{ "Event": { "published": true, "date": "2026-04-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-11", "timestamp": 1775952182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "66b99bad-623e-4db3-a7f7-e7a7ad82d650", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f1dc9-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911717, "uuid": "826d7160-a022-4b8a-9ea5-9ec26c8d35e7", "comment": "Malware payload (Mirai)", "value": "12d3b3c88478a01031659302a34d1339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911717, "uuid": "d7b807bf-f8d3-46ea-989f-a11b69f6ec14", "comment": "Malware payload (Mirai)", "value": "0041d4ca26c4ad656abef788e1cdf6a01036c62c624b79929a4caee227dba1c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911717, "uuid": "670ddc1e-5afc-454a-9a02-83f861bd39c1", "comment": "Malware payload (Mirai)", "value": "05f04ba7843c3725c0ce57d6744765a6702b1245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911717, "uuid": "9c22db23-52fc-420d-ac6b-3e231724fa97", "comment": "Malware payload (Mirai)", "value": "a53fafbd262937d4ead6bf69adddc18d144ca7d16e20196bca0b68edec1c4e0d941fde401113a92d36e22528e0cdc832", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911717, "uuid": "295ebe64-44f6-4f4b-a8a0-39ebf827a4ae", "value": "T178434AC4B183FAF1DC05017C307AEB325E33F0B6613AED9BDBE45573A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911717, "uuid": "4611f29a-c5ed-48eb-945b-7f7feab141e4", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WIsoPMdQZl7dDFfG:xzuXndFq4ZthB/VUfOWhoPEQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911717, "uuid": "8a4a88d1-621d-494d-943d-62fb4a3ec694", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911717, "uuid": "724f0d70-7fa2-4720-833f-a363918e0b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911717, "uuid": "02592e31-84ac-4697-be06-4938f688c650", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d988cd8f-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888134, "uuid": "d00a96cd-43ef-4b4e-abfe-8831983f68e4", "comment": "Malware payload (Mirai)", "value": "b2e15f15f763e640b5f9a276998e9366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888134, "uuid": "38b39795-dcff-4aa8-a492-209fb29bb965", "comment": "Malware payload (Mirai)", "value": "009f1f01ec504d471dc25b6a5b268d40b146dabe3ee6091ebe40cfc0d3ced0ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888134, "uuid": "724b94a1-8565-4ab1-87dc-1ee9cd7b6d3a", "comment": "Malware payload (Mirai)", "value": "23eaa1c5a929e0be80f1fbe20b7a3ba321d9c1bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888134, "uuid": "b7ea9f51-e005-427b-a6ee-4874e6ffd008", "comment": "Malware payload (Mirai)", "value": "ac8063a663f6b03a011e3afbc21959f2948d6f3c5c7262a50c81728379d27db0821def995010ff944a8b1cdd4ceeaab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888134, "uuid": "f9b77f8b-f8f7-4a2d-966e-c486298b7dd6", "value": "T17C03198BB4929A6FC5D4537AFA7E159D7312F399C0CF3B07CE088F65228750D98AB940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888134, "uuid": "0cfccfa8-6559-4d96-9081-efd31569318e", "value": "768:Uglm0BfxO/qTFcqjDfgTm+8CBcsE2Wo9c2bJW/RvoS:UgsQ9TpDfgiPx2PcyJWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888134, "uuid": "8a67c81b-e35c-4fdb-ab44-ba2ea9b9e40c", "value": 40048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888134, "uuid": "ea02056f-fc8f-4536-81b6-f2537caf4e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888134, "uuid": "b4a4c232-5f94-467e-b641-2f2d12e50446", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80730927-35ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775915902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915902, "uuid": "6f6ed099-141b-4942-8071-803143f42650", "comment": "Malware payload", "value": "805b5ab616ee3764d64d2488144631f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915902, "uuid": "fc19a963-ec4f-42d9-8a76-2d1aceb55748", "comment": "Malware payload", "value": "00d97ce94ed699bbffdf020f061e54ae432f61d782828d761bbb0a36ca2aa5cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915902, "uuid": "43c0c51d-ebdc-4d00-90c8-d4e7c8aa6134", "comment": "Malware payload", "value": "73d54f885f7dda8ab8c7001492cae58c775f67b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915902, "uuid": "02a852b3-3fbf-4fd8-a851-b412827eebc0", "comment": "Malware payload", "value": "a9c7fda2bf50b28d254099f09791d2ff5b9834b337c49d6adcaa03c1a7640647b0ee617f5e8356cb244293c893dabd7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915902, "uuid": "01a1a361-eed8-4995-b76c-ae367b5eb5c4", "value": "T1FF362A02A8A64665C26AE134BCF253513B31386443767BF30D97617A1DEB7DC2E2F31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915902, "uuid": "f6f0d410-2986-4c08-a089-0ebaf36a84b9", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915902, "uuid": "f94e7241-aa66-4530-9e6d-b7150e77d5cd", "value": "49152:8qegQhNHqvspMZdu+4FyPcCr8WA90o3DAVUZ1fEX9T7GdSJyys66yl+WyqwuBxRG:1F6qkG3yqwoxSRHo0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775915902, "uuid": "d4030c28-2cd1-45fa-b602-ba2fd1538fa3", "value": 4895141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775915902, "uuid": "95ca189c-e280-4872-9d7d-eb99abe6b595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915902, "uuid": "ac681d0b-4824-449a-aa58-3b5dace8fee2", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d05b1f7-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939035, "uuid": "83e39708-5882-4531-b951-6f20cca20270", "comment": "Malware payload", "value": "4fd2128e4b4549c46e2c112e7dc34096", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939035, "uuid": "7c66d9c4-73d2-475f-a1df-e87dc54af5f2", "comment": "Malware payload", "value": "010601e408a090be561e10c23ae17342d8d82ca65b2b280215bb9268bae8381a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939035, "uuid": "ded8094a-6fcb-41ac-9d14-ac68573cd9e1", "comment": "Malware payload", "value": "f243b93714ae55372bb849f7193044e17d6b146f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939035, "uuid": "1a8e09ca-5462-45e8-ae8a-ae6f6791f593", "comment": "Malware payload", "value": "641b7aff39023a3d3ab960064c5c9876f3d087dff1e16baad21068cbb733e386a9e413e8cc294b5d9999ead4836b14fa", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939035, "uuid": "0d9291ab-b6ce-4888-84ba-a19c0e791993", "value": "T1B7E022F8AF16FE36D0B0C8B5C11BF3210F613A0A0A8DB1B100E8A491E8701893E2A066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939035, "uuid": "a3543f61-8b0b-494a-bbee-ba5538786dea", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrlllALFSHxIuFhFyC6PJSHKuLLGPer:4xtJCUOblw7BJYXHp2LgquFTsuLQebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939035, "uuid": "c0d27ea1-c6ab-416e-93c1-16b887bf337a", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939035, "uuid": "a5c80a84-3b93-41bc-84e8-38adb0fef82a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939035, "uuid": "57912dfa-6881-45f2-93a5-5f1f21e66a9a", "value": "JoseTomas.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd24fe9d-35e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775937961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937961, "uuid": "77730b1c-44b0-4cf3-9898-64e9645dd2f9", "comment": "Malware payload", "value": "ca86a1f3fcd3d9cf286e64b4f4cf5f16", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937961, "uuid": "fa1767c8-2600-4633-9197-56cb7962eabd", "comment": "Malware payload", "value": "02e14c5eb68a31ac54e766a370ec1a68dc87e346293063d3e22f8a551a3a69fc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937961, "uuid": "bde842ab-a6ed-4a76-9f8c-5688bc619714", "comment": "Malware payload", "value": "70dbb9da894ab6aa071abe28a187ab706886ec1a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937961, "uuid": "cc3aec02-c318-4e30-887d-f88085a17aeb", "comment": "Malware payload", "value": "62a9a1a2d60a012e82d761af3b2291603807f6e7c7f59885486b5f1a89bb42d80341114eeec644c2e069eada09d8e5cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937961, "uuid": "3c3a687d-b64b-4474-97fb-f8a071369a3d", "value": "T1B824B733E6A288F9C49FC2749BCAD1B26671BC584174F21D5F800B127F4AF609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937961, "uuid": "d0705bd4-d55a-453a-b733-af5b29b127db", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937961, "uuid": "03f8ef0b-9d81-4efb-8a38-30ec1a3942ce", "value": "3072:e48PDJRje4K5t/SWsk0QmVQiMmYM4eD03u0KbuSpsrQvZP4DkJREJP5L5mf0:ibSBNr3RKbZpsUlJREJP5L5mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775937961, "uuid": "354feb0e-d41d-467d-9eed-49581e4e9e19", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775937961, "uuid": "4dd32efb-0f10-4203-af68-180c53137376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937961, "uuid": "11f5e010-87d5-4c67-8184-c9a38ed3ce88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd13dcc-359f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775909616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909616, "uuid": "2ee5a563-f4f7-4662-b42c-230bee220290", "comment": "Malware payload (Smoke Loader)", "value": "164555e2792fdf7feeab21ce948e5704", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909616, "uuid": "e1d1d9b4-d7b5-4656-97d9-83ca3e7571b6", "comment": "Malware payload (Smoke Loader)", "value": "03e99f0b808938dbed94635c8385b2830c6d4cd01388511176c91a3c38aa02d0", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909616, "uuid": "4b68b7d2-72d7-4ee3-acab-c7f754f533f8", "comment": "Malware payload (Smoke Loader)", "value": "de1e4ecf9527fdd0b2fc337175ac67d6fce0d301", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909616, "uuid": "d5e2581a-2282-4c18-b9de-bd026868d6fd", "comment": "Malware payload (Smoke Loader)", "value": "ad819426f16d586feb7e2963d1a0976c8459b17bee4ede7ce005d94d1fb7c202b2374073cc8ecbef03ecfea5449cd3e9", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909616, "uuid": "9328fcba-f463-48cc-86f2-ad24b10254b8", "value": "T10FA57C0BAC9548FAC4AA97358CB71591BB74B8090B3233E72E91BA783F727E05D74744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909616, "uuid": "b8a328e4-1385-4d9d-9725-d2038cab0975", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909616, "uuid": "4b07db01-1bd9-4fda-9db6-0c97f4a54e21", "value": "24576:IdfdABSB2y3EB4REWCpJkF3p/adCnwA7Bys5wm6uEFhheleh29mhPw+Bg9:IVdAIgyk4RE3wdp/aUwMyQsI+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775909616, "uuid": "87e67af3-8d1f-4821-80cf-225916d49cfd", "value": 2148568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775909616, "uuid": "d46df558-0f54-4e3c-bc76-a4c0db3e3073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909616, "uuid": "1a086695-4ee9-424e-890e-11a1262b4623", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4088359-35df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775937060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937060, "uuid": "837e3a30-3041-4707-8bdb-5bc79af330d0", "comment": "Malware payload", "value": "acb0d03cbac0f188fe4eb35131078c12", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937060, "uuid": "aca3e407-0bdd-432d-aa5c-6a26b5eaa3c9", "comment": "Malware payload", "value": "05bf99b8d1817cdc9450ce7128a0df9497f1475d1d0db21e7f528f83598c66de", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937060, "uuid": "5afbbbc0-3863-461b-89de-0e22076a32fb", "comment": "Malware payload", "value": "5ff587c228b64d1ad6c888d1b92d344e21cda658", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937060, "uuid": "2400b3bf-5071-46b7-b75d-c1aa7c45d58e", "comment": "Malware payload", "value": "7f7fa90ecf7d59b7f41e076072748f7f1dde86cfa4764ad17ab2b2c7515aad62dc55dc6b27176490ffaa637bab7c5219", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937060, "uuid": "ebb4cbab-ae3f-443e-a8a4-c0ea3312cc93", "value": "T14331EAA6F0039323F84F553910974E8CE95B937063DE81DBB76FC8155C505A91620360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937060, "uuid": "1166f38c-e93c-4604-86e3-07fc2358a870", "value": "48:9Z48z4a31KCmxxQdNiPN8QGl4eES8EgKeSzD4V:7z0pF8QoLvdza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775937060, "uuid": "dcd0cf95-5744-4063-a135-05b5302ddbfd", "value": 1675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775937060, "uuid": "f90141c4-9a51-4e15-9dcc-c7ea2ea13928", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937060, "uuid": "4f809222-e8a1-459a-b3a5-41f6211ae277", "value": "IMG-257980788.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e7ce50-35d6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775933116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933116, "uuid": "30dc8f47-b97b-4505-ab85-be150e546d63", "comment": "Malware payload (RustyStealer)", "value": "37142e4f9e641e80a5a1c9310e49cc53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933116, "uuid": "4d9de28f-05a1-40ce-9e13-56c58d9ee623", "comment": "Malware payload (RustyStealer)", "value": "06403d557b2c9521627ed5550620ae37a61229b1aa306a43f98d99aac183cabe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933116, "uuid": "770366f2-c95f-4364-b156-f8dda7bb093b", "comment": "Malware payload (RustyStealer)", "value": "d3dcb250bbbcae9479cff4da992e56053b061258", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933116, "uuid": "877a8a2f-dc05-41ae-9296-fda4106b318a", "comment": "Malware payload (RustyStealer)", "value": "9eea2019a203721b0c977ae10956509a8c56c554064506f744375baea30121b61f7d71f6bbffc2b151a2eda25c5b4149", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933116, "uuid": "914c621f-ffd7-43b7-9eb5-032c5572b2ec", "value": "T17FC50209D5A420CAFDBCDD3B0D0457FED2F09195B97A28D9A798FB65116E0F087B08A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933116, "uuid": "5d1ac915-05aa-40d3-9967-428e3957fbfd", "value": "9f5834b017ef95fbbb26f2ac50e0c90a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933116, "uuid": "2d3d7b97-719f-4b78-9b93-0a35817a3f79", "value": "49152:/ht4De9TCWoFSwz3x1NcNkSCidPd2rHDA1ky3SUkBS8:poFdx1NcYiP2QqHUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775933116, "uuid": "c05efdd2-0f81-4b8f-bd0c-8615ffe4bbf2", "value": 2698752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775933116, "uuid": "c8ce3f5a-791b-470d-b157-986ecf88a09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933116, "uuid": "d194c0de-baaa-4958-9967-e850bacbe7f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635bf812-35af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916282, "uuid": "ad56b03d-4e80-4ca8-b9e2-e91597dc4fdd", "comment": "Malware payload", "value": "9e16041e0f9860d8da98ae979f1c46ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916282, "uuid": "5869effd-5992-435f-8484-4c11377e3e89", "comment": "Malware payload", "value": "06f80270c9e7d47d461a37513ae66c9fcc7f6c43d94859bfce95c77578da1d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916282, "uuid": "b0860eaf-5812-4f6b-8231-f84acf99c5a5", "comment": "Malware payload", "value": "137bea51ae9350a3174530e5bcc4a124e20ddcae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916282, "uuid": "efc928bd-0d2f-47fe-970d-6f4aa0275ba7", "comment": "Malware payload", "value": "d2ce58cc6dfd72b61ede8740b9ca3c20e3bf114dbc6fd2bba4493c3955e74ae9c83e2bbcde59f582f3cf025fd30a9503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916282, "uuid": "ac95eb44-5134-4365-9dc7-13c85fc203a9", "value": "T12C757E12A488B115E331333F27DA7802415BAC5DF775EF92B2530494634ABDBB8626FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916282, "uuid": "3e9339d1-c3a6-49bd-9873-73f27c01a845", "value": "63eda700908e22cfe87281ff0f7dd60e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916282, "uuid": "9a5a257f-8ab8-4599-af38-cd427315d6c2", "value": "24576:jMUHHIWG4xAQ8AQarKLmt2cohBk3bxqbInt7sSX8+ZyWMVl0+FqysSOuRIPX/F1C:jpyIFaItj8mCWDPMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916282, "uuid": "dfe0f53f-e773-4cfa-a349-bdd2ce2129db", "value": 1655720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916282, "uuid": "0eb8b0ef-4ce2-46da-8d26-e5b395941185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916282, "uuid": "5bd316bc-040a-42bf-9b8e-1c8d542d47be", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bb6b1c-35fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775949257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949257, "uuid": "57b652dc-92c5-4f0f-8f77-3bcd3c749064", "comment": "Malware payload (Mirai)", "value": "34041bd9aec2e25e853d3a0b7ce3f9db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949257, "uuid": "832c3a8d-3dc7-41c2-a534-2ef807c03287", "comment": "Malware payload (Mirai)", "value": "08892b942d00c640a81cdede68d06e5616cf080b6362b0c1dbc7ec9f2ce7a8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949257, "uuid": "3a83c627-9b73-4fd7-adf3-ec3f4e3632b4", "comment": "Malware payload (Mirai)", "value": "ae0ae826a82d84e8b8c927382347c72eb7cf55ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949257, "uuid": "56d63138-c918-4e10-b029-1c896ff90f56", "comment": "Malware payload (Mirai)", "value": "2e76e92db8a53bbdaedc0fe889070928e498943634667cba127608c67a678116cbc962639ebd75e3c103104495aff244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949257, "uuid": "4d34043e-6681-4794-8201-bb3b12ddbf50", "value": "T194143B02731C0A83D15B6EF02AFB17F183ABED5119A2A544F62EFE845332FB15509F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949257, "uuid": "ea2b7d7b-ad9f-4813-ab85-842f3b67dc74", "value": "6144:fsf0gAGFmz/x6xNbojKlTkbFJZmTK4+Ehj681A2hNNmt1:0MgAGAqoWlT0hmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775949257, "uuid": "04aa0807-5599-4996-b95e-af1a326f5a9a", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775949257, "uuid": "a8a41bcb-14ec-4ac8-9b1b-d950516beb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949257, "uuid": "67ba1d0f-9ca0-40ca-98f6-35896fc3d449", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d51a3d-35d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931218, "uuid": "37aa4466-3967-47e8-b18a-f053e8bfaab0", "comment": "Malware payload (Kaiji)", "value": "81848644a2abe0f844960042c0fc6d80", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931218, "uuid": "2b669801-b237-4015-859a-48f7640ebca7", "comment": "Malware payload (Kaiji)", "value": "08eba95ef63148053a58881aae8bd736aefa25c7a9188489658f26933c71a236", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931218, "uuid": "888d278b-8717-4bc5-afb4-035fc5924226", "comment": "Malware payload (Kaiji)", "value": "5371eb84d25cb1fa6501b0e94f1d5cadf00f8138", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931218, "uuid": "ec85f4d7-da52-4e2a-bbaa-c799bfdda36c", "comment": "Malware payload (Kaiji)", "value": "195cbf9a1c1e7fed99e337d87248230a63cbf15d24bcd8f43689163ea84855d4afee6a1d520db3a3f5d21538168a1568", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931218, "uuid": "8f84dd6f-ebdf-4f8a-a2a3-16d571fe3581", "value": "T179B171CA0D47E4B292EA9E2662D451ABCC8461D3D9E51505F7CCBF230B78AA4F721ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931218, "uuid": "a22ca907-3579-4353-a7ca-514f510548d3", "value": "96:q2sQC73wC734/jtxIAEzgsC/ofpC73gTA0zC/Jtg5/JGq:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931218, "uuid": "b6c804fe-0e07-4501-b2aa-3a5f81068f6b", "value": 5175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931218, "uuid": "f0ae4018-9fc8-4eb9-9309-a5c88181df05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931218, "uuid": "3f372922-edb3-4991-96f5-9c1468c0d1c4", "value": "download.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b022a5ed-35da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775934879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934879, "uuid": "7ff4ca7d-072b-4394-9ac5-b9180623484a", "comment": "Malware payload", "value": "fc42490c6f0d918aa9e4746e000ef729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934879, "uuid": "d7f45520-8e4a-4664-92b3-f4a93ba4efd2", "comment": "Malware payload", "value": "08f300e96c71192a8b119efbf59f8c7484ae89c2982a8b732c0a267e88872c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934879, "uuid": "68c5ead3-ac70-4277-873c-bfb3c3d50761", "comment": "Malware payload", "value": "fd9745e2c2815e4d87a5aa2b03bacac69e358eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934879, "uuid": "7b16a4f4-187b-4415-a093-ec6e4d71147b", "comment": "Malware payload", "value": "93d3d5699ee44bfe1ab77805c8c64c4616b72890257419d219726cacb09a3a3dad4c5e1bb0aed570bd488c84956c3316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934879, "uuid": "205a7971-d634-4817-9f9d-002f2e26f820", "value": "T1FD047C56B7A900F9E0738139C4921A07E77278215760ABDF63A447769F233E0ED3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934879, "uuid": "39dd6f26-0d13-4ca1-81f9-525f818a118b", "value": "33b362e6e005d5dd66190710f660f7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934879, "uuid": "cff653a2-9917-4b1b-94aa-a4aa3c3c9d32", "value": "3072:26xV1W+/+fEppz2DqtLquNHv6vrHRoU4+WeW:PWQ+kp3xBayQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775934879, "uuid": "55deb896-405f-4b2d-a7bf-9bc593a44a47", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775934879, "uuid": "67824ced-a4f6-4056-b1b5-781c96fd6f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934879, "uuid": "e89a1f91-cc48-4b81-81e4-615b2aaefc21", "value": "wowk_netlock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505a19e7-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896494, "uuid": "cc80d050-08a7-48d3-a0e8-f945c8a5d374", "comment": "Malware payload (Mirai)", "value": "5096f96fbe3b14d93d5d2aa93225012c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896494, "uuid": "67eb9d25-1ab4-450c-a03c-b45ad9cb4f83", "comment": "Malware payload (Mirai)", "value": "0951aa8d3d886f907873c0f912845f01f0ae7e08338c634e0f188c72021ff900", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896494, "uuid": "ba4985b1-d0fb-46e1-9299-19600ccef328", "comment": "Malware payload (Mirai)", "value": "7eeabe90ca201b43cec404e411abc2ad0c56d312", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896494, "uuid": "0ffa02dd-45c5-4ffd-9e96-4c8b9a69f579", "comment": "Malware payload (Mirai)", "value": "c3a6202ee21087cfe027ddf9815e6155a0d3d14a0036f388f557df961c6dfd19224e45fcf70f8093dae8d99f19136cfe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896494, "uuid": "1ad6efac-73a4-4ee7-9ad3-3964e2e71d2c", "value": "T1F2F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896494, "uuid": "b233f065-b3a6-4784-80cb-1e6c3382afb2", "value": "1536:GdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpAEn5p5M/LW:I7vDtrnPTR71gmX7Dy7fMpAxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896494, "uuid": "aa170a10-1b91-4af8-8244-9f0c54f5b12e", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896494, "uuid": "0e190069-9b2f-42ac-a0b1-8cdefa0e4e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896494, "uuid": "775db2c3-b95c-4658-b65c-66c58be9972e", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bfed13-353e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775867834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775867834, "uuid": "33e71287-28ab-402e-803e-67061915feae", "comment": "Malware payload", "value": "5e46c0bd5615161a59a60ae4cb649777", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775867834, "uuid": "a201e111-b9fb-4821-8ef4-daebdce456e5", "comment": "Malware payload", "value": "0abdbdcfdcecc4b2d6eab08ab1986b941c9a88062abb00b7c97d7ff551337541", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775867834, "uuid": "c5ef0450-240c-47fe-ac05-af95b07775bb", "comment": "Malware payload", "value": "b968cf2944add497809a7187509d6d7e89e94a5b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775867834, "uuid": "fc8c18f3-7968-47ce-be24-ee58ec7a2ca5", "comment": "Malware payload", "value": "aa3fbf6a94cc37d50c3ec9231c2f0a7c30641132d47b199c7e3ece09650c7893a8307f7876e33c9a5c1294204abf3a7f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775867834, "uuid": "846c0cd4-da74-4201-ab48-8f65f99f27cc", "value": "T1CC24C633E6A288B9C4AFD1749BC6E5B26670BC584174F20D5F804B127E0BF609F7D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775867834, "uuid": "e9b9c206-a4dc-437a-a1a8-35f015c17c01", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775867834, "uuid": "31cc8463-4ae2-4d99-859e-2c785f3aa6dc", "value": "3072:cVgj3QDJX288UcTQmVQiMmYR4A96RD7o1mNDc4SJP5L5mF0Oi:2Q3WJoRD7o1mNDcVJP5L5mFBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775867834, "uuid": "dd0d30bd-a348-4f77-a1ff-adfd907607e6", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775867834, "uuid": "e109ae41-1821-4b31-b544-7ee9bf9af980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775867834, "uuid": "3a8f3ca4-0c7c-46a9-9f3c-153cc421fb83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bce5eb-3564-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775883936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883936, "uuid": "11e03c7b-92e7-4621-ab64-6ac32ef6dedf", "comment": "Malware payload (DCRat)", "value": "0aee94dbfa5bb7b6eeac2f91ece36ce9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883936, "uuid": "3a9af186-cb66-4330-8c61-6c54163362ef", "comment": "Malware payload (DCRat)", "value": "0c18f05173848fa221931c19fbbb231bcb8f2e20083187fb01ed6a468f4ec959", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883936, "uuid": "5f17af3c-02c1-4a7d-9884-f00247804c47", "comment": "Malware payload (DCRat)", "value": "424a31ae83f9111eb5ae9b038c617d197fe48c3b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883936, "uuid": "9e57157b-718d-47ed-ad0e-7fd932d5cd7d", "comment": "Malware payload (DCRat)", "value": "8e961901b6c5d6c3abc89657adaa2953ea53d37b187f87445882bc1c1e1f3b9155943a7bf6f623ee9fd62ef8a397571d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883936, "uuid": "b75ab32b-5ef3-4553-a598-e851c9e65405", "value": "T12516F2427E80CEA1F0191673C2EF520447B4A9106BA6E72BBFA9337D55123937D1E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883936, "uuid": "34f4e879-f1c3-4917-a44d-9af487ad4fca", "value": "82b074024f610a57407a46b239670a2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883936, "uuid": "c3da7329-065a-43fe-ab64-83f577dd943f", "value": "98304:mbbzx+3YGfZNMGFWmkukCbYvziRNPRmB58hSKH:mN+1RNXFWuksaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775883936, "uuid": "e2c740f3-2210-4943-9ba1-fc0cd2a6798f", "value": 4135932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775883936, "uuid": "50d21d1a-297d-43ef-998b-8bfecf8fbc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883936, "uuid": "883c1f47-cf00-4c1e-a956-3c08300f99ed", "value": "0aee94dbfa5bb7b6eeac2f91ece36ce9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d980ba7b-35f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946116, "uuid": "596bfe89-f308-4b8e-bac8-f7d4eebc334c", "comment": "Malware payload (Mirai)", "value": "1c4c2eab30535fd8dd69b65694bb5385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946116, "uuid": "f930ea80-b391-4444-8abc-919d0b3d2c89", "comment": "Malware payload (Mirai)", "value": "0c4ae821ce832d7a895f4b2997522b92c7bba93666ea76b9fdccf8fa91c32da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946116, "uuid": "48ddf23a-2ff5-407b-903f-6c347ce5c333", "comment": "Malware payload (Mirai)", "value": "ffe144e10d7a2c2cad4583d2d1561a0059fec09a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946116, "uuid": "14611f17-4110-4445-808c-575d58ccc4e7", "comment": "Malware payload (Mirai)", "value": "cc00df14a17b4f7a6742e2419d2d21f2370fd1216a246a27cd7143de15f278b627db128c0a7bedf8d8913b70bc3a9274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946116, "uuid": "309b0bdf-4930-47af-8973-647476104179", "value": "T193E37E85F643D5F6EC43057121BBBF329A72E47A102EEE43D3B91A32D951602C61B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946116, "uuid": "dc6eb5b0-4a65-42c4-9f55-4ac6837b055d", "value": "3072:Y3hBM9pyJZVUbeqbaXjksUnBQtqJyr8Xu7ys2Xeu:Y3sjyJY+PwXu7n2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946116, "uuid": "2f0c9bc1-1a1a-450b-ae07-a593f8d2085f", "value": 152352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946116, "uuid": "d4787f4f-dcc9-48c1-a834-00acabda68d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946116, "uuid": "c45b3d04-d445-44f1-b021-8f95cc72210a", "value": "ciubuc_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f2441c-356f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888846, "uuid": "b8692849-0f76-4763-8d67-1065b7fb66fe", "comment": "Malware payload (Mirai)", "value": "c9e7a0b46ea80686349ae69965ea6e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888846, "uuid": "1fc34505-5e12-415d-a25a-b4c0f8de5f2d", "comment": "Malware payload (Mirai)", "value": "0dd6ba5913c2835fead82b07a9375753e915d1ad595a1a26199781faab271202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888846, "uuid": "335e1832-eb02-4e58-b6cc-106cced8d4eb", "comment": "Malware payload (Mirai)", "value": "c3f634c3a443cd41b4527d56253f1b99e24b13e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888846, "uuid": "c817bf11-e74c-41c0-9c1e-52adbae37b12", "comment": "Malware payload (Mirai)", "value": "d6f07fe8aaa8cd443a61f8ff9b94e832c1858513bf7d5ee99505493234d8425ef21a11975e73c063d7cea57549f9a52b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888846, "uuid": "ebf6c804-d193-4cbf-9e57-3b15cde2de8b", "value": "T199A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888846, "uuid": "a0299f8d-1068-4f10-a6f3-4d391d508aa1", "value": "1536:yk8NZJjWAaoP3cve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBaovzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888846, "uuid": "f09bc610-d9d8-42b8-8ea0-e71e5b7d0f8d", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888846, "uuid": "377845cc-89b6-4503-8e8f-c83588f1f10b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888846, "uuid": "343c2ed8-e778-4aa5-9f17-9eee39d69927", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870c7802-35c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775927080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927080, "uuid": "0129dadc-8e75-49df-8e59-0cc2bc736246", "comment": "Malware payload", "value": "ec969141723adbb734adf1e8bc3e94bd", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927080, "uuid": "855f5836-c225-431a-b613-dc4c3a0e8f04", "comment": "Malware payload", "value": "0ea73b239544733942da220669aa2591a4b14d25e4d26a177fd46dec8641a3f4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927080, "uuid": "8a18f891-c13d-439b-bc7c-5e2761189552", "comment": "Malware payload", "value": "f9306211a64c6a8ccba885b0d74e2fc1efdfc4c3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927080, "uuid": "d76f870e-55dd-4ef2-85e2-d286f8466de7", "comment": "Malware payload", "value": "aafc98230dcf1432a75d671c0859682b1a1b922c8cdd40513f9970fa1f9a33aeb5fb1d6aac20f5e5372249d563ad699a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927080, "uuid": "1db0c979-209a-41a2-b75e-89fc7ebcf04c", "value": "T12BC353CA4E9E88FCC75FA028454FAC43DAE69317060DD6617A9FED803F22D6464EE5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927080, "uuid": "975ff842-4c3f-483c-b224-8271e3fffad9", "value": "768:/uhnSiioPBwMZW3Pv1NlaexzvDCmUWhaUusedujFhuSuduV8uCuvuwrTBog0qRyV:WtFioP3vOLrdM3/MY1DD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775927080, "uuid": "272e6e0d-474f-42f6-bf4c-ccfae6534918", "value": 129121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775927080, "uuid": "2c31d25d-059b-4a40-9d47-2faaaa5a2fb8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927080, "uuid": "3f4a88e9-191b-4984-8a29-cde30703ce69", "value": "Nova_Template_Home_7204.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c90d2d7-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896514, "uuid": "ae90c490-17d9-4f5d-b400-95578a4b57f3", "comment": "Malware payload (Mirai)", "value": "9df43d23f01c46593c5fee68bab481aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896514, "uuid": "a8a6e3e4-8aef-451a-aaa8-2559fb43f985", "comment": "Malware payload (Mirai)", "value": "0f02a738f46e178daaad029fcc173b213ca9c503becc90656f83527878aa4f90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896514, "uuid": "4e1b5260-040f-45b5-9a6f-ff106808db5c", "comment": "Malware payload (Mirai)", "value": "b9d2c169496995a333b555bf05c933e1462506f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896514, "uuid": "27d6129c-8cd9-41f2-a001-9d98fc7adb74", "comment": "Malware payload (Mirai)", "value": "3bb8624cfab8ed70407e48065ec99250406de9c3b3553467ee76c977d137269be66d43a02fd8f3a7f6d19a4ce4d860f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896514, "uuid": "abf0a27f-acea-4789-8485-97c168fbfe53", "value": "T1C323E14BE1176590C279ECB76A1C95D4CCE3F82273591FCF00D775AB5AF68F00AA0A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896514, "uuid": "47d59deb-f889-44dd-9e74-25cd594e0a75", "value": "768:ow7ka59WXVJViF3Zeb+vDFTxCvXgyApeWfGLTV12YtRrsRF952huuX28kSj+jIKv:d5MNiF3wqBTxQwyAUW+LgzSmnj8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896514, "uuid": "f37041b6-dbe4-4957-8c88-7869d499972a", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896514, "uuid": "b3f47aaf-a42d-4093-ac96-636587dc559b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896514, "uuid": "cab9545a-3fcb-45ca-9b87-f3db0c9a3871", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f53a5ee-35c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775926047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926047, "uuid": "0699f051-7403-46fb-a76b-314e349451b6", "comment": "Malware payload", "value": "92a370c27a2a8702b8138d9750c826f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926047, "uuid": "8495121e-e053-438c-a166-113c5ab65d33", "comment": "Malware payload", "value": "0fd1c492b37de5f252aa037dc2dbb2a148779e036f9cccdfab4d4b2825094717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926047, "uuid": "e26def95-904f-47f6-9757-3dd5df5dd674", "comment": "Malware payload", "value": "a7af08869cf330559f1e990248b6f38f5243cb19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926047, "uuid": "1f3c1d5e-8895-4e75-b012-e22256405929", "comment": "Malware payload", "value": "a1bfc6366f611377daf38ca790ef24133d71a1aefbd0450a14530a24db51270ef8c8a3e8c9fd32eebc3ed41dc0df9378", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926047, "uuid": "1fc72bf6-604e-4e15-86c8-1ce86a4d5cd0", "value": "T1C7E068D4209B04D680D81D5F72B7A408A9CA9B4ECD0A6FB8BCADB0A7A768E04D0C60C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926047, "uuid": "0f976bc1-730b-4e8f-afe0-73bf375f9ce9", "value": "6:xLgLW4Mv+iFnT7vZsfuaIuOA9yDB2/vXUgoDu/oz+Q7ZYL4Tyr:OLWDvZWfIuz9yd2nXeDuim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775926047, "uuid": "e7e48f3b-6e0b-47aa-85a7-e683ff11d3c2", "value": 417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775926047, "uuid": "a013730f-a78a-402a-aeee-d9ff1d3092cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926047, "uuid": "a9e7555e-8686-4590-9b47-704f2c5bef99", "value": "gpon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b257f411-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917274, "uuid": "8d3a11e5-619b-425f-aa3a-9aa31dc6da56", "comment": "Malware payload (Gafgyt)", "value": "232185a500fe87de890c320540d9ab4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917274, "uuid": "38f3cf37-65c1-4833-b932-649abc03b601", "comment": "Malware payload (Gafgyt)", "value": "1026d18a3dcf100cd77db3d88d32d2a815ec261503cc3f92158c6120eddbe057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917274, "uuid": "65f6d920-15d6-4417-8c2a-0651dcc9ba1c", "comment": "Malware payload (Gafgyt)", "value": "8e18e08e13df4c61fbf9fbf55c8ffa758ea22fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917274, "uuid": "cf1006e8-7083-4433-88c5-acbc23c3314c", "comment": "Malware payload (Gafgyt)", "value": "94ebdbcb07d6f10f8fbc744db0df21e0424212149bd681fe3324b816d8a36c408c389b6f8f8f127565e1a0dd30fa515f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917274, "uuid": "f8d2313e-7ba6-4443-b2b9-0d3025c7dbe3", "value": "T1F09302982A544ACFD973B43CEE604B95A8907C4B0C8AC297D7113D1E6C723D5B2FED1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917274, "uuid": "991435a7-28d7-4013-8152-72c4e79ced7c", "value": "1536:dzp3qF0zZQs0d00Ciad2L4k1CiFdtEJofC0P6KQiewuNBLAXmjJQ+yZhNR:jaFuZaCiad23MiFnrP/QieFuACZ3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917274, "uuid": "5b224e55-17ea-416c-aacf-681a13771f84", "value": 90128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917274, "uuid": "fe6f4417-540e-410e-83df-c7e826e8e26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917274, "uuid": "17a53c57-e400-4a9c-9343-ce209614ed2a", "value": "redis-proxyd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaecbdb-35d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775934448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934448, "uuid": "8aa0047f-6d1b-4620-abd6-aae9f245c6de", "comment": "Malware payload", "value": "4368fbb5dffada148d854d2dfce3dc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934448, "uuid": "84c85372-2efa-4b8e-a15a-30d173d184ba", "comment": "Malware payload", "value": "10a5e12422b28d885ee92fd4ec707d894c253e6cbc4e2534c57093e3a4446863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934448, "uuid": "5b24b75d-d80f-4cf6-9e34-03eeb1c55a5c", "comment": "Malware payload", "value": "389fbe22501e896e112c35ba3297cda17190b16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934448, "uuid": "7e435ffa-285a-4131-a4cf-c297856dc129", "comment": "Malware payload", "value": "2c3036d48601791673f59e29b081623ed3e11faba10bb9517654df8056ae1f85b78a0d41f2c8f6124f4f42e67e74cf5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934448, "uuid": "3dcea782-fb40-4a6f-a369-c0317432a11c", "value": "T156042917A695017CE1B6D2B8CE835943F77378864375A2DF13949AB20F23AD4AF36702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934448, "uuid": "0ebfe672-c863-4373-a01b-3467cb6ab1aa", "value": "1b455384606276b4594cc826974e02e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934448, "uuid": "b8effb67-3fb5-485e-a3e8-c827eb028f2c", "value": "3072:JoR3EkiXHnHmmbdVUB58wnr5Lha/WZr3LxcksK2LpqvNYdSRFlnqRn:JoR3EfXHnHm0VUB58wnr5Lh9Zr3LL2L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775934448, "uuid": "28d72549-3265-4c69-8f64-d4af5eefe150", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775934448, "uuid": "c0068c03-274d-4b12-aeb1-7b45e56836ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934448, "uuid": "dccd8d14-9399-402b-b5b2-6e8a7528c6e2", "value": "phosphor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7e2b0c-359b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775907763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907763, "uuid": "437bfbcb-a7cf-4bae-aea9-3af47eb35dda", "comment": "Malware payload (Mirai)", "value": "e1764cede7938c72168b169ff0e7a7c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907763, "uuid": "e392b554-b728-4d18-8703-e3e9fc29f107", "comment": "Malware payload (Mirai)", "value": "155b026df63972f068fd6153e3f2b844b69a5710ad291b560daf4e9e5eba3815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907763, "uuid": "c2f7231b-c4af-4780-bcca-f6751660bf15", "comment": "Malware payload (Mirai)", "value": "550274a3832525ea50db863673cb8e40b80656d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907763, "uuid": "4374e430-aee9-4526-a251-9fb4d8a7c8a4", "comment": "Malware payload (Mirai)", "value": "ba59e2e1eedb4a06a3323e3cff836edc3543544f51345c46a2e7d13e66e5d77e25ea4f86053195c120f10a3a3b4b5a53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907763, "uuid": "2c03c627-b997-4fb5-901e-188c4805f37c", "value": "T15E146CA9BA0FBD42D2C3D3F88F975FA5342735F08E5691F13D11132DC8D29DA89A0A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907763, "uuid": "04831ab5-a73a-40fd-b63a-4988adc11fc6", "value": "3072:QDwkhxonRtjWMQqO1SYshAn+rw/hZsdK7Jveoz6cjVgD3o2q:6KRtjWMQdsk/hZsc7xeofBgD3o2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775907763, "uuid": "17d037d0-0854-4ebc-b406-d7d5a55c5a56", "value": 194904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775907763, "uuid": "f5c1907d-ba79-412b-b2ed-6795db83d1a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907763, "uuid": "674b4593-c32f-4228-898e-2e0c2bd122c7", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4b6414-35a0-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775909778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909778, "uuid": "e3d6676a-0d7c-4d85-b32a-c26f4b6cfe83", "comment": "Malware payload (ValleyRAT)", "value": "d7078f1821be0bf8e5d9245a32825743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909778, "uuid": "82234f17-39de-453a-909e-e64b0bd0368a", "comment": "Malware payload (ValleyRAT)", "value": "1649aa15ff4adf65fafcaab19122796b23a21f506e6f3fe74d029483a8d166e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909778, "uuid": "aa95ac30-158e-4986-aa80-316c43d4377b", "comment": "Malware payload (ValleyRAT)", "value": "dee52105a37f3112710ce63602d0213091cb2f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909778, "uuid": "c6962074-618a-4918-9101-bac0bb0fb740", "comment": "Malware payload (ValleyRAT)", "value": "0f1be957131d0712b0a7a32b47e0ef324baba5481445bb16891ca3e1e915262fe135c09bd47d98cd5cea2d1dd9042e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909778, "uuid": "08468054-87be-4913-ba15-4493066a2949", "value": "T1C0E58C02A29501FDE077C634CA478532EA727C41B771BADF06D0BA572E3BAE05A7DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909778, "uuid": "b59e38a4-8026-4e6d-a79d-aae9f66cee1b", "value": "fc201832db8b875359de41cab619a321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909778, "uuid": "e66f5083-02eb-40ae-a6cc-7bb1b4ba8988", "value": "49152:/nG3KfzAi0eY4lOxkT/lyn79yJ7OK8rhkveStZy:efikSrIqvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775909778, "uuid": "6b8f3dc5-40ad-494f-b55b-0b26fcf2f163", "value": 3044352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775909778, "uuid": "8aeb862e-face-4c3b-96d9-72d193aa97dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909778, "uuid": "3d571155-7aa2-4ec3-ad79-98c414c6a658", "value": "1649aa15ff4adf65fafcaab19122796b23a21f506e6f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13cfe77-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896763, "uuid": "0a8df2ab-60d8-41df-a156-b40489879e62", "comment": "Malware payload (Gafgyt)", "value": "fd24e61f06ffb8ba759da7c920db263e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896763, "uuid": "a6370218-a263-4f88-87e0-7e1e9b7fa8d9", "comment": "Malware payload (Gafgyt)", "value": "16fe582641f2fdc51c4dcffc184486eaf214b722b049ff16d5dc4abf0f747eb6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896763, "uuid": "1b057646-f74d-4f82-8a61-1e50e0994a71", "comment": "Malware payload (Gafgyt)", "value": "22d2997c0c49904e0e22b9fe4e35510178d2f68f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896763, "uuid": "ec3e7dcb-9bee-4889-874d-790aa2560475", "comment": "Malware payload (Gafgyt)", "value": "db2ea5e89230e9718831de5b8f92e95826ab01210839a8426273413105cc6ff6efe864508cd6b135c51d7c80f8b6afbe", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896763, "uuid": "dd530313-4b8f-4583-baeb-ebfd80b19318", "value": "T1773132CF22E20EB0EC91A93732AA884475D4E1C754CA5F597CED39F6469CE157440BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896763, "uuid": "df9c54a7-acbe-428a-886d-3ea1c7c19009", "value": "12:q0FS8V0FSG0FS2c43fX0FSsAeekX0FSG0FS5UX0FSze0FS0fX0FSzi0FSol0FSJO:vt+ITc4kfAasYHs8bXsY35OZaFRKDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896763, "uuid": "19b10823-6101-4bb4-8da7-b24105c63288", "value": 1574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896763, "uuid": "df71d7dc-e8f0-45d4-857e-0752d2a6ab6f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896763, "uuid": "107850ec-e0c0-4ecf-8587-849d927b629e", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a525fb78-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775917252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917252, "uuid": "58d5880a-427a-495a-8848-7a50ee149a0b", "comment": "Malware payload", "value": "e84eb0a286c3635fe6cefb545c338a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917252, "uuid": "464ef565-b07d-44c1-b033-e28831e0f057", "comment": "Malware payload", "value": "17d90e18d16f7915ac07e402d15a49fc24260c88026bc751eaf7f86d488f0dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917252, "uuid": "a23ae1fe-9f4b-4523-a8f9-0783d43b0df9", "comment": "Malware payload", "value": "4b287fb25d45b5cfafdbd521ffb3ac12f98a2770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917252, "uuid": "31cc7501-634f-4169-abba-c996c1300fd2", "comment": "Malware payload", "value": "248c6f790749ef6eee41d478ddd97ea835395b750c166da9344e5c9985da448b109aebfaf28c7d7491f35990e5893425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917252, "uuid": "18fd3cb2-f69b-4e54-906c-e35e314c788d", "value": "T1D39312524B726170636CA03D0AEB44E303C1D5A6D8C4D1F49FEA4DF01B61DEBAB4DCA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917252, "uuid": "9b7c6c10-4cfb-4b85-b59f-79c88ff3af36", "value": "1536:yxtB/EM9SpeQcK7WcN9v0b1XefDg07ibICmaeU1TjMmMOPrr06lZ0EABA+B3utnR:kAeJJ0vIQlGbjt3XNlZ0EAKxrD6mjNue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917252, "uuid": "3714da80-73e6-492c-9487-1a55c4516364", "value": 96156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917252, "uuid": "a3cada98-79d5-4aa1-8946-0b847ec70345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917252, "uuid": "1eafb4fa-eb27-4324-99cd-e163dfca0955", "value": "redis-scoutd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f916f4-35a8-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775913364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913364, "uuid": "521fc02c-e2df-4acc-947f-b352364ea8bc", "comment": "Malware payload (DCRat)", "value": "fff1fdb13cd3a48d977a925d7d008c4e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913364, "uuid": "38a365e6-82a2-48ee-aac6-fd66cc4f47db", "comment": "Malware payload (DCRat)", "value": "180555e4cadadd6a56bd7fff0b068dbc77070a996e6b3b624ae64a4f5d535d4e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913364, "uuid": "cc80d1b7-713d-423f-bcfb-3c82e7bdcf39", "comment": "Malware payload (DCRat)", "value": "00bf970b72078fed45b92fc72afbb2d2047b8198", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913364, "uuid": "794d7288-d417-4494-8a66-c1ffaab54861", "comment": "Malware payload (DCRat)", "value": "7124d010111b640cb8f52439fbdc55e1dab7af2be17df1d44d5e958590de4b773140fd67a576db3467d6b8885660721e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913364, "uuid": "15f5899c-fd5b-45ee-866d-ddc89ac10212", "value": "T1CD455A027F64CA11F5091237D2EF850847B4D95166AAE32BBDBE33AE65123973C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913364, "uuid": "556d682d-86ff-4745-8004-489c5cfb90c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913364, "uuid": "af69efde-5883-4dc4-a288-8c96c46e192e", "value": "24576:vfou68ApuCOumeAeBwHXR9T48PZavJrZSLjzvOnXV:3P6kk6hauje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775913364, "uuid": "526cb8e6-df6b-4ba1-8ec9-f413e9347f8c", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775913364, "uuid": "004a0d23-68ef-4fef-a2c8-79c1aec62b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913364, "uuid": "a3397014-f636-402b-aed1-799a2116b94f", "value": "0180555e4cadadd6a56bd7fff0b068dbc77070a996e6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9af2318-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896697, "uuid": "38bf4c8e-eda8-4b4c-972e-15312353eed5", "comment": "Malware payload (Gafgyt)", "value": "5e6fff8a6eb39d228fb8947de4305800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896697, "uuid": "361e1888-7f47-4d4a-9934-89cf979a3e67", "comment": "Malware payload (Gafgyt)", "value": "18356277a213d154eb44012df535e6a6d1e5fdc3c852bc96a956726aef19ad5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896697, "uuid": "e04e3b34-e138-4106-b862-0540baa9e757", "comment": "Malware payload (Gafgyt)", "value": "8d9d4f0c75b93e9a839f707d11e32bf81bfc96d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896697, "uuid": "b2363787-85a5-498f-be08-2a026cff19f6", "comment": "Malware payload (Gafgyt)", "value": "a9d89e0eaaa40b904076f491831c1b1993fa3cbc46eb5bffb4b844cfdd1526d2834cba9ca299348006d10e42f9a8fee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896697, "uuid": "0bb9d5b6-090e-4137-bdac-5833560191ea", "value": "T13AA35B8AD743C2B3CC530AB2124BA6AA4621FD3B092E9F49F7197DB09F374C93125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896697, "uuid": "e7314d8e-5e6c-4e4f-81b1-77309f0820c8", "value": "3072:sWCjQrLpnr85EdT9Oa8vqbVr7h/CEgmqAgcVyZIcBI:sf5EdTbpr7hWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896697, "uuid": "e914a8e5-9b1b-424b-b6be-e2add49ce4e6", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896697, "uuid": "7af4e169-552e-4ecb-8adb-046e1c848aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896697, "uuid": "caee86a1-8fa2-4e4b-a96b-4702b1c12c86", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb2458b-3542-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775869535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775869535, "uuid": "203abeea-5b29-44b6-8bf4-8bdbc10cb922", "comment": "Malware payload (RatonRAT)", "value": "8224ea7a9ff71661935fd789daa9f603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775869535, "uuid": "7eb9135b-1578-458d-a509-c36d212ca195", "comment": "Malware payload (RatonRAT)", "value": "18d915d49dc0502363f9a515f53d1e6a98ecd40f2a65e191b87f604e74b13982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775869535, "uuid": "75ac9ac4-87c4-4b01-8357-75d63be1d0df", "comment": "Malware payload (RatonRAT)", "value": "5a6b32f736b2c33dba3663397d1c1a5f0b8a5bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775869535, "uuid": "3805fde1-2ec3-42da-b5fa-1e400c50b7b5", "comment": "Malware payload (RatonRAT)", "value": "e38e4ba3d70d5558cb603989cefbc7bb794b21fb1c34c3a7c7d8900123d7dcff3a962ed6275069e8d8c1984b82aec196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775869535, "uuid": "75247266-056b-4737-b0de-df4e0853ded6", "value": "T14E06F11973F841A9E1BF8678C4624616D7B1F8161B21D7DF02A096AA3F33FD16E39312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775869535, "uuid": "e2d61b5f-4be6-4428-bdcb-703c41b9f594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775869535, "uuid": "ec088c77-3453-4141-9d6e-53d72fe53da1", "value": "98304:75uO5mszgTSv3sm2zMgVUuHjkDGjzqpgmwQ13uRxfzew:/IszgTSv3sm2zMgVzHASjmh8RVew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775869535, "uuid": "94b79bf0-8a61-479b-ade4-2c47da4cae02", "value": 3883520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775869535, "uuid": "63204101-9c70-464b-91c6-50f1ddf33183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775869535, "uuid": "ceff6da6-7be8-4c93-8c37-f55344066e1e", "value": "prestigeinjector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a286a9a-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "d473227e-0f73-4b8c-8f2e-3507eb9d66f2", "comment": "Malware payload (Mirai)", "value": "71bf718c7e6ecdea4aaeb8796bfa5881", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "01d708df-8813-40ac-aa8e-34dfc21d3253", "comment": "Malware payload (Mirai)", "value": "1a0757bf4864c6ae5f4b6697368152b6c8f4dc755063d86e50c409d2baee8f98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "d14a29ad-e990-4c92-9feb-df74c2128cfc", "comment": "Malware payload (Mirai)", "value": "f8788e1c0c9116f7ceac6b938684fdd6c98b9558", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "b372fe58-4cc3-4ff9-b6c9-4628c80e6b94", "comment": "Malware payload (Mirai)", "value": "a59e00f84ef295e1a541f5eb96ef80af0e2cf709f26f808673dad79ced81831f220b93249c440c233e97c1ae6f69249b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "bf148838-27fd-4e6b-83f4-e54bf49e8d15", "value": "T12DA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "f71411f5-589f-4f85-8b7f-f4bcf2d385da", "value": "1536:7xufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXA/:8bU2RC4kPCtSzWu3/3L1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896510, "uuid": "86cc8d8b-c0c9-41cf-878a-1c8a943b2317", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896510, "uuid": "1bb97a6d-cc42-4f07-85ea-912552eac778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "156aae72-8cf9-4910-846a-e575ea1bead7", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba03ccb-35bb-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775921450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921450, "uuid": "f8ab0e49-06b1-43c4-9303-0766f4770c13", "comment": "Malware payload (DCRat)", "value": "22b53feeaadbd7ea6476ad635a085730", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921450, "uuid": "a31fe45b-c267-4145-b74c-5e1e1b809985", "comment": "Malware payload (DCRat)", "value": "1a1aad011a7b2f4db94fd1749260fda06e91c639c45835233e769612b50e2ce1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921450, "uuid": "3f4a4c26-d5b0-4318-b62e-3f6a7ffbe474", "comment": "Malware payload (DCRat)", "value": "307c67c7c4146af03dd10077b28801c0189e27ca", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921450, "uuid": "1c1a1ac0-217e-4f59-8d3b-32dda6193f5c", "comment": "Malware payload (DCRat)", "value": "bafd5ac104dff9db8e7478d080c945c403c2e4c1e35cbb422c75b9165860543a1d1a22b55e0e4331a93c119740f6ff6d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921450, "uuid": "4072a08f-bce7-452f-99a6-d62ad9fe3ca7", "value": "T1A9254A467E84CE91F0191673C2EF420847B499516AE6E32BBEAE337D15163973C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921450, "uuid": "898eb551-f8e2-4c47-9a25-0594961eee82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921450, "uuid": "f98db5d8-945f-4111-981e-bbe79e2c1fce", "value": "24576:6uL/SCCu2TIvwbOUMN64kp+RB5+2htcVDO6E:6ubn2z/8RB5P3c86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775921450, "uuid": "d47604f5-bb1a-4d84-b066-bb8037fd5211", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775921450, "uuid": "037bbe30-2baa-4a62-8663-c9dfb2e42599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921450, "uuid": "229315af-1333-49b8-a84a-87a057060871", "value": "22b53feeaadbd7ea6476ad635a085730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061aa1ac-359b-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1775907536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907536, "uuid": "296434d8-5817-422f-b42f-a139fe085701", "comment": "Malware payload (DiscordRAT)", "value": "0728377fdd9b05555dbd86916099b846", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907536, "uuid": "175753b1-79b4-4e3a-8334-e0d12b0ef70e", "comment": "Malware payload (DiscordRAT)", "value": "1be6a8d35632d5702bde202d95a972bf7a587367a21756cfd219b7bd2d47a615", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907536, "uuid": "aa0cdeb1-3423-420f-8a8f-0796b7dfc6b9", "comment": "Malware payload (DiscordRAT)", "value": "86f645347a33c9538bedcf50571a562463520551", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775907536, "uuid": "97d4aa51-efe0-4c29-b481-0883a7e93c55", "comment": "Malware payload (DiscordRAT)", "value": "0a3e79f59de4e1ec49948723e4766e8849b1cc49676df6c2a6344522b463eda3ee3aa78b835cbca634d92a1a1f3aeb92", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907536, "uuid": "ffbdb2cd-c056-4c95-a23a-8c90fdea8a5d", "value": "T13A73B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907536, "uuid": "d8298da7-e3fe-4c44-8b9d-8949b272eae7", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dAPIC:5Zv5PDwbjNrmAE+dkIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775907536, "uuid": "5ee49d88-b484-44f6-8e30-ecc70c600313", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775907536, "uuid": "eb80e4e2-50ec-4711-9a75-b5fc722c4bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775907536, "uuid": "2ba029a0-3d55-4b56-ab58-711e35f6cd39", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cd0bd1-35c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775925730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775925730, "uuid": "1ceade28-3b78-44f5-9501-d53410e03176", "comment": "Malware payload (Mirai)", "value": "838bd60301bd75258344d9698234dee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775925730, "uuid": "def1f93e-f0df-4e6e-bc64-e29d37dad6bb", "comment": "Malware payload (Mirai)", "value": "1c043275403d7a491c3d184617bd9241c3e4c73beac78c450ac8297cc94254d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775925730, "uuid": "f2021394-6256-401a-997b-5c5008b3f3a5", "comment": "Malware payload (Mirai)", "value": "347af1510361fe1937a9361497b9343d0400d888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775925730, "uuid": "984d52eb-dff7-4ac4-82a4-4eee2ae1ae44", "comment": "Malware payload (Mirai)", "value": "10ef738a0a2fe324155818745a680e3bc0e19e600b3ddf4301e6222d61bc0de88be088ed087899c93aea03e5fdb58322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775925730, "uuid": "2a1580a7-218d-4839-a118-fdd2b17d493f", "value": "T1F7343946FB408F13C0D627B9B69F42453333DBA4D3EB73069928ABB43B8775A4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775925730, "uuid": "a5ff5711-a250-400f-b85a-3e042b7ec2e0", "value": "6144:2zbrqmKRCA/fTN1aICYHaVqghjs1o6gm+9/V/G1osHQG:2froRxTN1aICYHaVqeQ54/qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775925730, "uuid": "7791a144-27ee-4c27-82ff-7972016611c2", "value": 247361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775925730, "uuid": "6bf785ba-01c1-43e6-83f6-66ebd6202df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775925730, "uuid": "abad27e8-6519-4577-9204-3f9481d0987b", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3c8441-3577-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775892378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892378, "uuid": "b504f1c7-3363-443c-9653-c5924863284e", "comment": "Malware payload", "value": "4701f4a411111c7df0e4b24dd23878f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892378, "uuid": "575ba894-005e-4c1d-8a6b-1c37cb498195", "comment": "Malware payload", "value": "1c7cdc98e74642be9e2e55a7766ea711501b15dd30af3bb9686b57d1ad7dd3c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892378, "uuid": "9892ea0a-fe02-4fe6-9a1e-8529833e26f0", "comment": "Malware payload", "value": "234d9f51527251f6b824c611f51021ab484a66c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892378, "uuid": "aba8c7c7-ecef-4f52-a124-c951ee92b9c0", "comment": "Malware payload", "value": "f7800db5d1fad1c0e5a5f2150f82acc6a72a19829ba8f3864479e75087897bd292c9c1d51069021b2662bdd413a4e0bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892378, "uuid": "f81766fe-1dbe-4fa0-b001-e074c7ba18c7", "value": "T13373F703E2E410FCE1C9D23893AB9A36DD31B8C956346A5E27443A122BF3E507B5E635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892378, "uuid": "dc797851-2afc-4ca3-a2b8-cdeca8abc610", "value": "1536:us0jU4VjcJ4erdbOdsXy+TglFy8A4lqL8LUy:P0jUhJ4erdb3Xyoh8A4M8LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775892378, "uuid": "07b4ecd8-ba77-4af1-bdf3-9dfb11743a29", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775892378, "uuid": "cd1458ad-78ca-4d47-9b8b-70fb7d7657ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892378, "uuid": "8d2e5c82-3975-4875-b703-44935d75d5ca", "value": "Kharon_https_443.x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b2bf52-35d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775931179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931179, "uuid": "5e08d736-084f-4e70-aff4-f57335dbf6a0", "comment": "Malware payload", "value": "f8c6961354ea3188258fc516607a5bd4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931179, "uuid": "12204d03-cf91-4c8a-ba60-83de7dc2cf78", "comment": "Malware payload", "value": "1d2b0dd75958dcef6623785096dc5212170f1b77d347ae376a0dedca686a6b4c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931179, "uuid": "e4889231-a5b9-4386-8050-d19583f580c4", "comment": "Malware payload", "value": "d2e0e8069b9d51fbdf0f70c425de55a3af7f421d", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931179, "uuid": "19a7d23a-a295-4650-b52e-1aac1bccf5db", "comment": "Malware payload", "value": "e94bd58b568520f649f34748f08d7f2a64624cbc5068c1b2e6f249caa2be5cc30298a5aba8b3db065de6721c7b792495", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931179, "uuid": "6095e550-6fc6-4449-ae86-c3644aa42e3f", "value": "T17424C833E6A288B9C49FC2749BCAE1B26571BC584174F21D5F804B127F0BF609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931179, "uuid": "de0253bc-9fb6-4980-a5d9-09193f0dec38", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931179, "uuid": "e9f9f17b-14a2-4ce1-948c-3ab48c1a11c8", "value": "3072:47iMqDJ+56ta7OaQmVQiMmY44O9yA1sbYSFcDA35dJP5L5mCU:47F6LA1sbvFcodJP5L5mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931179, "uuid": "783e4235-cd8f-4a09-948e-6aa4ace14ea3", "value": 216760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931179, "uuid": "a4cccf3a-89d1-4683-a6d3-fa7d46d8a6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931179, "uuid": "f698e991-149d-4685-846d-56bbb6b91629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd0eee2-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901002, "uuid": "256745d6-255e-4a69-8a35-bdc56d57e8df", "comment": "Malware payload (Mirai)", "value": "89ce4f2c4232be2c21ca050bb884acaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901002, "uuid": "ac3a59fe-f2de-4656-bf63-86fd15b06922", "comment": "Malware payload (Mirai)", "value": "1da50cb8ebf68660ecc61b87ae0d8ffea5646c82aadaf8f9313b993bf087c1ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901002, "uuid": "3d8f1768-d2d1-4525-89c1-0aec736ecfc9", "comment": "Malware payload (Mirai)", "value": "c62c52f42be9f056ecdfb170bdaa818e24be7aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901002, "uuid": "23f369a7-0a82-43c5-84fe-a3a8c7f77ecb", "comment": "Malware payload (Mirai)", "value": "64f3729046af71976d7a6cbc9011d0c605e6cf753d0224a5f21418660dd35906ef4aad7a39ef15beb9d4ae8d0c6855c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901002, "uuid": "50b2b311-0bfb-47c4-88bc-460e9d9164ef", "value": "T1A5F31A46F8818F12D5C512BAFE1E128E37131BB8E3DE72129D245F607B8A86F0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901002, "uuid": "9f1c165d-9f8b-4bf3-a5cf-4d0572b573c6", "value": "3072:x1lVLBayCMuUIjPdoXalga1CP5er0vf1l7/WE:x17LBarMuz5oXWgaQP5Nl7/WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901002, "uuid": "83101300-da8f-4a46-94df-235aaa3426f0", "value": 163964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901002, "uuid": "6569ec17-5e26-4182-9312-1ffbb4fe7513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901002, "uuid": "55ea35af-3a15-4cc1-b77b-4765dcd5a8e9", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32b1739-3595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775905249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905249, "uuid": "781f0392-a3e4-49d0-bc1f-cf59728a1f35", "comment": "Malware payload", "value": "452a47a98bdc3f1bc17e45f3fd66386b", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905249, "uuid": "57734167-ad92-4362-8907-217aa7ea0c61", "comment": "Malware payload", "value": "1ec6663dc16c71e406b35bb8b7e7542ed7823492b1c5eb040460abb6d6ec3f60", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905249, "uuid": "19852066-1564-4aa5-9a45-21e8cbb9dbf5", "comment": "Malware payload", "value": "20c49d655e1af8c96cfb50048eab5c9ec868f1c3", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905249, "uuid": "e285ec3d-df05-4361-a4db-6bb8a3cdca84", "comment": "Malware payload", "value": "c8221b99ca760f080d6fbd35e7fba7bc1254c237eefa444e0d4645d8a61e76ac082792d2e2df8411b6c3dfaea1450b51", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905249, "uuid": "c4f56f7e-0390-4e29-a18a-c8d511fd6b49", "value": "T11C924BD9493850C6DDABA83182EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905249, "uuid": "4c56738a-b76c-4a2c-a903-e173f5aa40af", "value": "47c3554d0dee53d4f925ed52484bea12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905249, "uuid": "c2356050-138b-45db-97e1-e70acfb706a0", "value": "192:oQNp/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/io:oQN85rVXcLr7GBJ1ah3yqvDyR9za/io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775905249, "uuid": "7c0add51-aed5-4016-ae8e-6a062f1b22be", "value": 19672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775905249, "uuid": "2db63bd8-476d-46e8-999d-3c262559b422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905249, "uuid": "1ddf54aa-83dd-4a58-a04b-5d408f8dbb7f", "value": "1.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d90b596-3593-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775904193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904193, "uuid": "5eb1ef27-f613-4767-8866-8e4f496abfda", "comment": "Malware payload (ConnectWise)", "value": "0fe7b02575e86b788ffa2f3a3c6c5eea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904193, "uuid": "f72594e7-5e6a-4585-b075-7f52d35bd808", "comment": "Malware payload (ConnectWise)", "value": "1ee01643e3abab0edcfeab34d4d18b3736221b986a6dba4c31e00e0b9a9dfb84", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904193, "uuid": "cf8bebdd-ec76-4c47-bdff-17999f9ab36b", "comment": "Malware payload (ConnectWise)", "value": "39df281e51e1241c77bf8a8a554a908605b77ff4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904193, "uuid": "384883ae-8a01-486c-ab42-aa96b0143704", "comment": "Malware payload (ConnectWise)", "value": "e0a6c4a81d1324991ec3a96b7b7e8eebeea83c2724f228efafb2f5504a32748a5ef705ebde1068a7a7bdeb3f2c63b8ab", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904193, "uuid": "0282fa2c-1a52-4258-956f-72509835b59b", "value": "T15B646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904193, "uuid": "91a61331-0c75-4011-9435-da70491877db", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904193, "uuid": "1004238e-a2cd-4f62-8820-a11bb73efd4e", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9WPv:o1iw7gryNkSV1hy1Z1u2JLa9WPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904193, "uuid": "6ac48508-3369-43e4-8fe4-7bbc1e048105", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904193, "uuid": "e1fee6d6-cab6-4309-9e64-0f41fd3ab186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904193, "uuid": "0e458338-41a9-46ed-8a4f-62a419434c5e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a708e04c-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775939159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939159, "uuid": "51ff1b70-dd4f-47b9-9581-e62b27fe2417", "comment": "Malware payload (Mirai)", "value": "cca864c4ce665c2015e6b6253b90aa9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939159, "uuid": "426a1ea7-95c7-4d40-8e66-d36f3f08b35b", "comment": "Malware payload (Mirai)", "value": "205d6f552a1abba9df080c3e62cc7e9f0e91a8dc238f250b4db080ad3917518f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939159, "uuid": "2916547b-6ee4-4b33-b51a-6d8249032d58", "comment": "Malware payload (Mirai)", "value": "09f961fa5ce963fb8d8f7af62cdfcf59f9acd9cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939159, "uuid": "33ce0d8e-7cf2-4da0-a697-130fc9ed863c", "comment": "Malware payload (Mirai)", "value": "b952b94d6ca0c7485810112c1055af4687aafa73ae11db2669bfb70052bef7b57253b06dd77669fd98eecc9a46188506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939159, "uuid": "c289793e-e84a-4391-ac49-04f9e52f97e0", "value": "T144F3F881FA43CBF6E44707F012B6AB334531FC3A442BE686DB65FE7669619C0E609358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939159, "uuid": "2f4ecae1-794d-4542-a109-f6f76c7bfe86", "value": "3072:fHKdKgTfRlXIB0ZVQn1F/keodcAyw0lAPEUz/wLYIOsoNRcTBfE39cV+8QMrQh1a:/aKgTfRlXIB0ZVQn1F8eodcAy5lAPEU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939159, "uuid": "d6bf71ca-4920-421f-a530-73a87c1189cb", "value": 163248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939159, "uuid": "2ffea674-1b3c-4040-a4db-5aae9ac8253a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939159, "uuid": "bb56dda7-3632-4b23-8846-058b13e25d69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5474f5a4-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "ef0b426b-5163-415a-b955-963c9e959883", "comment": "Malware payload (Mirai)", "value": "6841d85c2a1e3b6dbd548a68396a9518", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "02d5ff89-64fb-4cf1-92b2-d08d8e5c8a11", "comment": "Malware payload (Mirai)", "value": "20cbc7d98f23e14ae43c1d573fd789ce9670f8d43b582635903fead08382e37e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "0eae9750-906b-474e-827c-9db0c6cae40d", "comment": "Malware payload (Mirai)", "value": "24c322873a6897ca3450cc536642d1557406e48e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "ec05f405-167a-44b2-a45c-8accd7f48c7a", "comment": "Malware payload (Mirai)", "value": "71697b0ba31e443a63e4c076e3e4edf697145ea4751f65abda0d7711f0ba0a3b9c2f2df9269570645ec959398c605941", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "f2ff7374-64d0-4eca-bbb5-095b0427b419", "value": "T18214C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "ef54bec6-5bae-4ab4-8348-fddab5638ad7", "value": "6144:456eQCbeoufx4Ndf2dp06GtCqjYW8nY1j20WI:/ely4Ndfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896500, "uuid": "60391719-bec4-49f3-9a3d-a5b447de9ede", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896500, "uuid": "7bf1ced4-e921-4ead-8797-a3c660c63e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "be0c309f-e276-4818-b9d1-18abd19c6b9d", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3fdc77-35f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946845, "uuid": "4a367c38-e482-4fa6-9728-ec84e0a5f816", "comment": "Malware payload (Mirai)", "value": "68c9b8d45e210a540a3b92d07782e646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946845, "uuid": "0cf9418a-98df-47a0-837d-ef4409eeea3a", "comment": "Malware payload (Mirai)", "value": "20e6b54682e8d95417ec838960c8da56e8b13d898abdc35e5e6293f693788618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946845, "uuid": "728e66b7-4f56-460c-b8de-bb07bca24f39", "comment": "Malware payload (Mirai)", "value": "4e8a63e03b3f11cdf37565ef9c7f66fe09168e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946845, "uuid": "ec916b52-8b69-42f1-9abc-662ef4556b7b", "comment": "Malware payload (Mirai)", "value": "3131138ebafaada32722f6fb172999a7954661995744141ff021d294c3e690e1b81290eeb2262ababa0950c1f24f66a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946845, "uuid": "7e20b312-709f-4bf4-bdbd-77c212297621", "value": "T1A663F255D06A3CC5C78C9C3BA1C835B1EA93D6C4785E9B3A2318DD4E9A73E33B487066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946845, "uuid": "898616f4-48cc-43c1-b732-26d1a98e4c5e", "value": "1536:rHfNd2XTFCvYaBVsyhk6ab7aSVRI+aDd+SlfynDPaxAo2nXM1mX:7f2oQHNa+4+RnDPax4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946845, "uuid": "8c546539-73f5-4cbe-aecb-fdc7c65d0bf0", "value": 73192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946845, "uuid": "73f3031e-d567-4faf-bb63-07b74edebb1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946845, "uuid": "9f0899c0-449b-427c-904a-fe538a7ccc90", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b267c826-35b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775918562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775918562, "uuid": "1c56e936-6b90-4a6d-8949-259a1d95c3ea", "comment": "Malware payload", "value": "674be48ae936ca74c5a0b6e6a4f54a38", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775918562, "uuid": "9cdd9c37-303d-468e-a178-4da0a31cfcde", "comment": "Malware payload", "value": "211208d79258bd6b8ecba13ed31ab67267d9c2174a981563ec451230570b194b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775918562, "uuid": "2b2ca30a-b67b-49f1-9bd7-d2f3a89802a1", "comment": "Malware payload", "value": "a662556f41352c2c3a14e6cfd7181632864b0cfa", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775918562, "uuid": "1ee3dc46-b36d-43a3-b64a-9842bd47617d", "comment": "Malware payload", "value": "2e5285cf00cbe05e77565f4e90366e279b466bea867cda4a54924bc37bb47059b5146ea955aed0b5499003dbfc7276b3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775918562, "uuid": "a343f7da-004e-43a4-9745-b7750a1cb79c", "value": "T12F24B733E66288B9C4AFC2749FCAE5B26670BC584174F11D5F804B127F0AF609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775918562, "uuid": "8da4e102-d146-4a5e-8e0c-a67948052fe5", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775918562, "uuid": "ce7f2401-b216-42ac-8609-f3987f025d0b", "value": "3072:h/vsRg6DJx3RYQmVQiMmYO4JFCYdVtfSwsLqEeBJP5L5mXUjy:PojqYdVtKwUdeBJP5L5mXky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775918562, "uuid": "b9f9f541-9498-452d-a10e-efca7e9e48c6", "value": 227272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775918562, "uuid": "0543a8c9-a986-47b9-8c17-b1c927e49ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775918562, "uuid": "6271c9da-67e3-41e6-887b-63350e5de27b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525cbbe6-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "c6476e36-b4e6-4ac8-9324-75346cbfe8b9", "comment": "Malware payload (Mirai)", "value": "852b97e098069232a6ebe7346e0c1fb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "d59b8e9e-2eb3-4fd8-b91e-92ef7531fe03", "comment": "Malware payload (Mirai)", "value": "227e8735bdb5c5e5e5bfde90c1d33ddffe7ff1436be3d7090c47a50bbec7a1d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "4393d9f3-b513-4a2f-ad66-ceef944f41c1", "comment": "Malware payload (Mirai)", "value": "79e3b5feaa40c669f30f02198ee36bdf28ea8e80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "bec2b309-4a58-40b3-a851-1afc78662d13", "comment": "Malware payload (Mirai)", "value": "c320e7784e98c3a7a3238e0bf3c14f11d049c9ae34fc6865c495444c546881c0a8609c10197927762b2a62829b05a716", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "b2ae393a-7f36-4c5a-a6ca-fefc7059e30e", "value": "T199C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "3f093252-09d7-434c-add5-77fbb8ecb4d2", "value": "3072:foD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1Q:foD76aX9aKTcRQVnoiYq1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896497, "uuid": "ee96c250-7ada-4b5b-96c8-0a8389a61ace", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896497, "uuid": "8de75026-049a-4ce8-9b9e-e262ef8f7f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "2a343da0-396a-48f7-bf69-2fb87f355730", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c839f3ca-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888105, "uuid": "ceb0b4ce-3b8a-4b4e-ab52-c5f0a7fc8975", "comment": "Malware payload (Mirai)", "value": "5f99be33efaa59895ec199d28f7a0b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888105, "uuid": "8902277b-1cba-42f6-8501-dab156987a87", "comment": "Malware payload (Mirai)", "value": "230ed0a7ae9854426b7ada13914ead5d1c977e6c3dd20a578ae199248edb17b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888105, "uuid": "70eb5038-d6fc-4b04-b68a-bc077ae96c9f", "comment": "Malware payload (Mirai)", "value": "8e015964ce8a98fc41b372c05e8852732b3daaec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888105, "uuid": "de06da19-496c-4d91-9857-f172f143fd38", "comment": "Malware payload (Mirai)", "value": "ef94e2f78eba6d61099d5d5d1c020ea9fa84b03bd99807e29148351ff5cb2d932b35623a269c4f0bbfaab28e737e3c6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888105, "uuid": "412bf734-c28f-4607-85d9-267e888103c0", "value": "T171B3BEEFF34B1590C86187F017C39BED2E6332129E6B99E77C0E263A18751DB490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888105, "uuid": "997ebab4-4845-4b8b-86a1-ccf5c615bbe4", "value": "1536:omfH5zGf6VNalWJQ6TABwZaiJlMWb0aB0O6Jgq/LW0:vpGiVNalTYmA3lMM0aB8Jgqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888105, "uuid": "e07de925-895c-4354-a713-5ac40e98f280", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888105, "uuid": "84027b92-7dc8-4ba2-adec-a378b65f1eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888105, "uuid": "86a914d3-9e8c-4204-957a-f68f39ffd643", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c952e1e-35cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775929156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775929156, "uuid": "527dbb42-8043-4d6a-9657-aca705232f7e", "comment": "Malware payload (Mirai)", "value": "9bf14fae608d98b6ebcd660887fd8e33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775929156, "uuid": "bcc9728c-344f-4179-84af-902ff733ed0a", "comment": "Malware payload (Mirai)", "value": "251103e74f9897298b410b0dd3963ba24a79a0680b8c97131a0cf8cbcc4fd793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775929156, "uuid": "c86a9d2a-2cca-4bcc-8b7e-0ca54af67870", "comment": "Malware payload (Mirai)", "value": "7a7ab6d3d3b457c05f73fcc24d47745f0e09d62b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775929156, "uuid": "93f71348-8d35-42f7-b857-e2ff9ec4c1a4", "comment": "Malware payload (Mirai)", "value": "cdfae4388b91b8861fe261700f28728e2c0a70fe56bb4a9ca12c829c1cb802516e6a9412aa470117ddf1414872bbe762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775929156, "uuid": "c8039e4c-cefc-430c-a7c4-5d44698dbc84", "value": "T164042A02B31C0947D1632EF0363F2BE193AFDAD121B9F644755FAA899172E321589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775929156, "uuid": "9ccd9cc2-2243-4716-ab4e-3960e3dbaba8", "value": "1536:bqB5cetFVgnymoGzBjmpCxuaaRA+U5DLG/oQqLdHu3nU/CvApucjaSWW6kr4Xqp3:bkcKUymo9CxzIWG5qpHu27pAYHu3RSM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775929156, "uuid": "d3de5f55-1cf8-4569-b896-4ca6f2b30704", "value": 179356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775929156, "uuid": "213745f3-46d8-46be-a211-3189d32d2a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775929156, "uuid": "a0bd7f92-762f-4c8c-859a-d0ad76ad09e5", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd60300-35fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950307, "uuid": "8d8ddf0c-8038-4f42-aa57-84ff163cec1b", "comment": "Malware payload (Mirai)", "value": "3ef02dd50a7c184d332fa911b9cb9da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950307, "uuid": "bc44d825-8bdd-49cf-8b4b-5551d37fbf1c", "comment": "Malware payload (Mirai)", "value": "2525678c2711c2eb8c3016a5528e34a6847272a390dd33506bfc817b081f74ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950307, "uuid": "05d65d52-3097-4342-b2ed-e630b402c62f", "comment": "Malware payload (Mirai)", "value": "28b29592f7037c0d636549ebe9d913f7fbc2fbdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950307, "uuid": "f5d33f1a-c757-441c-9797-ef10c83b12bf", "comment": "Malware payload (Mirai)", "value": "f6e9988fcad16b2b113a38837669f3ad757090c10cfadf6499ea77911e200b4a39a412ad6a62b3145a39674aeefa4e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950307, "uuid": "050c45e6-61be-4497-bd00-35881d723122", "value": "T1CD34A40E6E328F7DF7A8863447F74E249B5D23D623E1D685D1ACD2111E6024E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950307, "uuid": "79dd351f-d01e-4590-be3c-751355b5ae34", "value": "3072:LH/0mduNpsL02t1yCtKcpnQr0K9jrzD4XJDj1B5CKRBv6c636L5Rrw3:DNIpItjtKcpnQr/zDKJ33bRch36tRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950307, "uuid": "222caec5-cf4e-43bd-b4fe-925694ba8158", "value": 252752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950307, "uuid": "0ca55a34-1563-48e0-9264-3b8afe45441f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950307, "uuid": "42a004bb-2298-44ee-864b-63e38fa1ef05", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e3d8cf-35ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775927742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927742, "uuid": "a02e7005-61b0-4dbc-bcdb-91a53c61cde2", "comment": "Malware payload (Vidar)", "value": "3c287c1643e4b7e50dd36726b53da3c5", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927742, "uuid": "efd4e0b2-601e-4edb-88cb-a09a4994be61", "comment": "Malware payload (Vidar)", "value": "268268370c1edca064d8584a48e48c86a34bcf7db7b0ee7b85c487032737ae96", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927742, "uuid": "7c0030ee-0bbe-48c8-882b-026e95897917", "comment": "Malware payload (Vidar)", "value": "07c3f00a2241874ff0e5d279af917c4497b61423", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927742, "uuid": "cc12ca76-918d-4bbb-9575-55fa761ba6ad", "comment": "Malware payload (Vidar)", "value": "afe56fa496ff08f8f617fff0499acd66edaa043a54b595ef341ed2bae21b8b5de039be292d5721dca7a9f94e4bcfd74b", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927742, "uuid": "acae48e4-a590-4262-bc9a-43f8d8774650", "value": "T1FAC5AF0B6DA549FAC46AA7318CB75291BBB4B8090B3233D72E917A783F727E05D34744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927742, "uuid": "f1d728e5-e40e-46bf-a7c5-7ba9bf44ed5b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927742, "uuid": "3b6a37ab-ec43-4e27-b3fd-d73be50d4264", "value": "24576:Zj5L2bLeU4rIYLqVUmV2hzPcl++mCMklej7NN8Nl3g2sKu5RCs7gFhheleh29mhR:ZjJWCU5YLqSjwO8ejh6jSKu5RCWshv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775927742, "uuid": "41749032-f9c1-43e6-9f9e-0e6b69f40466", "value": 2590936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775927742, "uuid": "a3eb0377-8bee-414d-aa2a-9d88ee05b746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927742, "uuid": "099abdd2-3c22-402e-8022-43f564c9c3f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ce3996-3571-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889892, "uuid": "87ee750d-cbb9-4711-95e4-22f7700d99be", "comment": "Malware payload (Mirai)", "value": "01a709b6e50a8f322a06242dd9fe088d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889892, "uuid": "75102b3c-95de-486f-8b00-0893b912d23c", "comment": "Malware payload (Mirai)", "value": "2741bfd2098fe3493ad3b8426589214f2dcf4a83aa599a768f44348f89243a37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889892, "uuid": "7b8d3252-3ec1-4937-b230-73e970160f48", "comment": "Malware payload (Mirai)", "value": "dd11c05d62cc64fca51fad82925ef04350f6c568", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889892, "uuid": "76d40746-d461-4524-a4c3-7c93a89eda9d", "comment": "Malware payload (Mirai)", "value": "bcf80a9be925d3dba0771f265c763542ef49ab22156f671373aa94be94ec96ab9c2d3fc3324fb3c42f00daca200e577d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889892, "uuid": "d213bdab-ea6b-4063-947f-5c2f9a616aac", "value": "T1345168F7D36702352CE5A9637ABE4494B589D1E228D4FF0AF4EDB9F8428ED442444AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889892, "uuid": "937c0ed9-cd99-4745-ac79-0704a010d057", "value": "48:iDzL7IazL7XWzLuzL0zL+zLfcEzLlzLSzLCAzLYzLkzLczLNzLKpMz:iD3t3i3u303+30E3l3S373Y3k3c3N3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889892, "uuid": "1aa753ce-b40c-43be-9dfc-383d03ca116c", "value": 2449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889892, "uuid": "5c2c5805-08c1-4133-9ba3-1951518a4ace", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889892, "uuid": "49817759-cf3e-4416-8f5d-0b8a4c695d2a", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e4a811-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896550, "uuid": "ddd3ecbd-9119-4cf4-9c4e-3a83a51c460e", "comment": "Malware payload (Mirai)", "value": "0370683c629a40cc495915161cf3f975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896550, "uuid": "180a2ff3-3f49-4faa-acd1-65af148ffc52", "comment": "Malware payload (Mirai)", "value": "27cd29da844f42e276b9942f76d31ffb4a1082c74685766fb5f369f57c68b3e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896550, "uuid": "1b067489-2c16-4219-81ec-946af46f530e", "comment": "Malware payload (Mirai)", "value": "9352b490a7a7861073e7d1642da941c4fb6ac4b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896550, "uuid": "e73114a4-b0d1-4ab3-a5ec-90d4d460da69", "comment": "Malware payload (Mirai)", "value": "8f5f51f996bcc9b9590aabab93364fba27b7a027f61c667ddf3f18c52e0d3842b2020fdd703693441f1c009d0d7632ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896550, "uuid": "c383df3f-9ce5-4693-87ec-84d4f135d8d2", "value": "T19FC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A271F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896550, "uuid": "69dcb6b5-2908-441a-9e7a-01e7006494c6", "value": "1536:U/AFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3X:UoFmSmviqS1Bs0+Nd6lAqktNMxSNbmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896550, "uuid": "f50f84d9-393a-4272-b376-7311d2fc4af4", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896550, "uuid": "d2a22e22-8723-4652-9e2d-b23bf72825d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896550, "uuid": "ed2d743a-8fd3-41d9-9cb9-5c8fb5adf7d7", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076fc0b-3589-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775899849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899849, "uuid": "daa0760f-f9cc-48aa-8060-21f157469a75", "comment": "Malware payload (SalatStealer)", "value": "76133f90748f2ac045a86069a5930e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899849, "uuid": "02d87423-ebf9-4d67-b04c-d0ccf55d11e1", "comment": "Malware payload (SalatStealer)", "value": "286c72564fa71e052d37c12f4a327d0e7de231ddfd21bf596dd15a3c13992de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899849, "uuid": "8bfe0b4b-ace4-4e97-af90-b998fc6560f5", "comment": "Malware payload (SalatStealer)", "value": "fea5623d23471fe41c11aa9caca3e7beacfee30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899849, "uuid": "b433baac-4378-4116-84c5-267e08c7adbd", "comment": "Malware payload (SalatStealer)", "value": "5596945e5154f4ab7b6120bd03080c735e2c1314bf1954c62c0cd47c056d4e2abe243f3508195213dde55b3da9a4a8f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899849, "uuid": "ba0c6020-7e98-45a1-b422-8b45ed655510", "value": "T1D0673380E9E10EF8E799033894FE5B5C3AF52A56AE52EFD74E5460E61F711C3582BC08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899849, "uuid": "433f1afb-05ca-49e4-90a7-c05cf13b3860", "value": "107b5ea4b2e1dbe6a2ee9c5abfbb5489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899849, "uuid": "e3506d27-aec6-4ec1-8b5d-b2186823cf19", "value": "393216:Fa2fTRQhDNB0UulNITuoCEO/EHOx61wgPwlhRUfZP//Q/qg3R0olIALVAjTHLIzi:k27QLuITDLO/lxXgPxx3ZGcL4MsBAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775899849, "uuid": "47d2ba24-2fd9-4e8a-862e-c6dad98443e5", "value": 30952288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775899849, "uuid": "474d4292-5b78-4c0a-9c45-ae1b66c27c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899849, "uuid": "d1c041a6-81c9-4d68-a8fe-47e6a172e7d3", "value": "OWX-FIX_2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583b43d2-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896507, "uuid": "79e085f8-c03e-4881-a193-b8505e615110", "comment": "Malware payload (Mirai)", "value": "22db549fb79b5573f6c627cab87ce494", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896507, "uuid": "87123fd2-a0a8-4c11-be28-7976388becb9", "comment": "Malware payload (Mirai)", "value": "28aa64e3f357e0838fb4f2baf0bfed18715973d9eebe3c57607b018f821ed02c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896507, "uuid": "68fdce31-e0b0-4c49-b0cd-d20d82af067d", "comment": "Malware payload (Mirai)", "value": "0888ab851b1f83dcd493c26cdf84c5bdbc91c9ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896507, "uuid": "9041c8e0-88fd-4c51-8ab3-8b954e930101", "comment": "Malware payload (Mirai)", "value": "f9e43dbf75588f2ff6dfe9216e7b3c82ca2a3112b8df525f66543803b6502e9d9c8d6d14a6965866e3274903927deba8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896507, "uuid": "a11098c6-42ae-442f-9a74-3c64ff32a326", "value": "T134E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896507, "uuid": "39cb93a2-0d16-46c3-a0fb-9df5297783dd", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxRdbK:pYlybKpzEOfGQ+vEubTt4ouftL4NdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896507, "uuid": "95f6b105-5ea1-434b-8bd3-74b4d9db7c2f", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896507, "uuid": "040256bf-c714-4b40-b055-1e98c306d61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896507, "uuid": "4bc430ff-6a0e-45d0-8b00-5d9427235af7", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4fe4cb-35bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775921456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921456, "uuid": "a93145d5-a3e9-4809-9ecb-563df81236e5", "comment": "Malware payload (SalatStealer)", "value": "3d829943ef82fb5f60e9f92a8ae3bd00", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921456, "uuid": "56121d45-cfd0-4226-9d45-52b38bdb4214", "comment": "Malware payload (SalatStealer)", "value": "28c5a1644c42a0ce35b4211edfd849a9a29282278a222ab2b64a1d7537e17eb4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921456, "uuid": "9081b226-c18f-4abb-bbd8-2af2ccaef81a", "comment": "Malware payload (SalatStealer)", "value": "31df70a07bd5cb805410244fafa6ee0c425d285f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921456, "uuid": "55e98bda-efe0-4cbb-a1cf-bcf13e0e9c87", "comment": "Malware payload (SalatStealer)", "value": "b4bb1cf5e1209f2e1857e8f934cc18e768de97d0c3b17ffec32e0bb7ac1fa4952447a461bfeda9b52409cb4c6e34bfbe", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921456, "uuid": "c77d910b-34a1-4059-bde2-b5012377fc32", "value": "T1F0863389ED8324B4DAF5097514DFB36B93706E194429EF6BD785ACA37F3B712090320A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921456, "uuid": "d002a5ea-c0e4-4e82-b8d2-b00b196cc046", "value": "8754f016dcc811c96be53527fd63b3b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921456, "uuid": "e7d9f181-392c-40ae-9329-528205d0c554", "value": "196608:a/jxzi2PfACMfsxJGvv5zjhodtw230Srz+bgVIQJsTszp:y5i2wZsnsid0YzQQYY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775921456, "uuid": "313b5367-1153-406b-ad84-ec66ac903b4d", "value": 8463776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775921456, "uuid": "ea8acf89-d8da-405e-9ea7-e1b06cfd9f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921456, "uuid": "15030a97-b15e-42ac-96a0-b250f04c3e1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff43ff-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888155, "uuid": "a8ed4d7e-6500-4941-b996-fd9eb9817fb5", "comment": "Malware payload (Mirai)", "value": "e843643aab84e8bf36669549ca7c68f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888155, "uuid": "fa1e81fd-8323-442c-bf0e-e15a3d8eb55d", "comment": "Malware payload (Mirai)", "value": "2b054a7698119aab074a22ef0f5175db81c2487d1b3249af902484500ecc534a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888155, "uuid": "6721b07f-d14b-44ee-b157-0f07ae24751a", "comment": "Malware payload (Mirai)", "value": "bcea0c37cca78cfb34e38bce689faa3b76beddc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888155, "uuid": "57699542-e5b8-45f2-adc3-9e6463421e11", "comment": "Malware payload (Mirai)", "value": "f581dc7ba5565c84ee1f6a54e59735e758c4f1b11ff130c6b4138d8775adb2199e5e32fe5d914f0d98fd8c1db64c5d9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888155, "uuid": "62937fa0-953f-429d-bccf-cbb7eb551d50", "value": "T186F33A46E6418B13C4D61BBABADF420533239B6493DB33069E18BFF43F867994E67502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888155, "uuid": "668b462b-07f2-4b16-b016-698e0b284111", "value": "3072:kfT9s6mEamEgh7qkm6kEftG/hR3aFbfiaebvNoM/9ByKFm4w80WYjh:em6mEaja7qkm6tt+R3aViaebloM/9Byd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888155, "uuid": "81b1e6e2-e74d-4872-881e-d713033cf7a9", "value": 164613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888155, "uuid": "4850c702-dd50-4c60-bb15-2eaa4a882d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888155, "uuid": "e40e6a4c-bb33-4f0b-92d8-2749ad22cba8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1f37bc-358b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775900889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900889, "uuid": "68df3e7c-864b-4ee6-9330-4e76505329b8", "comment": "Malware payload", "value": "0853ceda7c03cbcb766a3b78062e7aa7", "object_relation": "md5", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900889, "uuid": "322ab5b0-b646-45d2-85bc-152d7faf7cf7", "comment": "Malware payload", "value": "2b2425893c83dc53fb87975a080efb361da8da37df21c157a3bb601738c608b8", "object_relation": "sha256", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900889, "uuid": "254dc034-5f9d-48b7-9433-be51f871b9a1", "comment": "Malware payload", "value": "04e06792063bdabe0dce5254fda88b4cc23f31be", "object_relation": "sha1", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900889, "uuid": "7d34661a-a02b-4908-a361-45f4da9c6065", "comment": "Malware payload", "value": "a18ba5b1dd9ee535d51789ab12ee0accc16970455736fc78f7cb83350e16d7d0f14d608c018f12d33ee9738bbb3edbca", "object_relation": "sha3-384", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900889, "uuid": "593c2839-2f35-46db-b482-6d30c8af4a64", "value": "T1DC034C85F79400F8C1F64336F8756B8693B43477810A164F47B85A6A4FA3279E93E2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900889, "uuid": "08933bd6-713f-4556-b2c9-7eadfa353151", "value": "3b2dcf30386c4c5da656dc4849549fac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900889, "uuid": "3ad9ade0-56dd-46f3-9c72-523e452ba25d", "value": "768:zsASD0FViRTiB3F9dA4+4QMYoBO+reEiZnQ:zsvD0FyG9d+aZrepnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900889, "uuid": "f64215cc-b2eb-4efc-9f7f-0c5ff1c34a94", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900889, "uuid": "2d1a880e-c25d-4808-9571-e01858eeba69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900889, "uuid": "e3f2cb9c-8423-45ec-8ee7-d33a35f3318b", "value": "data", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7726e53e-355e-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775881526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775881526, "uuid": "ad603fc5-86ec-43bf-acfd-92221e3f664d", "comment": "Malware payload (DCRat)", "value": "096c637245d50eccfae8f11c34cc1015", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775881526, "uuid": "bd83ca83-900f-4511-b1b2-c27a7f437a03", "comment": "Malware payload (DCRat)", "value": "2bde6786b2837e12bed22cd99f9f83fa1cb4623163e2e38c6792821246d31362", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775881526, "uuid": "2be29a23-c736-4038-ac04-ceafb0a66a88", "comment": "Malware payload (DCRat)", "value": "6a85d571d30f75fd3babc3d4868351bf0714cf4b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775881526, "uuid": "6aec962f-44db-4f5c-a892-dfda38540dd7", "comment": "Malware payload (DCRat)", "value": "409ad2b0931cc79cc528152d34bb13d004bfab5ee5c2326514f3ae65d00b9013875e558a536e2fc712bb5844cfbe7310", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775881526, "uuid": "e4c49ce7-317a-4d4a-928a-d728a95390d7", "value": "T187859D027E44CE11F0191233C2EF594887B49D516AA6E32B7DBE37AD15523AB7C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775881526, "uuid": "20b55be9-93b4-4eeb-9265-887e77a1c56c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775881526, "uuid": "e788a3e2-823a-48b0-aed5-b6354cd3ccd0", "value": "24576:7D4H1uuwc5P2a7pAORLa/SmubpEB9dw1W0vNb0pnsIprmrkEDYyGGM58cbwyQSv9:781XP2qmu9KWW0lOnVarjLMXxv3cn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775881526, "uuid": "87a8d627-a0af-4bdb-8a40-a4f52f5b43b1", "value": 1754624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775881526, "uuid": "1ed869a6-f33b-472a-a778-522e8319776a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775881526, "uuid": "d33498fe-af91-4350-aad9-230dd678e997", "value": "096c637245d50eccfae8f11c34cc1015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add4d0fc-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911683, "uuid": "e7f9188c-3b98-4982-95bf-c2203d46ad25", "comment": "Malware payload (Mirai)", "value": "443f4351ff9a051b1cdba77d40725bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911683, "uuid": "5054c4d2-0afb-4c18-8032-78d26e21a1cf", "comment": "Malware payload (Mirai)", "value": "2cf45d2e3331f12abec91bc127838be4ecd1d62b966d5f9d78d1881def027cd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911683, "uuid": "78042ca1-3096-4d1e-84b4-c72d56ed4d6f", "comment": "Malware payload (Mirai)", "value": "79f2466c68c7393af81bde5fa43ce201e1bac580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911683, "uuid": "47059ecc-0114-41a9-adfa-e1072f0daecb", "comment": "Malware payload (Mirai)", "value": "edd6ba52c1dda6ffe2516963f328c80ab072cdff9d7d562250f06d3c862d70b433e0ca03cdd4f103a851e0c92ad6124b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911683, "uuid": "5871d675-a195-4009-a264-87c950713160", "value": "T16133F197618A9B13C8216D37503C53C696CEEFBDD3E7502B6B3A5B48A1373134AF1281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911683, "uuid": "a60519dc-6e19-4edc-a6d9-c935f103b75f", "value": "1536:3TSAhcEX8OeRWJ78z8L6AOo6sBiolcTi+k:j3DQWJ78oLRnNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911683, "uuid": "e65d5ae6-68d8-41e1-a745-b16c316e9554", "value": 51468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911683, "uuid": "8d6ead0e-a751-42a5-8165-a3aa0fa3ba62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911683, "uuid": "c2b1e7e2-8913-4640-b6cf-e17710a21306", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf9c4b8-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916834, "uuid": "60e37019-02a9-4fe7-a6d1-865255eebeec", "comment": "Malware payload", "value": "2f5f22342f77d9b3a521698d3b60c62d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916834, "uuid": "6b215d54-8452-4d41-b760-b7ceb7701cd3", "comment": "Malware payload", "value": "2dbb5c532feb5be2cc64f61bd4697322353aaa6de9b203ca71a421b473cdda7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916834, "uuid": "97ad4e97-4e8b-4ecc-9af4-df24432c0dcb", "comment": "Malware payload", "value": "c72d43ba602769da93747438f6da0516642d3c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916834, "uuid": "11aa62ea-7818-4481-a14f-793c50563dd7", "comment": "Malware payload", "value": "ff56e8b66cbbd0d7b3aae87bebbb75af3ca491e0abb89e1be00b3d671ac4cfceae8daf9badb9c429aec89da4be7c25c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916834, "uuid": "1e48309b-d594-4980-b5a4-3422855fc328", "value": "T193A31917B9419F01D5C321FAFA9E514533136FB8D3E97112ED20AFAC23C69DB0A76622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916834, "uuid": "dccca8f9-9c2d-4919-a5da-71ad14288b78", "value": "1536:OUnNOoWDk86bVhZDaAaG5bkvhBe9lNXilO8G9gOYkT8k0hWpLi:jOE86BhZDaAaG5bkKUO8G9gOZ8lkLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916834, "uuid": "1ed3e336-f7da-47c0-83ad-332a82018551", "value": 99344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916834, "uuid": "dfb29a03-a536-42af-af75-9cd2b50645a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916834, "uuid": "52c13da7-bbb8-4e83-9ab7-5392824daf19", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513ef973-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "09092634-a1f3-460b-915a-da7e087c0614", "comment": "Malware payload (Mirai)", "value": "361d509b8857166f54cc32c02758afdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "2583706d-dc98-48c8-bd2d-3572a4f2a9b8", "comment": "Malware payload (Mirai)", "value": "2e710a10ca0d4b656c7216d7e04e7c35be6c2d6fdf79904a02c5e490cea101d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "1c0802f8-285b-4df0-9700-dd7a2ca44cb6", "comment": "Malware payload (Mirai)", "value": "a8119acc31d208778e9d63988ca65da6aa40b842", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "f8e1c111-9e26-4094-9852-1d7245c8f32f", "comment": "Malware payload (Mirai)", "value": "f1ad2c41f622e7570517163daf81c6dfe77a1aef6068115bd4b722802b989027c9369abf96b7d0ac4be1c90071290b16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "326518e8-50d4-4486-bff5-ca2929d81f98", "value": "T116930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "e174b9b6-f311-496e-90bc-de94103dbad5", "value": "1536:wqnZM8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YDn:U8NUv5nTacgzafVAwe4BNRIbT2gXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896495, "uuid": "bc6153e9-0da5-48f2-a3b1-efd44fa7d330", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896495, "uuid": "34b6e39e-7e35-4f64-ac39-87cf340cea09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "ea8f4ce5-eae3-4e5d-8bae-043f9216b130", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4141f3b0-35f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775948008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948008, "uuid": "3f21165e-a1d8-428b-8ea5-79d3a8e936da", "comment": "Malware payload", "value": "223ccdd95c22cdc51af5ce4464749ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948008, "uuid": "2b3db9d0-b619-4abe-aa32-1fcdb3e9b254", "comment": "Malware payload", "value": "2e9f53d1c53ca7ee3bfc34ae94f05855fdb1c574a763db1e2290bd95c6e44bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948008, "uuid": "a4fb94f3-7428-494f-bd1a-e110aa34cb19", "comment": "Malware payload", "value": "ead220ec2bc9d788848f3143d3bf5d2ff3dd2093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948008, "uuid": "d4b2a7d4-455b-4b8e-a7ca-389b86bd8196", "comment": "Malware payload", "value": "680f391c2b6cb87276e18efd43746fd9e6de1d5cf70338d4ea6b68c99b7dcf1ec8c48a24011415475b72a6998f63baf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948008, "uuid": "9cab4df9-ed7b-4b63-b2aa-29f2c43b07e7", "value": "T19763400ABF610EF7F86FCD3B46E42B45308D601A21A83F757974E818FA4A10B55E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948008, "uuid": "f0eeef89-d881-40f0-8f09-1255a403086c", "value": "1536:GWxIaM86eAtqVUxfdVKO/Buo0g8m6n25lgwbZn:KaMjeAt8URd3uFg76npwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948008, "uuid": "a79ced77-d5e3-4cda-8f74-ed7406ac25a4", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948008, "uuid": "822a50a2-c660-4ab1-883b-2a1d67d86262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948008, "uuid": "bcc58f78-164b-4123-8d49-dae10b963c92", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8202dc1-35f6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775946946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946946, "uuid": "cb265444-61e8-43d4-a963-7c5323442efe", "comment": "Malware payload (RustyStealer)", "value": "20469df03bd2e2f30d32d3a23bb7282c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946946, "uuid": "ad2b7e56-d250-47e8-8021-148225c18291", "comment": "Malware payload (RustyStealer)", "value": "2ef28834f30d3fd881f8c3004ab67c01e2ec283c03d57e173e43a7b30d52f97b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946946, "uuid": "fbe54bf5-e163-47c9-aeaf-3fc25ad18ef5", "comment": "Malware payload (RustyStealer)", "value": "5d1b56a2ceae5046c70ded0a1a9d3654874ec57c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946946, "uuid": "47c70b0c-e2d0-4724-97d1-dddddafd89ae", "comment": "Malware payload (RustyStealer)", "value": "ac590d92d49c9a87ff22684a7d3818d6d3d9d96c1dac863ff0486266a94f65a5c14b33550a12aa833ad82f2042613c68", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946946, "uuid": "b7def09d-4b56-472c-8f6b-f664552a4fd1", "value": "T16284E122FB55A5F9D126C07893A54A73FA3174CE0B22B9EF125C05382E59AE52F3DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946946, "uuid": "7538cdb4-6961-4c99-a740-60435097b1f4", "value": "f1c829ae0d42171c0463e67e11e8f799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946946, "uuid": "f4f486e5-938b-430f-91b3-266657aa8d10", "value": "12288:KQvzMYcnZ1a4WfqkeCPhVU/rClIDqeH+zqntg:ZvzMFZ1VVDp/rTDbH+zqnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946946, "uuid": "deed491e-ed4c-4086-b544-c3ce271e734e", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946946, "uuid": "8e5b42e7-7232-49e5-8874-c7ac677f1699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946946, "uuid": "ad82e142-09b4-4c8d-8909-38dd9f4edd15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fbd2f5-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888093, "uuid": "e8781584-7dee-4d23-b134-35c474deaa33", "comment": "Malware payload (Mirai)", "value": "a29ad0ab7586f9633fde1388386dd585", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888093, "uuid": "62fa746e-f8c6-4b53-858b-8d709f9b14aa", "comment": "Malware payload (Mirai)", "value": "2f0dc6ab0edb52c39b36d2809e5d5241ef2ef878ab6980920a9df10d6f7bab7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888093, "uuid": "923ec549-6442-4708-9b19-af7722a1ab35", "comment": "Malware payload (Mirai)", "value": "e901fdae81fcc86f92ffe0159bf95933f4b0ad91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888093, "uuid": "36c15953-9e7b-4359-8542-ecddc95b94c9", "comment": "Malware payload (Mirai)", "value": "c861eab145fb7a8b5dd1edad7ba94c4ac39827d7e9d4887fa7c2597709835e942f9604975430572c82a705582f888210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888093, "uuid": "54f29228-9f9b-4de8-924d-b24ae25a4fc0", "value": "T13AE33AC7F900DEBDF80AE37644634805B130BBA149921A377357797BEC3A0E8456BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888093, "uuid": "c0acd5c3-e3af-41d7-8e34-36c0f2ffd316", "value": "3072:PHPjed1JhQbf05u7xxZKoPJtVjjbiSLXObmhA2y0nmGsNORc:ad5u7xxHPJFLe63y0js8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888093, "uuid": "b32c0a5c-d144-44d7-a4ae-b4bd1a057192", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888093, "uuid": "949411ae-a039-4448-b14f-a64ba1959141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888093, "uuid": "c573ced2-f335-49cc-8450-67b4b8d8368b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232e36c2-35bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775921329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921329, "uuid": "bfeaafa3-eaec-45e8-b19a-de45e098c6a6", "comment": "Malware payload (Vidar)", "value": "7b724bf2ee7db60f9473fa11d661a092", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921329, "uuid": "43de1984-6bed-461f-86f7-4ce1e86a5f20", "comment": "Malware payload (Vidar)", "value": "30b69df424c0db429b36760d419c28c2ab2771bafa99eec3e3e29d443a6dbd8b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921329, "uuid": "353f9f72-bafa-4b3d-ab40-d25ef56f6f04", "comment": "Malware payload (Vidar)", "value": "fb6db553eeb33364e387a6f318dffad2828d8a75", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921329, "uuid": "2427e7ac-bcec-451f-a992-8100489d2208", "comment": "Malware payload (Vidar)", "value": "462a14e26cb668ebe72b217520b91fea6ffd3f4c39b01d0cd162e665473f38be129cad6f8c6e342cd6525eeaa8fcabf4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921329, "uuid": "263492d2-2eae-4d22-8d52-3b70b484f5ef", "value": "T1D4C58C0BBC9545FAC49A973688F25292BB75B8090B3233D32EA1BA743F727E05D74354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921329, "uuid": "5efb8bcd-00ef-423d-9652-307f1c204182", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921329, "uuid": "c0771f5b-6f14-4c1d-b01f-8ea541a293d7", "value": "24576:DQyCztFZM1OKOsg5hXNMej4Bj0RMySZzhbLd0PFbTesxBjXJvIFhheleh29mhPGE:DlGDZZKOsgLNt+05AzxLdMTbbs0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775921329, "uuid": "cfb9ae4f-50f6-40a6-bc2c-c62c4c8bea8f", "value": 2624728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775921329, "uuid": "8b7d4b10-8f52-4578-b065-fb4e6161a532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921329, "uuid": "8237c752-a074-4b27-8990-e4478e0721fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd4289d-35fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775948562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948562, "uuid": "4736ae46-ea14-4155-9e40-a047bbbdeb8f", "comment": "Malware payload", "value": "4271777c3430a37b998caf9dae6df89a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948562, "uuid": "1e1d6f84-0f43-4a20-ba0a-110c9d5043d7", "comment": "Malware payload", "value": "31d3dd8d503455e71ee8a6407c62cadbc3f453bb005c544ca1fb2952ca52faad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948562, "uuid": "1d536663-8826-42a9-a67a-9414a05f5ae8", "comment": "Malware payload", "value": "9606c73517ffd74acf418fe2aa801ddd1c2eb15c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948562, "uuid": "7ff86029-b85a-4c8d-9d01-05276e530d11", "comment": "Malware payload", "value": "ce5103ff5aec88e9566e512ed2aa33a3ef30c56f53826ea20214d7c660f386c9a3cddffaa197a6b47f4495169bc1d792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948562, "uuid": "8e1d03dc-1e54-4a25-bea3-a0fe20f3213e", "value": "T11F158E56B2F374BEC467C130939BDB326932F4640A326D3B51C88A341D96E741B1AFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948562, "uuid": "6f52ed0a-9aae-42b2-8d50-8083b1627e53", "value": "12288:4zTVp9r/bHJEmNElMmXOFql92XcvBzOIqQyuPF3KKiLZaKUYs0SBPmJb:4PVp9rzpEmNElMmXOGvpOIbFjKQeSBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948562, "uuid": "365c1861-5609-4151-8bcf-71992f42abb0", "value": 896616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948562, "uuid": "ed3e4fd3-81d8-450f-a724-f907fa226c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948562, "uuid": "2eae5cf7-4848-4feb-bd2f-63452c3d390e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cc5d3d-35af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916204, "uuid": "eae99114-d0e1-46cd-b86e-82d48199d0be", "comment": "Malware payload", "value": "db91cbc42f4a393c76b862a72f347223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916204, "uuid": "061f4733-62d7-4aba-a2db-32020ecd5621", "comment": "Malware payload", "value": "32d6a744f2e330cf403ea1bca66ef2bd80beedee684d3e6c6eb0ec5d9728e4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916204, "uuid": "671f4504-8f2b-4c89-85a1-38bd11e457a8", "comment": "Malware payload", "value": "e2f1b66f63b12f7dd873121afca1da7759863f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916204, "uuid": "39d76cce-5320-4528-9b8b-efc99521172b", "comment": "Malware payload", "value": "ee307f2a72b050b2d1f3cb0530185916e96ad6248745448f9d8c17b841811dbceb4eac6ce16fe9eba680d56b2c2b481b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916204, "uuid": "38c5a384-2b8a-4dd7-a226-3ad1b80d64e7", "value": "T1D5E55C13BD92C5E1E096F235B9B16359B7707C48473373E31B62AAB41CA67D40E3A728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916204, "uuid": "b12378d6-a2cb-4a8d-a14d-962738666d9a", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916204, "uuid": "dbd1ce19-b370-4ad9-a892-c260aa8b6a65", "value": "49152:d+isnXmnOj8IgbUJK1mBqAiw6ERwj9WSgngofcm:cAnOYb4qAivEaGcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916204, "uuid": "7a859dc8-879d-47e0-a6cc-d2fc72db0e86", "value": 3305222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916204, "uuid": "03c02e1d-3852-4bf1-a0a5-d21805252f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916204, "uuid": "434d4c96-ef98-4658-8340-931491d963af", "value": "1intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09fe552-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896682, "uuid": "5e4e3898-6fa1-40c4-893c-a5ebf6a1a36e", "comment": "Malware payload (Gafgyt)", "value": "0809c65bf81afc6631358d56d8abfa04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896682, "uuid": "692c7c9a-ee50-4c91-9a41-4e6c2261c5be", "comment": "Malware payload (Gafgyt)", "value": "331f16cb8a09aa942afe48fee5b014d694f4a0619d578c8cad958741ac20844c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896682, "uuid": "436c03e0-371b-4c51-803b-c2f3dfb66d21", "comment": "Malware payload (Gafgyt)", "value": "d082b5855d10845594a568af36c76eb96380370d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896682, "uuid": "f446224b-5b05-4f90-b970-2e7f4cf49075", "comment": "Malware payload (Gafgyt)", "value": "a02bc4d562f1988e84e7ab41ba8d1227ce7f7e45a6cf169310a728bbbb1e217623fc4010ae905341c0cacaf42dadef99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896682, "uuid": "46417f08-6460-486b-89be-3f758dc7187b", "value": "T122B33B4795A89EB3C086FAB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896682, "uuid": "62ef84b7-1de2-4fdc-8134-b6f8e361c81d", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCJB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjO0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896682, "uuid": "e6e572a3-07ec-4a06-84f9-ffe0f34b289b", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896682, "uuid": "3f1ca284-67d1-48ce-be5e-39e88f0efa50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896682, "uuid": "0b0aff55-c708-4f2b-a6cf-27789803ef2c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75f0871-3590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775903082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903082, "uuid": "18d7b5a6-616d-48f2-bc32-12e930578746", "comment": "Malware payload (Mirai)", "value": "36c839537bb7c46be9f8b24c15c1b7c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903082, "uuid": "1e15f2fc-16ae-432e-b1c5-301781785a44", "comment": "Malware payload (Mirai)", "value": "3342c3265f8c4770b6ffd6ea7ee34671af34cfbb1ee6d39f6874d98c3b010c60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903082, "uuid": "7e7e52ba-14fe-4985-acb9-55ecb8edd7a2", "comment": "Malware payload (Mirai)", "value": "869b8ee1af8605a9905cceedea17738a18ed3c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903082, "uuid": "ca320bf9-d731-4b19-b612-2944e21406e9", "comment": "Malware payload (Mirai)", "value": "d7de1264374db0d727ca72a19316c7ebb4f3f3c9268e724f3b4ab26830188d9f2cba1f5b4f5e23e4781a4304e7768b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903082, "uuid": "ad77c6e0-cddf-434b-b7bd-9504500654b7", "value": "T188E30945FC918B12C5C622BBFB5E428D3B2617E8D3EE72039D255F60378696B0E3B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903082, "uuid": "ecd52f80-b99c-4e78-a273-a9d555d115b1", "value": "3072:VNE4tnWJ+a2q0HmO4btT1RfPsX/FO8R49ZdsUwRjBId0488:VO4tS+BHY/Oh49ZwRjqdV88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775903082, "uuid": "2dd6c4ec-e378-4d2c-89bd-2ee738278c4e", "value": 155808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775903082, "uuid": "885cbd05-2db7-4d39-8983-216e2cffcc8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903082, "uuid": "9f7a4cf4-83de-45a2-9b6e-9a676d1e2536", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c0c530-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917259, "uuid": "c8f06855-fa7b-4057-b270-62ba7f1d43eb", "comment": "Malware payload (Gafgyt)", "value": "ad5d496f0b887142cdc32683d0e6ccb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917259, "uuid": "bb86432f-8061-4105-922f-cbf68d08c4d6", "comment": "Malware payload (Gafgyt)", "value": "33631bb5f8896d51a980f540fc7012ccb37285c81da7f50751bf4e3aef0fa28d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917259, "uuid": "f817effe-0e6f-498e-a9d9-77ddc5df2e8b", "comment": "Malware payload (Gafgyt)", "value": "ac541b8e0c6fb10898e91fa5aedff41cb778ad9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917259, "uuid": "c574a31f-5cb3-40e5-8951-10c1d963a1fa", "comment": "Malware payload (Gafgyt)", "value": "b25fd400795bd2e014adfd1474149e182181580833a4fc7f14c0e5bb42374c5a390a04df0e5fa5afb19df69aeb7a05a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917259, "uuid": "de03de90-e55c-4693-a6ae-fede46a077fb", "value": "T156A3127E8A30968BD07806B3FB478189730653A5CB2A74521EB4E2CFDBE23F5DB45518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917259, "uuid": "250efe75-09fa-45cf-bc4c-a1f7f7c5c00b", "value": "3072:xbd1C9YXVITzluRExzSCLld/9JGfsJ4KvCmyUZc:L1RV0huRExzd9J9J49j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917259, "uuid": "8f1a629b-513e-47d4-bb66-f9fc296e53c9", "value": 100820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917259, "uuid": "2de7b1bd-f7ab-432f-95a0-5a57f5ae7356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917259, "uuid": "7cb3561c-aa09-4753-af60-0f66c4d5ef3a", "value": "redis-conteinerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d467669-35fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950310, "uuid": "49973090-29d8-43bf-ae3f-4288c739ae76", "comment": "Malware payload (Mirai)", "value": "a109a3635c420c5c1ebf315dfa4bb970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950310, "uuid": "07f45214-3e1b-4ea9-83b9-a22d2ae300c6", "comment": "Malware payload (Mirai)", "value": "33d062fa3cdb2894325bf5666cde51135fec09440595c90a845e9b9d720c3e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950310, "uuid": "ea0c4840-5e06-4207-a9e1-12f90024d80f", "comment": "Malware payload (Mirai)", "value": "ed45f010a31a7be6c3d69d78cdf5e5cc4ba4f630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950310, "uuid": "26ef59ac-8683-4c56-b587-00670ceb178b", "comment": "Malware payload (Mirai)", "value": "70084df6a976a701f2438a2f7d5d9235d9166db6ec216ea2994451994f5c2baf07032cf1bc88d6521644ccb6076d7136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950310, "uuid": "450f4f7d-02ee-49f1-8843-5e4f89c457e1", "value": "T136141856F8819F12D5C012BAFE1E128E37131BB8E2DE72139D245B74778A87F0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950310, "uuid": "3e75843a-cdc7-47d9-85ef-e3fb0f8dda31", "value": "6144:4Wc8D7y7i0QGTbBLEUfxaOsnbufOTAy1LU1JT5pV:3c8/y75QGxwUfxaOzf0Ay1LoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950310, "uuid": "09a9f3b5-f576-49d1-85aa-4e3394a3b6e1", "value": 203796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950310, "uuid": "6fe5480e-5de9-4de6-92e7-dd65175068ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950310, "uuid": "0c97e04f-85fb-4f14-94e6-22cf76cd0a39", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53682c57-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "78b0b701-5b51-485b-bdb3-21c82e3761ad", "comment": "Malware payload (Mirai)", "value": "40a83a43960420d23e8f1c22103c000e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "a58538b1-d30b-4461-8254-7cc0da65ec44", "comment": "Malware payload (Mirai)", "value": "340a6acbca701bb09732445e64abe24d2cf96038ab26ba021c49b33c3ee0cf54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "0a5b95b2-068f-46da-b362-74ebd7fe9aa7", "comment": "Malware payload (Mirai)", "value": "a91111ebb472609aa8007221b790d9f07db08e11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "0c2b269e-b59a-4aa3-9293-feb25efe5dd2", "comment": "Malware payload (Mirai)", "value": "926dd9297c522b366876d643cc55f1469c3c88a10e819ed632ed440456880a859f97cead3129b2633615dcd48180df42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "e1ed5f13-3987-4f57-b1f5-f17cbfa34234", "value": "T1FE333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "bacf99f4-690a-47dd-9625-eb12c9d370d3", "value": "768:RwzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98LN+s:Rwdt3SpOzwLMU431ANA0BLBCvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896499, "uuid": "8c19180a-bf61-427b-88f5-03177904da38", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896499, "uuid": "5a1bad0f-ee5b-43f2-ae00-5f4b0b8a2d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "73e3d728-1966-4b39-80e8-605b8d8bccfb", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7425cf-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916623, "uuid": "d9394fe7-db40-4d61-b59b-5338e0739fcb", "comment": "Malware payload", "value": "1fcb2db54f35a31856c9670ed28c8ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916623, "uuid": "1b118125-214b-4cec-a37b-ab241049a58b", "comment": "Malware payload", "value": "34b4d7f88d2e40981c5b7ccb58805be1d3cdfd21b3cd779e5c902569d0a4a5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916623, "uuid": "0c33a5f3-d217-4644-8e16-1c83bf753ce0", "comment": "Malware payload", "value": "a689e7fe692ae2b6c3682550232c0f35347ddc47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916623, "uuid": "9563fd34-d8a8-42f3-abeb-72eb290c9bfa", "comment": "Malware payload", "value": "0176806946fa5bd745fe0ca604e880212b2d37301f7ed09348016666bf0187d6fc6b45410155fee9303fc4d9e2b48c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "midie", "colour": "#292A97", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916623, "uuid": "912f0393-42a8-4080-b699-e64e30add40f", "value": "T180656B136184EEBCCDF84172033D0BD8463D75C34A9A277C464916B6AFCAB7CA46FA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916623, "uuid": "3bf47b4d-e3b9-4b7f-8e9a-6de92123b869", "value": "0c04363417c8544dfd508c7272e7940b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916623, "uuid": "ba3be388-4dde-4161-8edd-90a4b9cb2457", "value": "24576:/hGGtsoCkLzzgTuxl6ifab33YYce5fUAuVBd67lDQND+n52Sd3YkyiQ1P5q:c5oiFbnj1nu0U0NQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916623, "uuid": "2c96138b-fa17-41c0-b44a-a7c3adf6e391", "value": 1486004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916623, "uuid": "a19d44cc-0b48-4a34-bcb5-4411f4bce09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916623, "uuid": "b3698b77-ec89-4d5d-b164-74f8dbb3899e", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64a07cd-35e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775940554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940554, "uuid": "bd238411-4a52-49d7-8505-4736074145a8", "comment": "Malware payload", "value": "10b1ea9aeeab95898c27cfecdd694fa0", "object_relation": "md5", "Tag": [ { "name": "XorBee", "colour": "#6C1FAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940554, "uuid": "7034d18c-9dfa-43c1-a605-636005d47564", "comment": "Malware payload", "value": "36b6c054e1067be0a2f397f7cfabf0bd45011f60f0fa2d5ece429b4e53037464", "object_relation": "sha256", "Tag": [ { "name": "XorBee", "colour": "#6C1FAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940554, "uuid": "7ec24c6d-eaf1-47cd-b13f-01f61531436c", "comment": "Malware payload", "value": "9e480d5763be74eab74a1e97756c56b5e6651693", "object_relation": "sha1", "Tag": [ { "name": "XorBee", "colour": "#6C1FAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940554, "uuid": "fde11c7f-43da-4632-a095-7696c3f7e22e", "comment": "Malware payload", "value": "922df308dc47c67d26d4fff60cca63a1fbb08062a8f131e264f69d54762b4eb4c4760621190104024c667b68cb3a5f40", "object_relation": "sha3-384", "Tag": [ { "name": "XorBee", "colour": "#6C1FAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940554, "uuid": "e0afb593-3b4e-4bbe-9586-5033b4fabb41", "value": "T1C0572373CD557763CE072B32524D836A438EEA6876035C8B3FA05B5839396852637FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940554, "uuid": "3cb8a180-0ee1-49e4-a337-cd9542311c29", "value": "786432:xX+UbmbbpIMNQQG+LW1/r6b/wD1lqpPJ3:xuXpIMNQ1+LW1r6b/wqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775940554, "uuid": "57ac82f3-6d03-4d8d-8430-3a478e1da967", "value": 28282390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775940554, "uuid": "f42afe07-c4b9-4d91-b9d6-8af0eedb86a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940554, "uuid": "3dd4a34e-749c-485b-9740-f5a1c8201e88", "value": "archive.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf05977-35ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950875, "uuid": "37a226c6-2ddb-473f-9e36-9539c82be55a", "comment": "Malware payload (Mirai)", "value": "6cad7fddc7f0c4a5e7d085189f6d4c46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950875, "uuid": "9210e6f1-4530-48db-a96b-c31bc4a9f291", "comment": "Malware payload (Mirai)", "value": "36da3c70b3f775a897e2a17753d7a2343282f6393d174e447fc7848379cc217c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950875, "uuid": "e7e7ab1a-1534-42d1-9755-2913d4085c88", "comment": "Malware payload (Mirai)", "value": "426d7bacb4d9709435d4c1d03e750ee1eaa4877a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950875, "uuid": "055bd5a2-c0e9-4b11-9822-eee8764e0e5a", "comment": "Malware payload (Mirai)", "value": "2349dc3443fffdb5c32aec44ebdbc0359c7a0ae3a20c779ca0fa054659adbde8939d9c37d483064fe6de524a32ee2b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950875, "uuid": "4f3beac8-fb72-4e28-963c-1537832f50cb", "value": "T175F38D73E8356E98C154D070B0F49F786B23A6A192072FBA59A7C3B59043DCDF50ABB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950875, "uuid": "7af17f62-c1db-4e39-a428-03a14acc3d19", "value": "3072:hdffLQPFWqIogrSSejKJT+2bHngWh+AOmDPxxd70W8PPsAt0bx:hdfzQPRguRG1znNh+AJNt8PP10bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950875, "uuid": "e1699f05-228e-4b75-bf5a-ca0a13b54467", "value": 171484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950875, "uuid": "a71eb717-c761-44d5-91b1-15aa5635d663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950875, "uuid": "5bf8bb81-44a3-442c-850f-a415bffdaf1b", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ef8f6c-35cb-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775928282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928282, "uuid": "8ae52c6c-1cb6-4ca9-90c3-d0e19df552f4", "comment": "Malware payload (NetSupport)", "value": "99be94c0971eb62128c59bfefb62349e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928282, "uuid": "ca63ad61-b1c8-48f7-ac46-353d8305c598", "comment": "Malware payload (NetSupport)", "value": "3724523bb6374d69da38b8c4f1c028450690389c58ee7cbbed8c26f362aa9f45", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928282, "uuid": "87d50ee2-8482-4fee-972c-6f54e253751c", "comment": "Malware payload (NetSupport)", "value": "4cafefabb3593b9607c1ec24801cdf2697f8cbbd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928282, "uuid": "80d2a8fe-7764-45d5-abc0-112aecb12449", "comment": "Malware payload (NetSupport)", "value": "e61235bb76808aebbbdc4d06a05512ab01c85f6448350d2aa05b1d21285fc73c36021088dc849eb0abff7f30c71c670b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928282, "uuid": "dc1e9401-5e56-4c62-b95c-ff89d838cad2", "value": "T15DD1B024C8FA5569E91D15B4030621216E13CBE896ABECEF3922BC24B301F651FB33D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928282, "uuid": "dabcf889-6bb6-450f-90e1-b800abe268f7", "value": "192:5TU24gOidLNkQz4fnopD2CRqVH/NxJTWUTLuc:B0g7kQzeopD2XHzJaU3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775928282, "uuid": "3b462fef-5b08-48f9-a60d-dfd5d479566e", "value": 6667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775928282, "uuid": "5840b862-38b1-456b-a13a-c11b74bb0b6b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928282, "uuid": "1c099b1b-0267-4366-95e5-201cd79eac4f", "value": "SoliqTekshiruviUZ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280b5a7-3584-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775898054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898054, "uuid": "cdd5d5f6-5631-42e3-bed4-1af5ca187a35", "comment": "Malware payload", "value": "a02659342f8ffe20868eeb699660bd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898054, "uuid": "72a2f0b1-2f85-457b-ac61-a18d4f2e4e6e", "comment": "Malware payload", "value": "379481574bfc430bc2da3a97bf01bc9e177cf408a576bf899d548a604495db0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898054, "uuid": "8b9f3eff-0e7a-4005-b159-e1e6c6dfba87", "comment": "Malware payload", "value": "33f54e3720349299005b8e2ef19769637d19ef9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898054, "uuid": "3e6072fc-7f25-4a54-bc1f-133e5bdf99b5", "comment": "Malware payload", "value": "43c0888141d9e08604ebffe79d554749284afee73c7ebadde88f6c7a8cf1296816e182bfb2648aa07b54c24bb8ca4625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898054, "uuid": "0301831e-fc75-4ffd-9078-8a3bcc028594", "value": "T1A5B533D63E04C1BCD33BB5F98A918CE1F8EB66695CF04C036561B3931E24931AB395E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898054, "uuid": "544fa04e-4f03-4003-8948-22177202f3b8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898054, "uuid": "05e62c3e-06df-4c1d-a758-62b4f983d73d", "value": "49152:Ta0tUuHqXzCJ2+mFWy1wc5HWRhCxQphLZ6oiykQGsO1u96gpiOK:20tUuHqXWJnNIHWR4OXZPJFU1uFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775898054, "uuid": "9c76e39e-4e7d-4499-ad9b-27f5c3df9acc", "value": 2463744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775898054, "uuid": "8bc37426-ed40-4f7b-baf1-8b2f7303d74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898054, "uuid": "ebb92946-89bc-4341-8b6c-83582ee2d160", "value": "Fortnite Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a844bbb-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931729, "uuid": "fda57d30-ab1a-4a0b-9d5b-ca6b4ce8656f", "comment": "Malware payload (Kaiji)", "value": "b904cb4ce2aa080e68ae69f4b890bedd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931729, "uuid": "7477f31b-ba1d-4f34-9d22-49860ccc35e5", "comment": "Malware payload (Kaiji)", "value": "3a7c2408713b426dbe0b08e7cf51421666b18872d11de099a8f2434c5e257b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931729, "uuid": "afce4a42-7bac-4ed0-b5da-aa65bdee7d90", "comment": "Malware payload (Kaiji)", "value": "9366c0874ef04c2aa1081c906df55b7ca8048158", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931729, "uuid": "ecc537bc-980c-4817-b5c9-28bdcfbd570d", "comment": "Malware payload (Kaiji)", "value": "0b3f1f9c30ab3731a599056fad4cf54879963b5dcde056543d6239b5b2e8d7b890a6afd35c4ca3f43804e3ea22a00850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931729, "uuid": "b8ff8f59-8a0a-494a-9535-486e9c81e064", "value": "T14CA50857B8918542C4E42677ACBE81C833635EB99B8663266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931729, "uuid": "3802c4ff-bad6-4012-ab44-b1e734d1ac64", "value": "24576:JgCbFbDVZ7bVCj3ozPQPTUkrtQ05OYRWNOrdErF4ff1kRrhnyVhv8uofvsRWA1SH:VCWxuM2T1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931729, "uuid": "55fa8222-23b1-41a4-b3de-46ad09b0b00e", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931729, "uuid": "2bda73e4-87cd-4d44-ad52-a1b0d7cbea13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931729, "uuid": "0e010b41-47d9-41be-a6f1-82cd9349c600", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ff1cdb-35f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945726, "uuid": "a8eeaa18-9b6d-4899-9cbf-d1ff7507d233", "comment": "Malware payload (Mirai)", "value": "ed3a720230af368530145f7b6c8b2965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945726, "uuid": "ee5d49fd-d525-456c-9939-83d14ceeb67d", "comment": "Malware payload (Mirai)", "value": "3ae5fe39220114be834f20f83580c0b4f2bf3f12131a6b3c13bcc42dd6f1444f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945726, "uuid": "072193a2-37c3-4137-83cf-e328a16c1f10", "comment": "Malware payload (Mirai)", "value": "bfee5875003e9361fdc6526d64192ed55468874b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945726, "uuid": "547b3470-07ea-453b-bbe9-b9301240bd2b", "comment": "Malware payload (Mirai)", "value": "1c4d018e43867d665416059f03bf18a4ab658e7eade8758b6d796a9bd1edccf4a71c8a06ebf44f003d357876469502c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945726, "uuid": "5f22c8c9-b012-4f2f-91fd-af2ff9eb0405", "value": "T138C35BC5E793D4B2D8430B7001ABE7395631EC621329CE2BD76CFFB65F22682B546618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945726, "uuid": "072b8fcd-a8d5-4be6-9826-1098433af06e", "value": "1536:W1MXVwBrNbNOQLbsiLkYpgbWxZ5S8g7Rkl9bdzUJ31Q6tNB5cz1r1l9FGnBaUUkF:nXa1Nb1IiHVxZw0Wu84zJ39KUkWfSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945726, "uuid": "c49a32fb-8329-4e9f-8420-b770270f00ae", "value": 119444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945726, "uuid": "29f149b0-808f-4595-a76c-4ca6e2496440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945726, "uuid": "c85c0954-ada2-422f-b172-f209a4a61f27", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5ad946-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911739, "uuid": "fbe074d4-88c4-45ec-a5dd-4c2b4860bb05", "comment": "Malware payload (Mirai)", "value": "9f78742a9d3a2b5fe369d6d61c80d01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911739, "uuid": "fb0a7462-7f03-470a-943d-7a8d40bec89e", "comment": "Malware payload (Mirai)", "value": "3b653b38b31651de518b6b22754de9f80f8957d4f6d8faf9886b935a108579b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911739, "uuid": "bd91de5f-737e-4251-83e3-59f4f4fccd1f", "comment": "Malware payload (Mirai)", "value": "c736b2e1d3a450b7056836d591d8a875077dccaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911739, "uuid": "bcfc5bb8-3c1c-4a0c-ab69-076f5d7aaea4", "comment": "Malware payload (Mirai)", "value": "77d0605ec8e59a4df79281e51c34aeebf2891146af0c6bab0213731def0215dd3b5022099407275931b5a3f281b481ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911739, "uuid": "5e44d4b5-bd9e-4ec9-bef5-b509d0957c63", "value": "T1F3730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F6077CA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911739, "uuid": "88fcd434-70bc-48aa-9d94-4a62d57e9248", "value": "1536:K0neYQY3k2iFkY4Zas7i70/cvX5F0rGvw/yAMC1TfXHK0cYI4iVz08sxGl4:CEk26kBZe7uiXL0rGo6XCRfuz08sxGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911739, "uuid": "e118e861-111a-43d7-b058-a509b7d85cca", "value": 79780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911739, "uuid": "ee6a71f9-2b5b-4377-b78a-125d3a1d3054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911739, "uuid": "114cb67e-7911-4f7f-b95c-eab9c63c9dbf", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94c26cc-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888080, "uuid": "a970a918-a2ae-4206-9f4c-ccfeda082895", "comment": "Malware payload (Mirai)", "value": "e17f40cc338c55602b2900740a2384bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888080, "uuid": "94567175-4009-43f6-9a9f-5129e793e545", "comment": "Malware payload (Mirai)", "value": "3c01145ed6ba3ada22abab16cdccabeac722fb6f6145fc2a316a10244790003c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888080, "uuid": "4ef8ac7f-1e3b-407e-b59b-e232bbddd8a0", "comment": "Malware payload (Mirai)", "value": "4cf53f1fe4b5dc0499347a0e25cefa8eb5126054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888080, "uuid": "1583af8a-c8e3-4b6b-8422-db16b688536c", "comment": "Malware payload (Mirai)", "value": "28599f7f8150ec113b3e34d6a888d49c3c16d9f9ce4b869ef6588e37f1c44187cf8e459d097918a31bf288f2f5e80e9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888080, "uuid": "1b613770-4083-432b-9f8c-c3b6bc33bf5b", "value": "T10C82B0A01571EE31C3700876DA7D4B83329682EDE3EBB6357978028A73E605657FD24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888080, "uuid": "c8ba409c-bc29-4802-b5a3-9319a22f77b7", "value": "384:e2ZK/RG5lCrKHIQ2RLSxrmaCB6yLwP/eJ3nNhymdGUop5huAh:1nlCr9Qe9LwOJ3Ns3UozM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888080, "uuid": "1870f1c9-47b3-48a5-b03d-435cb149e25b", "value": 18680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888080, "uuid": "6a76f5ad-5d1c-4136-906a-d8c0d764fda0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888080, "uuid": "cc19fda6-ee1e-4872-9af3-1d60f0f3454d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6670176-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911241, "uuid": "ff1cfc60-0954-4416-84dd-21cbd1c9d9b1", "comment": "Malware payload (ConnectWise)", "value": "243ad45b8e8f8cbbde4143b5ccd7f4e7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911241, "uuid": "9e8df359-da81-4ac3-bea3-3f4eb690f1af", "comment": "Malware payload (ConnectWise)", "value": "3cf2350bc8ee44b04f224cdc446ea1e4f2b2894fdaf8d3c5374777e412f17927", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911241, "uuid": "0342d8ba-d7e6-4b0c-9735-05261d2e85df", "comment": "Malware payload (ConnectWise)", "value": "15692327543f67382f73340499cda3267e76bd0b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911241, "uuid": "6eec557e-f39d-40de-9fa6-33a2e4c0ff4f", "comment": "Malware payload (ConnectWise)", "value": "be223468ecc0379373e3b9c189ed4b47ce434bc15958300cba3b68f4207f6ee92c7583ed43e0b45ccc71b650c030b129", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911241, "uuid": "5c5544a3-36e7-4e87-aac0-59dd933ed334", "value": "T1C5647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911241, "uuid": "faf9e576-e7fe-46b2-bf83-fd80c926eba5", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911241, "uuid": "021b2ee7-8b89-4fab-95e7-284ffa1c85f0", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911241, "uuid": "cafa155f-b66e-4e43-818b-a6a80f484ff0", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911241, "uuid": "4a9687f7-c7d7-452c-8f16-d847a6d7518b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911241, "uuid": "153c07fa-b240-4743-9209-52903a47d62e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dbf6c8-35de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775936604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936604, "uuid": "612c41cf-4170-445a-bf82-73e470d4624e", "comment": "Malware payload", "value": "4ad355f86df981569ae7b26b6e11d668", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936604, "uuid": "c40ce374-aa3a-4d68-90c8-24702ef891e6", "comment": "Malware payload", "value": "3cf7210b521de01b3580dce32031deec6f61a2726d9149f5f1d322379f8f8569", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936604, "uuid": "804b2962-36d8-4477-93f2-c13e8b282b86", "comment": "Malware payload", "value": "557993d2392607e9b201fc7a040650845ffb373a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936604, "uuid": "2e067cf1-fc67-4478-b2c4-3bc360a96d1d", "comment": "Malware payload", "value": "b7743571dd2b9def249a087bfdd12fc0dde1d1a0532532f9ddf662bd39a95bc7d55904d597a2d05c7a2d15517ac0f117", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936604, "uuid": "6c10dc5f-f1d1-425b-9319-aa8148ba009a", "value": "T136C14047BB915C38BB4B45BC8E4B04407A7AD02F580A0F27395E5BAA7F1D32C8AFD165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936604, "uuid": "b777e2cb-6a0d-4f92-8c17-0e9f78d7a335", "value": "96:snRLHkHrKbB06Yp1vHqL4MuX7gOXRRYXheXWWX22pvm54HqtBC53DWCXY9Ws/9LR:sn5cJ6u1vH0C7nbgsZsVs5zWCI999EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775936604, "uuid": "87aff41a-882b-4a09-b3b8-a64eed7aeb52", "value": 5951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775936604, "uuid": "813b6116-0e97-4fa5-a981-90507ede9fea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936604, "uuid": "ea751d09-1353-402c-8874-b55c60d1a0d0", "value": "microvolnovka.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d11da7a-35d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775933478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933478, "uuid": "d8b2cef1-545d-4072-9f52-8f167a70febd", "comment": "Malware payload", "value": "773181247801004ea3177286e295ad39", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933478, "uuid": "3e8eb667-47d4-4cc7-965d-609fc4092c53", "comment": "Malware payload", "value": "3d7859085238ac6246dafaad25e76b87d37605df91bb33d81df537b1dc55db47", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933478, "uuid": "79839689-b7ba-4641-821e-b04099e0d4dd", "comment": "Malware payload", "value": "fd96a64c4524fbd50327e4a327a433019d7537b3", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933478, "uuid": "65f5f818-12d5-4d0a-873e-0d359971f7c2", "comment": "Malware payload", "value": "ef789703396be0038d83698411989d9644159f9d928d2f16e03f3905ede90f8f1ba6be57fd5764ec4789e0022700abae", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933478, "uuid": "6ff0f1f1-692c-4b8f-8623-c7093fd82c32", "value": "T15442306063FC8517E4B299B569346B48DFE63C42A7F1C3CC0631362C6CB2A54CE11F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933478, "uuid": "b8701c98-9d76-4515-904a-30e08d62d99e", "value": "48:YEPBMVDGFfHF/1nADhuPBMVDG1HFI1wJV9V7EAtsjwLb/G/o/zmo/U:zCet1nADhuCmm1EveAtWwmOmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775933478, "uuid": "6db6b956-4d28-476c-a5cf-98e20e4b687f", "value": 12598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775933478, "uuid": "4f2ec6ae-403b-4865-b92e-3ff336be6023", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933478, "uuid": "6df43b74-0ddb-4850-a654-6bcaaaae33fc", "value": "\u0432\u0456\u0440\u0443\u0441(\u0442\u0440\u043e\u044f\u043d).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bdd003-35e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775937271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937271, "uuid": "24b59105-20b5-4871-8eb0-2be6802aac34", "comment": "Malware payload", "value": "6b07577f6b16d598e78d96df7892580f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937271, "uuid": "9ed33bf5-8b31-44af-88dc-ac26014e053d", "comment": "Malware payload", "value": "3e5dcb70d9c9af0acd34531af0fac9edccdc2638e8425503dde7b913dc8624a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937271, "uuid": "61a3a671-10f9-416a-bdeb-145fd88550cf", "comment": "Malware payload", "value": "9e559caa9a61ea52fd6e0585dadb4c20c623e753", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937271, "uuid": "6e1b4490-b6a5-418b-bb1a-42beccc97196", "comment": "Malware payload", "value": "faf3cf472b8afe99d73c44fd49d3f07ee29b9abad30899d4d8da78630505205977722feccd423a1229b4983e68ee5a76", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937271, "uuid": "b86d7c3c-ab68-4706-a289-9fbd74175c34", "value": "T1E7311892DA0720B1FEABD5F1128E0B8470169C889883DA9A3F333AEE60A93911D254C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937271, "uuid": "9f89cf6c-04ba-4ff9-9e26-9a09d55743b4", "value": "48:9GmeypruRLR1vrepzCycx4M7kiEnLAILfTtq:nzdulRx6CyS9EnLXfTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775937271, "uuid": "692976d3-7edb-47d6-838a-85c27eeb70f4", "value": 1707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775937271, "uuid": "68751d3b-b3c1-41f3-b42d-b0cec46c58de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937271, "uuid": "fb451d52-d795-4837-860e-2b2771fb1029", "value": "photo-328641553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b6bed3-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775938991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938991, "uuid": "0641e8c9-9059-4113-b251-deaf753665c8", "comment": "Malware payload", "value": "1893bf52ccbd6460854f79a33cee4ac8", "object_relation": "md5", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938991, "uuid": "24de2173-209b-4797-8b64-0248189ee2a9", "comment": "Malware payload", "value": "3f52c3f004bf2fb115662a651e749aac714be6b5d541b81e73ae9a935aac60a9", "object_relation": "sha256", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938991, "uuid": "5be2c928-2cb2-4f68-a271-101f580d139c", "comment": "Malware payload", "value": "388f1ba598b41e58fb7d6f9418735f8e106afe10", "object_relation": "sha1", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938991, "uuid": "04a1e776-4ada-48de-bc82-0a216c8a2374", "comment": "Malware payload", "value": "c2e77582c177a330300767f4082df96872e243d2c12652c045d41125a188b87f6a6870e3389e1af629da1e41811f4877", "object_relation": "sha3-384", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938991, "uuid": "3231cdac-ba64-4777-9f18-70a429e71bc9", "value": "T13E41B4EFE4169734CE43463401AA6D9DDF22E63B55029050FA8C4D01BF149B1F3A03DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938991, "uuid": "8263a812-0a30-488e-a1f9-e1395874aa4a", "value": "48:w2WkMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:QkUP4ZkS56kUf6qo8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775938991, "uuid": "61418543-a7a1-4a1d-b1a4-d29347e9e9b8", "value": 2275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775938991, "uuid": "6999a20e-0a90-46bc-ac1d-0d43dc9b3166", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938991, "uuid": "29508834-557e-4e97-b378-ec44d980279c", "value": "form_59474.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc449fd8-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775900996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900996, "uuid": "fd352ddd-e0ca-4bec-9b17-17d882f066fd", "comment": "Malware payload (Mirai)", "value": "8943f667e613b8c708bb02ad79864d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900996, "uuid": "00a16fa0-8041-40fb-a3f1-3ec8d7e9bae1", "comment": "Malware payload (Mirai)", "value": "3fd676b5eb9bf1889abfa11368e18094ebc12a5a4f9d9fba366ce30adc4a6955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900996, "uuid": "374c4bcb-4453-4be0-835a-2bf906fe1216", "comment": "Malware payload (Mirai)", "value": "aa69e822cffa4bca40c7d6113665374eb1804ac9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900996, "uuid": "4e39c5d5-c453-429f-bcb8-2d074a8f6161", "comment": "Malware payload (Mirai)", "value": "bda164665ff499bba0dcb99c826531540ebd54d7c2d65d0e66cd96501634e0ad1c98e6666857aee6c62f8da36ebd3c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900996, "uuid": "acc5b6f4-4d52-4791-9a64-b9ea1ca38529", "value": "T140F33BD7F800DEBEF80BD7374453090AB130B7A254925B377257796BEC3A095186BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900996, "uuid": "843cf1ba-26c2-4471-94e9-35ed76e5b9ce", "value": "3072:C+xHPLtIRyVDF8MJu2VIp2l1HXsV6jbi/LVPTVowbyjKHMaq:fHPLNaMJuQI+HXYL/yj7aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900996, "uuid": "c247c418-ea80-43f1-b177-20c9b6a307ef", "value": 171616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900996, "uuid": "6bac4c56-d529-4337-a8c0-a766d1852853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900996, "uuid": "9415add2-3115-43bc-9b23-f3e83378c934", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73631d6-35a2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775910920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910920, "uuid": "22175eeb-179b-4e2e-b5e3-e7c09b8a6551", "comment": "Malware payload (ConnectWise)", "value": "223c895f9ae8a1b02f0e23585c321145", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910920, "uuid": "97ed3029-74fe-4104-9204-afeab7db4181", "comment": "Malware payload (ConnectWise)", "value": "410a9dfae747296d7211eee81de48f8f4864421f41f384d67abb7828cc0062ba", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910920, "uuid": "6000c70e-b0da-4039-85e2-44b7a61c014e", "comment": "Malware payload (ConnectWise)", "value": "73b5d3b76e8fb66b52d3ba3f2edb69294b65c51e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910920, "uuid": "bb839b8a-0532-40af-b771-6cda7a2c4442", "comment": "Malware payload (ConnectWise)", "value": "9e0ec8916f05f2a3ab4e5dc87e7555ebbaa193622a2ed0b3a12a9bf8e0a81a59dd2e0cc0367e517403ee068b1f39d67b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910920, "uuid": "d0edc4d3-3f4d-4d3e-8f05-5c39c63e386c", "value": "T1B2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910920, "uuid": "818fdc6e-841f-43fc-84c8-bc8834bcd392", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910920, "uuid": "b880fd8d-b281-4977-b66c-08786ad1a50b", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910920, "uuid": "b7823d8d-8ebf-418d-abe7-8514e7be266d", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910920, "uuid": "75e9cf05-5a6e-4e06-a4d5-7668610de3ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910920, "uuid": "6db8a665-294b-40d4-bd43-29c02ec5284e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e9698b-358f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775902588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902588, "uuid": "cc4c1ae9-159b-410b-bdaf-fcf963a6f813", "comment": "Malware payload", "value": "e6f49812f587c2cacfc7e73a26a8352a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902588, "uuid": "0950aaab-b629-453d-8708-dc327ea6035b", "comment": "Malware payload", "value": "411b6a3a552290239c1af8b934413af2594f6fb3f5caa08267bff88fdeca50fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902588, "uuid": "d8b6c529-084a-4b3e-af88-1a61d6565bed", "comment": "Malware payload", "value": "f7792a52cca0b5dd9af7e4cb91908bed0ff5f33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902588, "uuid": "b58d6298-9aba-46ba-94bf-5ea402d3c441", "comment": "Malware payload", "value": "ccb5186f766b4690302b215a34c0984ef25da7f5d88bd9a5a3f2f7fda9d5a5760d721ac7a626da858a28cee9c46a34dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902588, "uuid": "03334cad-607d-4bc2-9d0f-6b44d90ed19d", "value": "T11256123FB28B753EE06E5A3A7A72E110543B7661A5168C1697F4C89CCF250B01E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902588, "uuid": "98b5487e-54c4-4eaa-b096-f9a41dd227a0", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902588, "uuid": "0199d3d9-b9df-4c50-8d4d-601fe4c7aacf", "value": "98304:S5OTS2/hOH1I39J5JwO583aL/REx6w4jowNVS92PxeunczDxvuPVNNiRJtffmaxT:Ot2NJOc/RfoKVAppvpztff1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775902588, "uuid": "57ac964e-a824-495f-9d0e-76b95fab460b", "value": 6331576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775902588, "uuid": "7ae7db9e-fe72-47dc-99f5-435c6e136b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902588, "uuid": "78cf4692-85dd-401b-b33f-e9d6ebc90ea9", "value": "411b6a3a552290239c1af8b934413af2594f6fb3f5caa08267bff88fdeca50fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805ef91b-3582-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775897004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897004, "uuid": "bdf7f723-fd34-40c9-b0a3-35ad551e6d0f", "comment": "Malware payload (RatonRAT)", "value": "e0120fde5dc76e36923da4d3cd1b4a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897004, "uuid": "1278bece-3ade-4796-ace7-74628bf73909", "comment": "Malware payload (RatonRAT)", "value": "412f13591a1ec5ae18f3a9b4640641561479310a9e94fe69e59534329a227afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897004, "uuid": "37d06402-ca02-4850-9e32-d17403fdbe5b", "comment": "Malware payload (RatonRAT)", "value": "98d20873caa1743dd8d08c0e16f9a3b94a2bc766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897004, "uuid": "99bcaf12-fccc-4793-9425-1f7b2c6cc329", "comment": "Malware payload (RatonRAT)", "value": "30115fee54ad3961e35311861a00bc563c45ba0f8d813b424d6e6ae13c051c19ff3b53ec0feea6dab3450d6b1d4943c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897004, "uuid": "a0d46959-50da-4cde-9c55-6277323cce02", "value": "T17CF41284B3AD2606EFBD8B3D19A0D0640F727D678A20E35C69C67C6F2636B435931B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897004, "uuid": "740af056-f2df-4bc2-9592-29a7d331c27c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897004, "uuid": "20846e4f-d20f-4bca-8678-329eb7d95393", "value": "12288:h7rR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIQ9KCZ6L+H:DL4kkA7lXkXDDuAOFhWSApiYNL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775897004, "uuid": "ff85fe2d-81cd-4398-a07b-dc85b9e74f78", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775897004, "uuid": "f7ef2cee-19ba-41a8-b241-886d4de5c5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897004, "uuid": "d3da74b5-174b-4cdd-9056-1642fa3dec7a", "value": "MSKBAzVEJT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e2f01d-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910970, "uuid": "6c1f50ff-1899-4e5e-b614-741f7426b9c2", "comment": "Malware payload", "value": "6b632343d3ea150e0427e697f772476e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910970, "uuid": "52476285-a99f-4ad8-ab0f-bcc4c2d57796", "comment": "Malware payload", "value": "42361899a38f8aca537a7004b75848af1a8b94d5f061dfe62e5a25ff1361737f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910970, "uuid": "7932cf84-cb6a-48b0-851e-0b4761cbeae6", "comment": "Malware payload", "value": "3044ed2ec5ce2a28154309b5efaec3ff3b743e25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910970, "uuid": "458217c3-271f-45c5-b771-5dbf288bee1a", "comment": "Malware payload", "value": "6ded82cc36ea96387864fe86f2180b9f65c8e4aecf4ddba34c5b149b861db561e37d8b13368e1953a453f7f39796e24b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910970, "uuid": "99245c34-a4d8-4c41-82be-d8870112f42d", "value": "T1D8440271F5C0EB6AD7C002BBFA4D118273520338D5D972068E64AB697BE7A730F35989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910970, "uuid": "ae6343cd-46b3-4c36-99eb-05b2df5d16a4", "value": "3072:2bUdM6QbvRB4LoVBSRTUO4stRKaJz2v3mOgvOnr0vowuZhFdo1wDSOLPBF2b6oBD:2bcQbb4LABA4stRKngvg0QVielMQdGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910970, "uuid": "05027c8d-9dc6-4cdd-8be5-92986d08e8ad", "value": 254005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910970, "uuid": "8895d6ab-d2f4-4135-a42c-0e6e6b872b36", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910970, "uuid": "87084bce-6fc8-4591-be2c-8f6f73b2cf47", "value": "eo7un5no4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9232ab69-358f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775902617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902617, "uuid": "680f5379-4b16-4a3a-8139-eca0a17afca9", "comment": "Malware payload (ConnectWise)", "value": "65a66bbf6c9deae49f2b305afefa0eff", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902617, "uuid": "19ab2201-c78b-4f7b-bdcc-b32e70869fc6", "comment": "Malware payload (ConnectWise)", "value": "42481fc54d82576ebec5abdffbfe0dd5baf72b0c4260419c4c413e9a64f4c46d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902617, "uuid": "a7c3271e-43ee-4e85-9ca8-8b807b52ffe2", "comment": "Malware payload (ConnectWise)", "value": "941b8ba1818a160810e0e6af01f6587ee5260f64", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902617, "uuid": "70d37ed8-0975-4aaf-b0e5-4753bec56a7d", "comment": "Malware payload (ConnectWise)", "value": "95ac0c720dc8cab9efb7d97b0dcf2294aacf3573506e329dedc1e9e79bfc792de78ffd8dbca5deaeedfee17f86e50b2d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902617, "uuid": "fe1b79d6-6d61-40ce-951a-6b4b553f6494", "value": "T17A836C43B5D18875E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902617, "uuid": "840f1bce-4371-4ff4-b93b-843698e52bfb", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902617, "uuid": "34b8ab54-5703-4ca1-9aa1-0b518f9e46f7", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT7rJ6:4enkyfPAwiMq0RqRfbaWZJYYTB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775902617, "uuid": "042c1b69-7c46-421b-8e3c-2491a98b49a8", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775902617, "uuid": "45529b1d-433d-4756-87a8-8cd88d13a8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902617, "uuid": "b80a8f6d-1271-43f9-ac97-e128acb1e478", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d98515-35fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775948925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948925, "uuid": "4a6281b7-423c-43ae-b206-b91b697f8c66", "comment": "Malware payload", "value": "1ead8506faf4d2f839bab3ad1f45f685", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948925, "uuid": "ec9e97e3-7eae-4150-90bf-49a03e397c85", "comment": "Malware payload", "value": "42a72c649e30aa169ab45a85d4a70986e1999acd4065257ea5b696444fdf619f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948925, "uuid": "76148889-9aed-4a36-b094-7251ee2d9ab8", "comment": "Malware payload", "value": "48cf5ed393bc0b2b2921f7ad333330bdbc337fdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948925, "uuid": "df24f177-e1ba-4ff0-9790-e35a55a151ef", "comment": "Malware payload", "value": "1c2a8ce57702b404a98ce27d400d20f69565fe9140feba5143b94afe4794951abb0d7808387de081e4f42e4dca2ee750", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948925, "uuid": "aef7bca2-9803-4ab4-9b46-47b94565f634", "value": "T1CE136D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948925, "uuid": "89c72eff-6181-454d-b24b-e50924f34e47", "value": "768:bSXRWNGxVu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:belxRcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948925, "uuid": "64218c96-bd70-4608-84dc-9496aa12900a", "value": 45507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948925, "uuid": "a9a624dd-4852-43bf-880b-ad21132f78b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948925, "uuid": "6b9bd301-2e1d-49fb-b91e-0624df89a6c0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88990851-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775939108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939108, "uuid": "fac05bc1-4d12-4c99-aaf2-93f6fb13b54d", "comment": "Malware payload (Mirai)", "value": "5e3900e1601707b86345be19b2dcea22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939108, "uuid": "50931129-fdae-410f-a189-55b9fd199155", "comment": "Malware payload (Mirai)", "value": "42d28652dce45b687b7e508166414badd213191d16de11133f249c710697df86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939108, "uuid": "7eb5282e-85e7-4931-a8cb-aeb240d68da0", "comment": "Malware payload (Mirai)", "value": "2cae7300d2b105d4e9055d0a22ae8e37031047da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939108, "uuid": "099230f9-05d9-4894-9b3b-6ab680cd9584", "comment": "Malware payload (Mirai)", "value": "b08e549995f939cdb64cbcccff13a045d54edb97145c23edf0d41a497a8f58008a625a06d6ae8d1b4975cf67fc2100ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939108, "uuid": "9a20d580-8796-422d-8c44-ad4801027931", "value": "T15D43021CA59E4EE8C4DD10BA1631AE06F0A1A7FD1D2F9D91D6CC332F6D88BC5F400A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939108, "uuid": "0ac90dd4-c57c-4a38-883c-23544a7ad295", "value": "1536:3bn/D/l+CZYj+VOw+eFsssc3Uc2jQnCwlEsAnouy8q:TRBZYqWssJ/jQCwlIoutq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939108, "uuid": "f0388af4-c07f-4016-8d7b-a7d4bdc419b9", "value": 57648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939108, "uuid": "9ee581a9-1603-4872-a49f-b250d6abdb7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939108, "uuid": "09ce5b2a-0383-494c-8a26-4a0592fb0311", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95afc36-35d1-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775931110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931110, "uuid": "b99b4bec-6a1d-4600-b159-f528c9c01ed5", "comment": "Malware payload (OffLoader)", "value": "204b4f9378af55662f62a355f90c22bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PUREHVNC", "colour": "#56AF03", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931110, "uuid": "a0cecf9e-5158-4211-afa6-3c1a417e059c", "comment": "Malware payload (OffLoader)", "value": "4350ef1a476ba590c6322276be502d335e0f2d4972945b34306bcd3e96ff3f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PUREHVNC", "colour": "#56AF03", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931110, "uuid": "5f123a21-54b8-4943-8013-6837aa256bf7", "comment": "Malware payload (OffLoader)", "value": "8f76f2803b6b609b331f95a683b31e44bfbea486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PUREHVNC", "colour": "#56AF03", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931110, "uuid": "a4234fe7-a1ad-4061-9a25-fa9eb3a8a1eb", "comment": "Malware payload (OffLoader)", "value": "c74e1368ccb6944b353b2106bf9df66b5543151e89064464176b2ac03be46fbac01cd9929aea9b0cd099c43bdb597329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PUREHVNC", "colour": "#56AF03", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931110, "uuid": "812e1465-bd07-49da-b5f9-a6e12b445410", "value": "T111A6BFE4E06BF947E76AEC34292D5120B8BA6031DB01C46BB07CDAB457B7390251DE9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931110, "uuid": "6cf60b16-3b15-442a-bee4-6867220b0afa", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931110, "uuid": "b3496c7d-00aa-451a-b183-93bb11c6b4f8", "value": "196608:UiNB6dEkh6fpTwKVziiXOqZ3SyoE9C6p7vE/I:UYtwgPZ3STEzdEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931110, "uuid": "47c1be3b-639f-41ba-a4ed-89a8cd679eb7", "value": 10031325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931110, "uuid": "042c661a-1061-44c6-9d4f-4d5f5730c6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931110, "uuid": "bf9b11b5-e4e8-4693-9f16-f85fd01a9fc9", "value": "Idfddt_2026.04.10_21.11.33_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70834a04-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939068, "uuid": "75bf4b7d-54ea-4d9e-9f1c-31f4ddc292ec", "comment": "Malware payload", "value": "88e5c48cd7d0ba596c136967b28803aa", "object_relation": "md5", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939068, "uuid": "4b53a0d7-c72e-42a7-ae56-7d9466e8f02c", "comment": "Malware payload", "value": "439391f35a6cffcfa1c6cb3e5e8f25ed4055cd10664a7e9ed438dd0fdcda9965", "object_relation": "sha256", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939068, "uuid": "7f7d5662-3ee6-4514-9c20-249d903a8092", "comment": "Malware payload", "value": "ff6f3b93df69a7960cd9b20448dc522c5f715dd5", "object_relation": "sha1", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939068, "uuid": "d7da142c-d0d1-4c90-a78d-aee99f7a82e0", "comment": "Malware payload", "value": "a9c57b9cceb8d860c692f80b520139bfccc8b7789338b00a16616c5a8757538368c4df4d289477afefdce54b89de0d69", "object_relation": "sha3-384", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939068, "uuid": "f5b3f424-f5b4-47c5-9039-c25af53b0388", "value": "T1B641B5EFE5169738CE438274016A6C9DDF12E63B1502A050FA8C4945BB149B1F3A53DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939068, "uuid": "e843f024-3727-41a0-af28-9e0b0b536067", "value": "48:w2QkMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:KkUP4ZkS56kUf6qo8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939068, "uuid": "fb716e52-48b9-46c7-8a10-1e830d33e7b4", "value": 2273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939068, "uuid": "1319d096-3461-45d4-910d-465ba0d2e2de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939068, "uuid": "63db6c1b-6a64-45f1-9737-a0fea24dfbab", "value": "JoseTomas.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c947defe-3598-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775906575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906575, "uuid": "71efad22-7916-4ead-aeef-809d039975a2", "comment": "Malware payload (Smoke Loader)", "value": "e0331fff2108cb68517213661e6b2e33", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906575, "uuid": "40be3465-7fb8-4bb5-b2c1-dbe9ae06abef", "comment": "Malware payload (Smoke Loader)", "value": "45751d025cd6d5cfb634d40de11335a74074c35e14d8e78056fcc3bc436c60bd", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906575, "uuid": "6e431545-3218-4b15-83ff-4368df934199", "comment": "Malware payload (Smoke Loader)", "value": "7176b34e2e1dfd3cd18a7c1b491e1f94ab82bc5b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906575, "uuid": "cadce0b9-5767-478b-9313-40a963991df1", "comment": "Malware payload (Smoke Loader)", "value": "7769c5e9ba349e2690791ee90078057da4b6342b1a6d47c0ee5674521756c43d76762c51f934763d5707e198f95de23e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906575, "uuid": "555830f7-242e-4a52-aaeb-c04dfa18f4c0", "value": "T1FBA56C0B6C9145FAC46A9732C8B75291BB74F8494B3233D32EA1BA782FB67E05D34744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906575, "uuid": "106f908f-c2b9-4977-892e-6fceaad4f6e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906575, "uuid": "475785d3-3788-458d-ae22-eabd667d59ac", "value": "24576:ZI6pl5JPhGZ1EXWta3rDUPwJhCInVMyONZjDBmFhheleh29mhPsfNW2Psj4:ZV33PWEXWAD/CvNZnB1sVW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906575, "uuid": "0d18bb36-5029-470a-8beb-0cf90b9d8ff5", "value": 2195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906575, "uuid": "da3cd102-a430-4946-94a9-2d72ea2f7f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906575, "uuid": "b4b45e8a-31d3-47cf-810a-85bdd3e96549", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6dda9f-35ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950602, "uuid": "80afdc5c-6016-4669-93e3-9ab44c12e493", "comment": "Malware payload (Mirai)", "value": "7404aaa8da146be703444bd42492d8b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950602, "uuid": "2cbf69ef-57c8-447b-bc19-89b16a73e17c", "comment": "Malware payload (Mirai)", "value": "471a9b058e62d97215ef1dd291d8a20f7993cc2b2d925989c1e351c5f539bc52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950602, "uuid": "f75a4f0c-450b-423f-ab1d-dd96edcb353d", "comment": "Malware payload (Mirai)", "value": "73d1daaec535e8444ff57dd76029c3b6bea428e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950602, "uuid": "636226f2-ae06-4656-8d4f-34297ddd2a6c", "comment": "Malware payload (Mirai)", "value": "69e1b32325f1aebdbc48f32f65aed11b7b345f784b9489b28da0c094d3c6f32883a95a6dea870d7d75f2549a4630136f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950602, "uuid": "7121ab0d-f841-4d30-8424-89577408bdec", "value": "T1EF530253621EC31383F7B8BA9D7E10419B2F6E3140EEBA520551EA34B49F867F275152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950602, "uuid": "cf797731-3a86-4a7e-9e95-0495163bce3a", "value": "1536:c9v442aHaPocIonQ0dO3yhdOfTE1hsQTjem2cjLEVhV:cF1cPfarE4ijn/6hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950602, "uuid": "25624207-e55d-46b8-a0f2-87892914b616", "value": 64144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950602, "uuid": "efc3f9b0-08da-47d7-8287-303eae06bce8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950602, "uuid": "e1042361-4615-49ef-a107-e4244611ca86", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e197ff02-3592-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775904039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904039, "uuid": "71c2f791-13be-4796-9832-16c1a799a546", "comment": "Malware payload (Mirai)", "value": "47ffa846a7f64dec023b364f78349aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904039, "uuid": "ff99694f-fe1c-41f4-a561-8347e9c0c3de", "comment": "Malware payload (Mirai)", "value": "473612bfc3478efcde5666a2bcb6b5be5f21f56f98b4b64b4524ce682b176ab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904039, "uuid": "2e733aae-b541-46cd-90cd-11b7be33a642", "comment": "Malware payload (Mirai)", "value": "29b2515b67f3dd2c12ffc7da59844776aa706fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904039, "uuid": "3b034a6a-a500-4e34-bf59-cf77cba024e0", "comment": "Malware payload (Mirai)", "value": "9c6e44bc3d84fc89b7d06b1aa0ff9949bf4db5145c478ba3adcde638d8b93d78b94d59be0a8c2e330ed6dd55da811fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904039, "uuid": "78bc9967-17c8-43e6-a8c9-672fdf2e8b3b", "value": "T118F30916F8819B12D5C112BAFE1E128E37131BB8E3DE72139D245F60778A86F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904039, "uuid": "999b44a2-bd71-485e-80f6-f81d736b676e", "value": "3072:aerU4lEUCYNUxXi8Da6nOs99RTXK3bcHg4r7T:aS2V3xX3Da6nOsbRTng4r7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904039, "uuid": "da540a85-5454-4938-a001-76f61cf98830", "value": 170844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904039, "uuid": "cf10a2b6-0d6b-4e99-b29a-fd7683acf02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904039, "uuid": "8c212af4-1fef-4b9f-9377-6d1fbbb16e28", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0303d-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931745, "uuid": "636277d4-a84e-48af-8a69-f9d645958454", "comment": "Malware payload (Kaiji)", "value": "adabc3efdce4ff0451de47a82d297269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931745, "uuid": "3d7561dc-939b-488b-9807-1ed8a7d88ffa", "comment": "Malware payload (Kaiji)", "value": "47b6ecba4e77e4fce84fe768b11d8bde2936938c2ae07a35aa9aa8f7fe6fe192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931745, "uuid": "61685c38-6422-4c16-abdb-95a7221233e4", "comment": "Malware payload (Kaiji)", "value": "d9a071c518c2c936f07fab404093f3724fb4da4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931745, "uuid": "869d5b66-b260-4b6f-afa2-0d4d548a02e4", "comment": "Malware payload (Kaiji)", "value": "07a51322cb228e81876aba6ff5cf01ba568f2752dda807e87520045e7dc09eb7ae88d55ba09cd48890367aa635521689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931745, "uuid": "3e645143-746e-4212-a2df-46042f794d72", "value": "T1D4951711F98B54F2E9071A3104AFA26F27319D054F34EBC7EA40BB6AFD776D20932259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931745, "uuid": "c38eefbc-96c2-4b8d-9ab3-601d7f8e2f88", "value": "24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJjIbdYVVMtIwWz1v:WYMnwRO4ssPkd5Wz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931745, "uuid": "03b5fc87-c3d7-4839-b0fd-dab03c1fcb36", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931745, "uuid": "e91ce93b-7de5-4c52-8345-185bd9d4c71d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931745, "uuid": "2e92fcf0-b730-4b2c-9216-33c28b73bfd2", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d694ee-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896687, "uuid": "051f99f1-9cf8-46fb-a40f-c47eaa571a2b", "comment": "Malware payload (Gafgyt)", "value": "3f9d2fe2541c671cb09fc8ea806b434d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896687, "uuid": "a717989a-79fa-4167-b44e-d9d0c05f5dc3", "comment": "Malware payload (Gafgyt)", "value": "4886b007766501738fac2c7d95899f325de78b87e6bf33636e35022d59286316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896687, "uuid": "aebea8f9-d3e8-447a-971d-64c81427f6aa", "comment": "Malware payload (Gafgyt)", "value": "49ce9e63d0861943d9c563c370fa07c945ac8c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896687, "uuid": "3fa14847-ae63-46ea-a56b-5aeac812262e", "comment": "Malware payload (Gafgyt)", "value": "eaa93f4c12318ee5dd28aa669df428de05c419e03d44b1fa9d2fe6241b87328e5043d7cd51b081fa6a20ef0461b11a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896687, "uuid": "6227f6a6-e7df-42a2-9b39-b3655e6728b5", "value": "T181D31905F460876BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896687, "uuid": "84a0b2dd-2edb-4cf6-b6a0-47ea1eed73a5", "value": "3072:Sdf+fvEqa9FazYA7IboRhke391CErktmCQA9FX9aH:ifWEqa9FaNhke3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896687, "uuid": "bd5d2a53-fdbb-4e40-a391-4adba3ae6e0c", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896687, "uuid": "702333b9-1073-4218-81aa-f1764ca0cfce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896687, "uuid": "a2d4e101-b577-48e1-95bb-d9b8ad42220f", "value": "arm61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de7f588-35f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946875, "uuid": "2e6880d3-0603-4610-9bf0-04306ac2d522", "comment": "Malware payload (Mirai)", "value": "a4bb1d27f9bca1bb1c2b465f248f41c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946875, "uuid": "404df5ac-d5a0-4ddd-8427-514d3a893c99", "comment": "Malware payload (Mirai)", "value": "48e2481b101ab38f2b060c8c1382070774ada4f4690474642ddb5d97d309a4c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946875, "uuid": "d1dcd6b8-efe0-4f61-8dae-b43acc89eaa8", "comment": "Malware payload (Mirai)", "value": "3a9e2f493aacc708bb6191b432ec2b095f8a08d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946875, "uuid": "f7a99f4b-d115-4756-bea0-1acc33c68408", "comment": "Malware payload (Mirai)", "value": "f45e6d24bdf0dc39b589eb90cb619a56fd27d5f11833e8fdbf12772eb6b4da9207ff641283efeb63ce7ed032ad5cf569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946875, "uuid": "2c885b9a-d0d6-4a4a-969f-52d0e486e91c", "value": "T1D744E806AF610FF7D8AFCD3306EA1B0129CC681B16A52B36B634D968B50B58F59C3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946875, "uuid": "e414124d-1ff1-4c5b-8448-0fdd112ab68a", "value": "3072:xayY2qFDRQI5SoR6yBIvVh74oEdixmG5bK4Md/0FXyiYdfTmPhsqV:xDYp9QsSThx6ixmdRdc1yiETmPhsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946875, "uuid": "e00dd61f-16b4-41a3-b840-e1ab981e5562", "value": 265008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946875, "uuid": "5ca6d6a0-5c60-4b9a-8d41-ef5ff4af9c14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946875, "uuid": "b1716cb5-49cc-4adb-831d-ca9343d938f5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf952528-35db-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1775935335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775935335, "uuid": "86ce3284-6e26-4979-b283-449ad6128a50", "comment": "Malware payload (Socks5Systemz)", "value": "6de1a661015a94cf10fb95ddae6dcb84", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775935335, "uuid": "b0218a4e-7b0e-49a6-a870-7b1281f56a70", "comment": "Malware payload (Socks5Systemz)", "value": "48fce19c824842968f4898a4743ef630073b74fb82eb05743dece5922226adea", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775935335, "uuid": "b0b4ebd9-80fa-4206-8695-887b3c764bf7", "comment": "Malware payload (Socks5Systemz)", "value": "360cbe58f06abfa097da5b77579cf2482e618408", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775935335, "uuid": "c54e47c6-f565-4d7f-aee7-a077f7d665b1", "comment": "Malware payload (Socks5Systemz)", "value": "b15901c55f7e4e9035230d5d74def885cd15a547f7f6ada16d25c5d63437279e301aa7cf8783ab6b9e77151990b2693d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775935335, "uuid": "635a92a4-9b31-4e3e-bfdb-8364241f6f5a", "value": "T1D4F5337BA055CC3FC6B5CE301911170B062EB5890D37727A28EDB81E9A25FD3962A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775935335, "uuid": "62bebbd0-621e-4b94-9599-7337fde3fb5d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775935335, "uuid": "e0b37b0a-6bff-4534-82cf-4a3b5c552290", "value": "98304:N0fIgZwn/R1gj3Le+TdQdHqE6Aufr2pFV:Sf3ZwnQLlBWH6A+2bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775935335, "uuid": "7885b2bd-2500-44c9-9e27-6cbf1a17c46e", "value": 3564139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775935335, "uuid": "d7d4f08e-573a-4ebc-af99-1d7389d7d6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775935335, "uuid": "b664efa3-8445-46fe-b043-b69381e14a82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ea1bef-3587-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1775899060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899060, "uuid": "59e9a7a3-983f-488e-8f6e-98e925850073", "comment": "Malware payload (Expiro)", "value": "0ebb443942683e341ec3fdbaafa847a6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899060, "uuid": "986e08c0-0c8d-465b-80b7-7ee2a1dfd7d3", "comment": "Malware payload (Expiro)", "value": "496a17a786488b9f2edac47b19c70558fd995888ab1db0f5a579c751ae54d68c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899060, "uuid": "be1a20cc-cdd2-4e27-a860-4bf7ec8956b0", "comment": "Malware payload (Expiro)", "value": "0db0f7b412dedbe3421178a8e86e241deb143a17", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899060, "uuid": "01a548ac-8b98-465a-96be-15c1b8b78dbc", "comment": "Malware payload (Expiro)", "value": "9e8bca67cb5aaa7a43db79aab378fc93786c08f977a1caa3cca8e83486432d0b2257056e8a14438d1ea3baf7a8b53559", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899060, "uuid": "aafc326f-fc2a-4bdd-9c51-cc35ff03c9cf", "value": "T1096633CDBFD71A74F8AA2B31549B49B1A9F53E38803CE790E657644CBC326535326328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899060, "uuid": "163a82e2-a770-42be-aa02-ca437bb44371", "value": "323c0c2c042bf47745df8efeeaa656f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899060, "uuid": "4a7d0d92-b33f-4ae7-95f7-ccc0c779862c", "value": "98304:ERErU2ECusdAWQRCP2zvV4qjU+s2wr9+xhXg1mU07YbJDtgZ+lXb:wkECusdAzhzTDNhXmYkbJxlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775899060, "uuid": "2ad239de-a6a5-4c0d-bb15-ea8ad1200157", "value": 6990848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775899060, "uuid": "e464f684-17ca-44df-afa1-fc185280e0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899060, "uuid": "dcdc998d-8c3d-4f77-909b-c430ff9a61fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ec871-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775900995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900995, "uuid": "b8d78cbc-6f68-4b84-94a8-75b71df3b785", "comment": "Malware payload (Mirai)", "value": "c35cb53693d6969f75b49b2784ed4baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900995, "uuid": "4908088c-f245-4684-8610-ba142ad1cc10", "comment": "Malware payload (Mirai)", "value": "49c56ea547ffd13726228e63a1561f21e85f9c280fdd2363f7dfaad21999ba3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900995, "uuid": "c968a632-50cf-4d87-bca0-f626164fc37b", "comment": "Malware payload (Mirai)", "value": "d997a527d9356e34a9ef90685d3cb5f97411b7a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900995, "uuid": "cfe7020d-83d7-457a-84a6-37f1b0bc37e1", "comment": "Malware payload (Mirai)", "value": "5319b25d66a356e4ce77f0923fd8f5ddeca8088652775ee528d8132616ef71041d65ef1e29d48b5ad4af9030e2dda20a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900995, "uuid": "01bee890-1d0b-4dab-ab40-4b5038ea914e", "value": "T15D14C60AAF610FFBD8ABCD3706E91B0128CC545722A83B757674C528F54AA4F59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900995, "uuid": "773104dd-06ab-428d-8e4a-17aca3fa8b8c", "value": "1536:3lmU/XvespyJ86VOzj/iPWeLi9IvHOM0ujb0BRKZXBicZXs/rZUKFaz2ZoKmxIWq:VmUOod6VI/Iz30DKrxsVUKoy0IVpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900995, "uuid": "12183acf-d02b-4bb1-a9d3-33f65eabe670", "value": 206516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900995, "uuid": "914dca11-bc8c-450a-aac6-8b11ff39e871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900995, "uuid": "a0420d1b-d391-4853-9e64-e4156b253ea9", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0484f73-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917270, "uuid": "d417e28b-8f6b-4970-98ef-7f6d907ea89d", "comment": "Malware payload (Gafgyt)", "value": "3ed850b660bb47cc4fa7a4c1ef941ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917270, "uuid": "9d9672f6-9414-4828-bed0-911740cbdb4d", "comment": "Malware payload (Gafgyt)", "value": "4b06e68ce6e450cc021d9ac1e8b2e6f6308e7ca52f5047ccb55b2b955cd13a8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917270, "uuid": "46661cef-124a-4925-a2d8-a462d95252f5", "comment": "Malware payload (Gafgyt)", "value": "f853c260d8a9f71a2d232d964e015538d52e705c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917270, "uuid": "d9c84d30-59f1-4e71-8f98-e3c29268b80c", "comment": "Malware payload (Gafgyt)", "value": "52d2658f82fc094f2cc1862e9523f5ab410d8d14114e3ee902adfe16ed8c68178f4f3996f78ed9bf11ad102522a7df56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917270, "uuid": "121ff61f-4047-4985-aa8a-35e6b0540258", "value": "T1B4A3120878E0620DE5BC41F9BE4B961E0B6A82A1E17EFC5C97115FFC63E02AD877D542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917270, "uuid": "5bf9983d-49f6-41de-8e49-714ba1eb4c82", "value": "1536:aKm5a1GT/BiMEbHEu8Kpvt9hKVIDUPjREYBZe4e977zZh6iBXoAHi+8BQP7:nMaYTIMEbjvt9hKVYw1q977H6iBG5Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917270, "uuid": "29eb6ca4-aa95-481a-aca4-c49064608a85", "value": 104076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917270, "uuid": "a608d86b-92d9-4073-b203-79750297d27d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917270, "uuid": "ff9819ec-702a-47b2-b638-cd2f45d8a72c", "value": "redis-buildxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8779ae-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901000, "uuid": "7f75310f-11a4-4ce1-847b-95bdf275aa8a", "comment": "Malware payload (Mirai)", "value": "e6eb2d0d572c3158ef84a6a8d9e2acd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901000, "uuid": "9f7d41ef-fea1-4006-b2d6-2db3d3f2c8ef", "comment": "Malware payload (Mirai)", "value": "4b77cc9d50c0de4998311e507a5675ab02b5be0373f2aef74482bd9f0f31fb78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901000, "uuid": "9f7d59a2-30cd-4a0a-b352-e3cf9acf67a9", "comment": "Malware payload (Mirai)", "value": "927157db9db7cc0c29933e7ef38465b8325e7061", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901000, "uuid": "d7d087c3-79cf-4a2f-86c0-855cd19874f5", "comment": "Malware payload (Mirai)", "value": "ce7efe1c3b6f9aa892d743ddc842e5075081b821235724b7730d2bc25b8f97ee4b6386e46cdc3c4c605ae54e52a5602b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901000, "uuid": "262260e9-de92-468d-9b12-5bdd840e943d", "value": "T1E8746BE393078E5FEC5A577906D74F30B3F299A222628117E279BF2967221C0DE15EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901000, "uuid": "1d637cab-d7fe-4555-95da-6b4626e89e3a", "value": "3072:wKcvCM5cVCxvC55CEjs54aTUdtDbWiTQjqJdrmy6N40JKmpu2dK5qNdeMta:w7CM5DxiIEjsB8t3W9qJBx0J2qNd3ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901000, "uuid": "62badeba-65b7-4d92-9c74-f4265c084e96", "value": 342102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901000, "uuid": "418f28a4-6851-4566-91d1-a5cf05953f84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901000, "uuid": "776fbe23-5ca2-4e12-b3e9-ffd9c4509143", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3feef8-35d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775933160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933160, "uuid": "9fc5c009-f3f7-4d53-a42a-8dd910b6065e", "comment": "Malware payload", "value": "58de9a3596dcbd86d6e37e55e2f9572d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933160, "uuid": "d2a7c9a8-21b4-4994-9c03-2ac9f2a286d3", "comment": "Malware payload", "value": "4be0aa46d7fc6deab04f210881e4f9ce9914fd3ca407f7f2f6782b6ee0e628fe", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933160, "uuid": "8a1e36f0-8e49-4b2d-8eca-77e1e06c5966", "comment": "Malware payload", "value": "10de61d5eb28aa22e81c8aa07021d8e5d2ea2955", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933160, "uuid": "9bace7e1-5506-48d4-b87b-d3a80b3fdcff", "comment": "Malware payload", "value": "c00935c1296201ee8f99d02564bbd24da45465fd5f687876f95e94c147d2cf9a2afcc275c24dbca831d817341509a963", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933160, "uuid": "608cd619-bf5c-4b4e-9eff-985e8d1d95cc", "value": "T11EC6335637A3494AE08B433062238656EB24BC465B9C63DF4258FF1B4E737F06CB5AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933160, "uuid": "fa49e89a-23e7-41c5-88af-456b6b225450", "value": "196608:ujkjviEtUvQw9BDJuyx6GK3ji5Stzvdf3c0c5r5jEOuIbxsbFSdPMG:ujkjPah9hJ6GK3jXtLdEVruIbxSm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775933160, "uuid": "cc4e5b2a-f7d6-4ccd-b33b-f4ca276c8e6c", "value": 11649024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775933160, "uuid": "9ca6291b-cbc2-42b9-912e-48fbd1d7e9d4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933160, "uuid": "ab84684e-a86d-4108-99ff-1a039b616d9b", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c222fc5-35af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916378, "uuid": "d408a993-8bf0-4e1d-9fcf-0bb2b515053c", "comment": "Malware payload", "value": "abde073d29ad9dc3bd6f927d27d33d96", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916378, "uuid": "9d8e89a7-6436-4e99-9133-a94da7bd4e0e", "comment": "Malware payload", "value": "4e26b76937638f9e3bd7a09d48eef026a4770b41376ca4d4bb44a22926947a78", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916378, "uuid": "ca32606f-e59a-4a1f-8189-dac61b8414fc", "comment": "Malware payload", "value": "e71ff4a6910b12a2b4c7359a9cea5f590ac90b07", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916378, "uuid": "041bfff4-416c-4683-a1d8-5dc82d1e6348", "comment": "Malware payload", "value": "173cb0d8216870a2ec67ba3b6c0af74c91e360e62d36986734b8c4d17b5fde4a61e9753bf395764f7e13c6312a86446a", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916378, "uuid": "21106771-9d98-4169-bea9-3f5a7af9d97f", "value": "T1DED633EA3DA10513D49CFABC51624C9F039EA4097C82634E3552197D9A8DF83C6CB6EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916378, "uuid": "23286f10-9122-4545-a2db-cd487cb7cf20", "value": "31284eedcbdf23da47fe7ed31d3eba9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916378, "uuid": "614e7022-33a2-4fd9-873e-e18e597fb257", "value": "196608:rp4b6ZdaDd7Ld/AhxOvuM0Ijj/CEU06rbHo0a2cNFfBZXhmK+iDPZloD4oZ0UeME:rpCd7Ld/6xNI3aESbaHB7j+Ko8wyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916378, "uuid": "2d184c4b-9406-4e19-a87a-f97b3f8e94d8", "value": 12823056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916378, "uuid": "91c07475-c7cc-41e7-bfa0-c065bf07f4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916378, "uuid": "94025895-45e7-4de4-b25b-c6ab986a27c7", "value": "Horikita.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63925a95-35ee-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775943341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775943341, "uuid": "a640b54c-6c94-4bda-a263-b342f07a5fa9", "comment": "Malware payload (RatonRAT)", "value": "629e0aa59731aa9cf26c783f37a5f252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775943341, "uuid": "050747ac-3568-4eeb-ae08-97acb7180b7c", "comment": "Malware payload (RatonRAT)", "value": "4fbecfc9618c481a7ce291dd54179b997fc1ce6959fb6e0212cc696a6418a3c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775943341, "uuid": "38b0494a-6c13-4891-b8f8-e10a5c0086e4", "comment": "Malware payload (RatonRAT)", "value": "d5871c989924050aa84fdd47eb1aca6d2ccf929d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775943341, "uuid": "68249a36-7800-4403-b705-4655e9b91f0d", "comment": "Malware payload (RatonRAT)", "value": "2bc9460a6a39814c5b222ffd2960d0fb705d24bb678663c801f19d0569f19c10bc4407b4f19252c31f3293a20e150dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775943341, "uuid": "3fbc8b81-451c-4117-bf32-fd7586a30e5c", "value": "T1EB95F11C33F98A18F2AF0BF4E97185654771FE178C12DB6D59E579DE00B2F48A620B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775943341, "uuid": "0afe28ff-faf8-4f58-adaa-01ce30d522df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775943341, "uuid": "a21b9549-c136-4a2f-bdb4-4095b6b02c69", "value": "24576:q7z8CrmiaunV5vQ2ue52wWLt3QA2cWAnOEvSrtv94TP0lRRkxYcxMNnyFoBOkA69:2iGWU5+5WD1sclR0BxMsaRw4AyOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775943341, "uuid": "d365691d-a32f-459a-8b04-669b2933dec1", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775943341, "uuid": "d32e44cf-791a-4e8c-b16c-c4b3b48100d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775943341, "uuid": "b16ae15b-85d4-4496-a59a-2ef872246da7", "value": "Nexa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7784f6a2-3539-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775865635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865635, "uuid": "93f85390-8cfc-474f-98ac-895e00aa718f", "comment": "Malware payload (njrat)", "value": "0bde3611657a78c1eff1585f42d884aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865635, "uuid": "72eaa8a8-519d-42fd-addf-a61309c5f2c6", "comment": "Malware payload (njrat)", "value": "50bdd8af5436df62a340f45efc2fdc2b120b6e48af483150817764cbff1f7719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865635, "uuid": "ad937ed0-76e9-4710-b384-e5273c1423f7", "comment": "Malware payload (njrat)", "value": "4d156ef620146dcb89183b9a92688f16ea3094f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865635, "uuid": "b4ad0628-1e95-4a6f-8172-be1424455100", "comment": "Malware payload (njrat)", "value": "1560f8e8aa29c0f00a1deff6116cd6f90d021489af95d4c1c73701883b603b7cf07601ed7d109b7b48bbc0584b0efae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865635, "uuid": "45210da7-2499-4bf5-bab6-38c1826c5eac", "value": "T14A93E94977E56524E0BF56F75471F2004E74B48B1602E39D98F219AA0B33AC44F8AFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865635, "uuid": "1a49f473-7dbf-475c-bf22-5dd06410f81c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865635, "uuid": "c1128d64-7fee-439f-b9eb-550e1c979788", "value": "1536:0ujJD/HBZbszKu9AZpd7r1jEwzGi1dD5DJgS:0uCzK4AZ3HCi1d1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775865635, "uuid": "f4e6c390-ed30-489a-9af1-825b501f4bfe", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775865635, "uuid": "ae756201-d0e9-405c-be84-a9d26ccf865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865635, "uuid": "b6682a0c-231e-4782-a434-83b1212f4197", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c94133-35fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775949275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949275, "uuid": "22cb94cd-fd24-44a0-a002-38c7864db167", "comment": "Malware payload (Mirai)", "value": "17abdb19993cd72ee58863a495dda222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949275, "uuid": "a612a202-2796-4fc5-a9ad-bae5cbc0ec9e", "comment": "Malware payload (Mirai)", "value": "525630123a01efd91a7ea114d9ab483c51d1cfa22639c56f52c83551819b8087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949275, "uuid": "94a0a5f0-d5ad-4500-9741-eebf8ba831fe", "comment": "Malware payload (Mirai)", "value": "8376a27b41712ae03bb98ff8759966a38ff59665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949275, "uuid": "cec8f2a0-c649-42d7-93aa-c0ff22af3d8f", "comment": "Malware payload (Mirai)", "value": "e5fa9485883de3d414b5bbd81a035eb6369ad3720b2be0921f4dd47f13312f4599aeb984ac415742198d29d5a6fa55c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949275, "uuid": "aaef294c-42b5-4336-ae5a-8a9e2f78abab", "value": "T14644951F2E228F6EF36986B047B79E24975C37D626E1C680E16CE6105F502CD641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949275, "uuid": "53cc3ee5-1c5c-46c1-9631-d45f2701757c", "value": "6144:g1yTvn8hGazNcimgSxbbKvbmFd9wvnScdw:g1KNbXFdMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775949275, "uuid": "644394e5-f099-4992-bbd4-dff09f49d903", "value": 256816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775949275, "uuid": "e8e35250-d38c-4d0f-b55d-f12891f63003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949275, "uuid": "8cb98c9b-f165-44d3-85c9-84185ed9f190", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f20705-35c1-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775924155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924155, "uuid": "aa31e911-2be5-4af3-9abb-4875b2b2e051", "comment": "Malware payload (DCRat)", "value": "16576c6235bd87fc6c06a13ddb1fb104", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924155, "uuid": "2bf8ad35-3a32-44ab-bceb-5527aa95a3bc", "comment": "Malware payload (DCRat)", "value": "5270663410266dd8d172b3232365fe4127979342f96d78cfa8a020b9862ed22d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924155, "uuid": "a7502637-d2ee-4a1c-9f5b-be8923bd90d8", "comment": "Malware payload (DCRat)", "value": "e1dbaa1ab5ef8353cfdcf1c04192cab3a357d1b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924155, "uuid": "bfca78cb-1888-4ef0-80c5-2d5bce86ac8e", "comment": "Malware payload (DCRat)", "value": "92803b00dd8644dceee35f8a4e6d0f4bb859b0b8a6e7e27645d18b3e8bc1217f56611553e877578fb4041aaa4391bc27", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924155, "uuid": "2aace85d-c418-4e78-bd72-550ff887b3b8", "value": "T19A556B017E458E12F41D2233D2AF850447B4AD502AE6E35B7DB9376D1922393BE2DACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924155, "uuid": "7063389a-30b1-4255-bcc5-b37ae8cb1040", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924155, "uuid": "cc06df02-25cd-4fbd-8a69-4d57a08f2349", "value": "24576:B2G/nvxW3WuncLyIcZR1u7xKE8ium3czNH1koKecTettxAMastqJ2K:BbA3ZcGIGYN8iuTz/wq9AM3tqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775924155, "uuid": "6484de29-91f3-41a6-a5f8-a7aa8d532d0c", "value": 1407585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775924155, "uuid": "e4e8136b-755c-4178-bd20-1efb04e6b024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924155, "uuid": "9cbd9070-78a7-40f6-b36f-51521f00d481", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0323f32c-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910967, "uuid": "cdc69c4b-f91f-40ad-aecb-61594e7026a7", "comment": "Malware payload", "value": "d1f03ef0b0f98bbd9e52e8013985d801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910967, "uuid": "e1d590f7-19b3-439c-8740-c0717c235304", "comment": "Malware payload", "value": "53d6fcad33718a4e75a9cd1204f3d741c075e584d41ab3beed7ab807c751ebb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910967, "uuid": "c35002ea-3219-44af-9d81-d33171be6f53", "comment": "Malware payload", "value": "1ea8b184c39a6ec18bee3a9ff0b4d47af89307fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910967, "uuid": "8ea4f7cf-e3bf-44ef-8f1f-27e069dc93c4", "comment": "Malware payload", "value": "79a11f1461bb2eb3debb1f8c46f77d69ed2422a5090827140e88e014e1f50435e7d9b87bad72022189eb0ee689ae1c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910967, "uuid": "1df98a4d-83e4-4ccc-895a-75ab16e21829", "value": "T16B541240DF580527E9675DF49EFF176AE30D1CA040BBE46A480CBB9A15A3EB3C287352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910967, "uuid": "23cfc4a8-0df0-40f3-8046-c069838ac6f0", "value": "6144:ZuZPHvgFjkeUGKUxcPMxLGTo6SoIQSfV+PaPODQ3esccoxsO:keU3WcQLGTXvSfVADQOxiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910967, "uuid": "3d84120b-67c7-456b-8a9b-6f73f0a0414b", "value": 289075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910967, "uuid": "5f9eb528-184e-48c2-874f-a9e618eed80b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910967, "uuid": "5ee7d6db-939a-422c-892d-05564b161f50", "value": "bl1e67obm3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0805f97c-353a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775865878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865878, "uuid": "33f29958-9636-4aec-98a2-c86e726d0664", "comment": "Malware payload (RustyStealer)", "value": "ad30038cf70305e5ca1c20e80d32453a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865878, "uuid": "b5078a1d-8507-4925-8c5c-886e3c9502a8", "comment": "Malware payload (RustyStealer)", "value": "5605f711e9c256b09dcf06c4f39851545dbfc05c1c5b3e5f3129b16506e7df19", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865878, "uuid": "c45a5aec-4d78-49c4-9e09-46fd84e3702d", "comment": "Malware payload (RustyStealer)", "value": "8afd98be615e7e5e8d13ebd862dfec6fa00307a5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775865878, "uuid": "c3815933-0d05-48b7-9464-04f5640c86d7", "comment": "Malware payload (RustyStealer)", "value": "c169e7eb9dc4f301d824d4b33bd52fad1674bc1f31985b3b82da15ac6e8f7a2c6265a713003c8de9a86631dd71109965", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865878, "uuid": "accce5b0-922d-4c75-86ab-21a66bab9d7a", "value": "T1C284E122FA4495B9E15AC078C31A4A73B67574C50B21B9EF0268D27C7E19BF52F3CB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865878, "uuid": "711b87f1-3212-462e-8d79-ba81b3929620", "value": "c944b71e6abc7ebff55b4d9a1b73a928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865878, "uuid": "6669afb8-b0d7-4a6d-96c1-097859c6a394", "value": "12288:ixbEuIkxekW5KlE43QGhp7SjNY0dRboQGI:kbEubq5KdgP9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775865878, "uuid": "4e98020e-a6ae-4cab-8947-5499eafe9f1d", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775865878, "uuid": "983408be-b385-446b-a08f-e9ba4707a3b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775865878, "uuid": "1aa300ea-2374-4e22-9125-0bbfa0d09688", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b1111d-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896692, "uuid": "257667ae-88e7-45b7-97a9-8df9430ce20d", "comment": "Malware payload (Gafgyt)", "value": "c3b4637d55e8074ce5f01004610bdd8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896692, "uuid": "07173261-8b59-4e4f-8db2-3509b967e0fd", "comment": "Malware payload (Gafgyt)", "value": "57b80957748c76fc8d2ef4efa49b3a62fd95834ee48b5b571fa8d7f3183c1381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896692, "uuid": "90b2049a-91ed-4d3e-9e40-ef49c51d27f8", "comment": "Malware payload (Gafgyt)", "value": "2b0c501d90f8de98f7c3492f9e72b2ae5b7185a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896692, "uuid": "92cf96e6-15ba-4f9f-a2a4-965a6ffd13c4", "comment": "Malware payload (Gafgyt)", "value": "b3ca9fcc9d511a1a236b387b74f17c4d9c0fcf83fafe739afd5417c2d25c7e5820eab3ba5935036a7678e05ae2bcfa71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896692, "uuid": "fdd40ddf-6525-4790-a09d-8eda92cb51d9", "value": "T1FDB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896692, "uuid": "8cbf9f29-9d1b-436e-b8ea-05e6bf6d536a", "value": "3072:td0wrSAewzi+Xn+8Uhw6W+aPKJmDk1c8xF6KjW:7fO8IBPJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896692, "uuid": "95ad6109-3b27-4245-8ea4-da33141e4e2a", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896692, "uuid": "e29378c7-7b38-44a8-a880-2e8375966542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896692, "uuid": "027c25bb-b51e-41a3-9e9a-486016b5f480", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d316d317-35ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775928066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928066, "uuid": "6a655bb1-aa6c-4c3c-913e-730fa2583a85", "comment": "Malware payload (Mirai)", "value": "e2a883b35b094ce63315544ee8f66877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928066, "uuid": "7eab4151-2a7f-4143-80fa-137e4a5f2b56", "comment": "Malware payload (Mirai)", "value": "5905918ee6de9875209ffc756b520b30962f4e7f1f65aed09220e15b60553a96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928066, "uuid": "567eb44f-1e37-4370-a1f3-c7c65804675a", "comment": "Malware payload (Mirai)", "value": "49840345082472c6c2016770af7a7fa65225ed8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928066, "uuid": "1a847fc4-25a2-4579-a7fb-cbbd93f958c6", "comment": "Malware payload (Mirai)", "value": "022e66c766e727359ad11d96c2b32956595bf765466b3548cf462efb3a5f2621ecc4ce6617603c9d4d5369673459477e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928066, "uuid": "2a0aa802-bed7-4e57-92bd-175e97e27259", "value": "T17E143A45AA408B13C4D62BB9FBDF424533339B64D7E773069528AFB43F8679A4F22502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928066, "uuid": "dddb1eb5-9c3f-4be5-a85c-65ae65747be3", "value": "6144:hh0S5gT/bHd/aDvUBak/X3j8EEb1bh3sM/RQTOk:3ibHd/aDvUBamXz7gbhR/CTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775928066, "uuid": "4f798609-a46a-4a69-bbd3-99d1ab683211", "value": 200065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775928066, "uuid": "1e79e448-ca54-46bc-b794-adac75371b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928066, "uuid": "952b7e5b-488b-45e9-b3d2-ec0ee5f37cc8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923f594f-357c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775894457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775894457, "uuid": "1102ae52-c300-4b7b-ac87-99802e61022b", "comment": "Malware payload (RemcosRAT)", "value": "1e59819f506e024fa2e5bb348a5d7b04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775894457, "uuid": "01fb9106-dbef-4bfe-934f-31b8da98d68c", "comment": "Malware payload (RemcosRAT)", "value": "59651977a6d83923377d664eb430237a58a2e58d52cf4619f7741bec6bc1a503", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775894457, "uuid": "68c3a789-c349-45e6-a3d8-c33158e8b955", "comment": "Malware payload (RemcosRAT)", "value": "c4f9b7cf077a53543ccc0ffd093efd36c21fd250", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775894457, "uuid": "eb986919-452f-4e35-a166-8c6913aa368b", "comment": "Malware payload (RemcosRAT)", "value": "8aded83ce0c1cac5cfd9ab081d767eba9d3589b19dde576fd1fe90785acbc481df0b70bdfd7d2a7063e11fbf8743e72e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775894457, "uuid": "31a3cafa-5128-416d-87ae-0b6c9baa6e84", "value": "T15E26C441579CE732B6E9A75CD13EFA30590A600364CADF1D30A893183669E1763ACFE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775894457, "uuid": "f19309b0-5cf9-4576-9871-abc4d156d57c", "value": "98304:nsLbzWR+rWvS4T0yG7ZgVcl0+QLI+yvfqApaoilo9ZKxW6DgzQu4q0gNKyo8+l:nsqQr4TdGlz1QLI1FpAi48QHio8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775894457, "uuid": "33ddee22-f29b-4af7-ac91-0bd5dcacc7e4", "value": 4671153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775894457, "uuid": "6823ab6a-cc8e-419c-b7cf-59fc8cd406e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775894457, "uuid": "d8ee152a-e367-41ac-99a9-5be5992a89b3", "value": "Attijariwafa Bank_Copie de Paiement.pdf .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f062c3fc-35a7-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775913083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913083, "uuid": "e379c072-a5e4-46e6-8d4e-98faf7f48e59", "comment": "Malware payload (GuLoader)", "value": "7caf1ea02197c23b0242a7daf323c171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913083, "uuid": "595bd101-04e5-4925-a7e7-a3123276067b", "comment": "Malware payload (GuLoader)", "value": "5a586ceb3e76be7e7b2a24ab6915da17bf3993748d38540b4ac137c33f2b92cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913083, "uuid": "582216b8-416e-483b-9112-a7e7651919c8", "comment": "Malware payload (GuLoader)", "value": "382dbde822a1d6c21fa76bdf06d925133312efdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913083, "uuid": "597cf4c8-5a0e-4ce1-9c3e-6f91c8b721ae", "comment": "Malware payload (GuLoader)", "value": "18f7b0f08087beec815dabc7190e4460665084ad3060b83006a6758ede36fc3215cdbfa2757759624c5f18661fb58ec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913083, "uuid": "257b3074-acf5-4395-b789-000a9aa5ba1d", "value": "T198267F16EA7409F8C785E27944A3A3C2BD68B400772123E717D923AA1E237FC5677B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913083, "uuid": "b9641bc8-b7b1-4a92-8f73-a616aed69914", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913083, "uuid": "555f910f-2357-40a8-b46d-3c23cbfc5837", "value": "49152:17u66ZsFrYVtPypaFZ+8uj00gd92Qoom/R+jbQclaQ:17siEDmQt1tm/z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775913083, "uuid": "ebda4ce3-0dc4-48c6-b917-e4f09382f052", "value": 4515767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775913083, "uuid": "b4165138-809b-46e9-bf3f-0dfbd3157d74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913083, "uuid": "0ec5f6c4-bda7-450c-b7d7-be8784e4bbe0", "value": "SecuriteInfo.com.Variant.Midie.177881.13089.17051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c58122-35ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1775916072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916072, "uuid": "9b5bf94b-fa59-4d71-9cf3-96f3841d1de1", "comment": "Malware payload (Meterpreter)", "value": "3ddb098d844fc631a1381f79845498ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916072, "uuid": "93ff6ad9-19d2-45a0-975f-71b61768b70a", "comment": "Malware payload (Meterpreter)", "value": "5a5ec77e09541b3dd5f0132e26d133e2b963fcdb591a3c20a30c6eb3083030fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916072, "uuid": "08d5f1fe-8141-425c-bf58-26946e0554cf", "comment": "Malware payload (Meterpreter)", "value": "d95a7b1ee0ec0ef6f2c89f17016884d9293d587b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916072, "uuid": "93116a14-f69a-4fc0-8315-48b39496d109", "comment": "Malware payload (Meterpreter)", "value": "cfc199c02e8e68731bf8f5b8a11d2059c377204c4ec961b4779721acdb3c70d28f4952c511e1148bd872cd6fd1b1ad62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916072, "uuid": "f5c478c5-d8f3-4401-9769-4a6c2cd21908", "value": "T18273AE42D9C45022D1A6217D2BB53AB24A74F5F93611C29A768CC9E5EFC1CB0A27A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916072, "uuid": "43a77ed8-ba23-465e-bf04-a4a0c22b8f34", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916072, "uuid": "7720da38-38b9-4d8b-bfa3-6f694d82ebbf", "value": "768:Iu1DNKxJdOBMlpdBa0p/Cw7P+efFJAQ92gY7WWeJB3dsVhTPCHSckzCScx4qXfbN:ICD8xLOK/DcO+mdOMb+KR0Nc8QsJq39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916072, "uuid": "4da65381-1953-4cb6-805d-7a0d0870725d", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916072, "uuid": "47ffab11-989f-4bab-8d45-c588b8f7b0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916072, "uuid": "061b7b15-4461-43cd-b9f7-8c3c40784730", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc21d317-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888138, "uuid": "ac7c8e2b-f4ef-4bb1-bfee-cbb9d76dfb57", "comment": "Malware payload (Mirai)", "value": "c4cc78572324905244fbfea41b381206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888138, "uuid": "fbd21319-7813-4eab-9cdc-2ea7c9e6e85c", "comment": "Malware payload (Mirai)", "value": "5e042d19cc462af31a9dbca1266d9124badbb846be99e8e3f7afdb1fbe3dc70a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888138, "uuid": "f4a5b39f-3aa6-45fd-ba89-c6c3c7a7b1ed", "comment": "Malware payload (Mirai)", "value": "41b9cb359555a595c6dbe43348bfa9d7ecbc9dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888138, "uuid": "40666e70-1667-4390-b613-75cd67d84fc6", "comment": "Malware payload (Mirai)", "value": "9c22a0643708bad67a2e0aa1c83da6f7a966d0e93998627379391928403291d65e4e97344c2d37b76e10a596611d42f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888138, "uuid": "3457adb8-e5ed-4ad4-a475-dab1df1637e5", "value": "T198A35CC9D6C3D5FAE8120078207AAF36DF73D27E212ADE43C39C99319872550DA1A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888138, "uuid": "c3204286-c367-4aab-b0c5-8c57373885b5", "value": "1536:DrBvIbKzQKEPVnNHie2hqVjmqP5WSv9IfC5CzU/lS2:BvOjPzH0AVi+v1ezU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888138, "uuid": "9e3995d7-f574-4aeb-a436-c68c9c923d56", "value": 100552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888138, "uuid": "88522eae-66ed-479b-a2d1-3ec5e3a09310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888138, "uuid": "2feff71e-4b52-45b8-85fe-2a2e76acf3ac", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf68a626-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896680, "uuid": "c32929f9-311d-4037-8dc2-a6b5d4909a54", "comment": "Malware payload (Gafgyt)", "value": "3f35f65e07efd0b238f1014e8d268bf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896680, "uuid": "4c6e03ed-4148-4f56-b300-afeef09aacc2", "comment": "Malware payload (Gafgyt)", "value": "5ea7b2e52a8a1843e6d5ec251b803b6bb5b0b9bec65455664740f18ab811ef45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896680, "uuid": "7b8b2899-e7d2-4852-81b1-f6b8ab2adf9a", "comment": "Malware payload (Gafgyt)", "value": "93e0acb1ee21faa7b4234a1bd9f7d89144062efe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896680, "uuid": "f563f555-9235-4052-895e-d676ff21e455", "comment": "Malware payload (Gafgyt)", "value": "54d0b359671861fd85186b786f2fa060885465c577fd052e7554bdc5a94c0b3b71178aacc9e8333a509d876c6033636f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896680, "uuid": "0fb28d71-a349-4152-9beb-a6db12653c36", "value": "T143933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896680, "uuid": "8c0472c2-19b1-481b-8138-ad738c7e58d4", "value": "1536:mzqmXTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emPGMUNLe5um7WAgcVjmZIcBI:mz52UVUtBUI8GwPfHkk8rheLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896680, "uuid": "cdbd4f09-b947-4419-a31c-60511ec0a17d", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896680, "uuid": "b3780ff2-93d0-4c06-9bc4-6f992711d869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896680, "uuid": "eff4c91b-27ad-4d5b-bd4d-2c5859a821ae", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d130188d-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901005, "uuid": "531f4681-df91-4bfe-8355-d99396aa78d0", "comment": "Malware payload (Mirai)", "value": "f44837068540e4eb848c8a7d9d2dacb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901005, "uuid": "04b82083-385b-40cb-a255-6b89c7bad6ae", "comment": "Malware payload (Mirai)", "value": "612bb13110f96dddae90e180780cf7e571ae910ad9ab0b6c8ad78d39179621fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901005, "uuid": "3dc0fcfa-d5da-480f-8726-0b127368f29a", "comment": "Malware payload (Mirai)", "value": "8db35f1487d1cc95d0cea6aa2ba43dd41f01c311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901005, "uuid": "4f94bfcd-02f1-4ba2-b59b-bbb3116264c8", "comment": "Malware payload (Mirai)", "value": "8eaf5fbfd7a2c52b00a34f6ca8f94de47b621ec53bd347d67c854e67f616b9f96c803bcc29e67eb3bf7497697abd95f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901005, "uuid": "4f38dbaa-e90b-41d4-8a7b-31cdd7fa5b7d", "value": "T184E32901B71C0947E2932EF4363F2BE197EFDAC126A4F640255FAA4A9172E331549ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901005, "uuid": "de3d5a75-2a9d-40e5-9b7e-a2c4ab7f571a", "value": "1536:J1TnZ3DUHGx21Tiaxl297SxBIOghs3EPvARYSM6Fbeq39YnfWpZQ28g1z:J1Tn5UHGxaiax+BOg635R8+OOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901005, "uuid": "474c1904-c495-48cd-ae31-19e7eaf0d5ee", "value": 154292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901005, "uuid": "138ec56c-4911-4caf-837c-aeee8ccfe594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901005, "uuid": "cf95cc3d-3b2b-49fd-99f4-a967a1aa156e", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e1d29d-35f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775948250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948250, "uuid": "306f32a2-18ac-4de2-aa69-0e1b37a33975", "comment": "Malware payload (Mirai)", "value": "e70547aaedd54ededb62cda2354c1945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948250, "uuid": "2ea95903-f8b1-4627-a766-01ecb5cb5b79", "comment": "Malware payload (Mirai)", "value": "6182f2b194463e395a15736ecfda65b86c0cf7a90650d5229aebae5193688263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948250, "uuid": "737a2139-11b1-404c-8593-4572e16b3bb7", "comment": "Malware payload (Mirai)", "value": "540b9d837a65ef22318e44b4eafb5b1fc552fe68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948250, "uuid": "2d9820c3-9159-4a7e-b6fa-3bdddb19fb63", "comment": "Malware payload (Mirai)", "value": "672b3962be240bfc5ed32afc63997408a09f305ed880f2553b14ae4785364e950ef5c56d4314010ec0de3ece16475bdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948250, "uuid": "dcba2336-4fff-4be1-b0d2-2e295cfd9b41", "value": "T196C35A46F787F1F0DC4609B1105FBB7A8A34DD722120EE56F7E4BE72AD61B029046A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948250, "uuid": "f7b73adc-0ace-4e3b-9463-9fe8597a44f1", "value": "1536:i+V7NqrfEf4eL8/BqhuGZXOoDLCStTrzu8S9pr8EhHllZoTELyUj31c7LmHaSc8j:FV72+nYsz9HEpr8EhF8g9OmrI7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948250, "uuid": "932fa64f-57c6-43fa-88de-d3a16e9f9d4e", "value": 128252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948250, "uuid": "14f3e3e9-52c2-491c-84f5-a5e3004a2152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948250, "uuid": "67266ea5-cb48-480c-95a5-d4b9c0ba8020", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4372cb3-3571-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889843, "uuid": "01971b65-b49d-4cef-908e-2510b6761704", "comment": "Malware payload (Mirai)", "value": "f2d5b95929a067d4e7164dc7d473b98c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889843, "uuid": "2e938c36-9844-43c5-a5bd-f7def7e80a1e", "comment": "Malware payload (Mirai)", "value": "622e1bbcdff2b189093d0772ba39a73c7375993dde9c91419eb9f4cfcc71113f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889843, "uuid": "4269090e-587e-4631-aa3a-ab345cb92883", "comment": "Malware payload (Mirai)", "value": "1bf8d7a42f16a5498ec341ca9dbd946591c79a6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889843, "uuid": "84c4a31d-c047-4408-91c1-4d2a1cb4cdef", "comment": "Malware payload (Mirai)", "value": "eee886c844d9f7796190edbcbb1bed9febf4071ae580b6e7e5b014e4cebb350fe07f3b737f11ea78b616a38490b57575", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889843, "uuid": "e25526a5-1cf0-45dd-89c8-08e0ef1fe237", "value": "T1DF33F191B6F11FA4C5D5827541F00F6A3DF11B102192EDAE38CB998BDCC6EB7B8D6844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889843, "uuid": "4acb9a5c-519f-410a-8ec4-f14b40abd7df", "value": "1536:jVT6DCwHqLXO8fC+dUFL415b6DCP4PVJue:j2qL1dUS1N5IVQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889843, "uuid": "6265dc9a-10d0-4531-9aa8-6d8bc6e78339", "value": 54960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889843, "uuid": "ea084509-29ea-4de1-bd5d-a2cfb2f00361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889843, "uuid": "1dd534c9-9803-43ff-8055-ca5e1e5132b2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a90ef6-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916560, "uuid": "6a4f25a8-0c82-4bbb-8843-102ca7a2b65f", "comment": "Malware payload", "value": "27ed77c337accb056f830f9528d00f03", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916560, "uuid": "c48cbc02-4ac1-4794-adb5-1d3f4aae38dd", "comment": "Malware payload", "value": "6295e0599bce151f24d310814270dbeeeffec33f10c40dac4dc8d1a854ff436c", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916560, "uuid": "bfe3a802-fba6-4f8b-8c46-f9edeea1ece7", "comment": "Malware payload", "value": "3ec5b28d530dd3b9da637ebd765a59897c3a1194", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916560, "uuid": "53956d6f-d0ff-4610-8d1a-9e6678504281", "comment": "Malware payload", "value": "c360a430c617fcffb4a3f6507e28a70d637099636ffaa86e573d8e71f5756873c1ce0e705fd85611d1e474a456c4ea04", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916560, "uuid": "c612ff52-3e9b-4552-a505-90e6b84bc1cb", "value": "T1FB66AE18A3880594C577DA78CF1AD233DB71BC961666929F0AEEF6160FB3B104F2F905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916560, "uuid": "662a1051-ec19-4e58-b073-c228ae1def9d", "value": "39e9ac77dda8d9d34792dfef317386f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916560, "uuid": "9d6d7a6a-a99d-460c-92fa-2d505577a98d", "value": "98304:rVF5hQC8am0ea+8LHPQTUkc7h4XCu3ic+OYXdl+8SfdYIgg:zrlhdTc+OYXdJSfdYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916560, "uuid": "c6975cb1-59de-4188-ac8b-4ad3fb5bc1e2", "value": 7078912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916560, "uuid": "8cd74607-f00a-40b5-bea1-1745f4eb4892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916560, "uuid": "0be0a559-a7ba-4157-a54e-75bea2119ec2", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899753ba-3591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775903462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903462, "uuid": "b413142c-78f8-4dc8-8c1d-a521329d55f8", "comment": "Malware payload (Mirai)", "value": "872840bbfc132660093142e451a58f10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903462, "uuid": "cb4524ca-0488-43bc-9c18-edf0cf1eef8a", "comment": "Malware payload (Mirai)", "value": "64b3b2dd86f82d98bba82adb00737ddcf188620a3ee9f9bfcb467901e05365d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903462, "uuid": "66f55e75-d994-421f-ade4-c0549d6978fc", "comment": "Malware payload (Mirai)", "value": "76cb3aace3eed36414048a3ca99016cef8d97316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903462, "uuid": "9bf9e0a3-915a-4e71-b645-4df3b7e93965", "comment": "Malware payload (Mirai)", "value": "a8d99a55e1393239581e184368d709911312f6f9923ed18641039f326b1a8c8a17319f653d98f28e2c5f6aee4af73449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903462, "uuid": "79ad45dc-08e2-4148-b6c9-f033e7659a5f", "value": "T189937B46F787D5F0CD4204B0119FFF7AAB35E9B12220EE6BE7D4B932AC726425406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903462, "uuid": "f8fa3439-da3e-4cef-8483-51591f215fa3", "value": "1536:aMnfxRfg+P++NZfJHyFj4B3/HDyNL4G2U831kmcbQQ2NjELIjr:aMfxVja945PDcLEymBjTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775903462, "uuid": "710b4476-3361-47a3-98ac-9940683ed795", "value": 91032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775903462, "uuid": "6489f751-169f-40a5-8fa6-712c1eb94185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903462, "uuid": "d47995dd-7fe8-4366-bbf9-d2e0eef5196e", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3740d66-35af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916497, "uuid": "c7ac2217-c469-4a8a-8189-2c1684a8677f", "comment": "Malware payload", "value": "df22e3e63c07dc20537f855b8f0a9b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916497, "uuid": "97c64cef-8e6a-4512-89dd-805a349c8e71", "comment": "Malware payload", "value": "65001f8dd1df9359d031ec8f87a08818b328b6bac430a14cf7a6c80a4c6e7567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916497, "uuid": "b35455d8-0f8f-4081-93a5-ee66caa2f5a4", "comment": "Malware payload", "value": "905fc672afea9af2ae3d00c968ad1a7753c6153e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916497, "uuid": "c7dfe665-6d24-49c9-b080-327ddd3e23c7", "comment": "Malware payload", "value": "fdd8071d3f26ecae31f2f7a681c9587c198464f0beaa106a3efeb08f8f8515b265c39dc6f4b7603dbf1b98015947448d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916497, "uuid": "6ccbe6aa-4468-4598-8372-cc9951278f00", "value": "T109658E143865B054E2BE42B2B1FEAF9CAB03510D456B3D2C5D673276BF332273A87466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916497, "uuid": "aa459d80-2688-4188-b430-6064a702232e", "value": "750885b21a87dc52bc557ec84f62d772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916497, "uuid": "1dda8aa3-5a16-46dd-ae6c-abca4baddafb", "value": "24576:DHObrkQ0WmBvB8rB85G2FiDT6ahhpeav1fACpFaeJZWRvGixvlAhKZ9PBtg3oh:DH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916497, "uuid": "10ff92a1-7b3b-4542-bbc6-80fa1af94278", "value": 1486228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916497, "uuid": "160863b6-7055-47a2-bced-2152e3aad185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916497, "uuid": "e891dcb0-8cd0-476a-a621-49b4d620227c", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b12a998-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911061, "uuid": "8cb092be-cca7-4d3b-961d-4c1921f7bdda", "comment": "Malware payload (ConnectWise)", "value": "9f96f5d60ef82a3c7a61da2dfeb793b0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911061, "uuid": "38a4ffdd-4578-4370-bda5-233c30eacfd8", "comment": "Malware payload (ConnectWise)", "value": "6626cfd919eae3d8b8728372745c2c4ae604df2e618f900833ab3c80634fc233", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911061, "uuid": "2851c701-2445-43f8-9e34-7e10d00a9c4d", "comment": "Malware payload (ConnectWise)", "value": "5897c4acbd22071e54b394057a81ec40187beefe", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911061, "uuid": "87450591-54ab-4cdc-952d-8984aead33c9", "comment": "Malware payload (ConnectWise)", "value": "fb9978f8d3e873d9bcfc01cbc584cc5d5ca9cb033af76af2581305689bd11dc4945d9e9b660b9f81f05fa4f4a61ed8b1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911061, "uuid": "dbc9bd92-5972-49a4-9dc9-60b6ac8b630b", "value": "T18D646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911061, "uuid": "a0ef84f8-ffb2-46ef-ba9a-a5a6ba8da229", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911061, "uuid": "383704ab-d690-46f9-8f69-935abc556c47", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9kt:Q1iw7gryNkSV1hy1Z1u2JLI9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911061, "uuid": "f776b638-ca28-4550-9604-5beaf02843d1", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911061, "uuid": "5a2f8ce6-84fb-49c9-bbf7-83baa7866e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911061, "uuid": "d001500c-2ab8-4f81-b0f2-175603266ddf", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29988866-35e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775940667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940667, "uuid": "ea1131f7-4854-421c-88d5-2903fae5c57b", "comment": "Malware payload", "value": "6d22cf2165a61a687fab635e8fa37fcd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940667, "uuid": "99d1aaeb-6662-4306-8b9a-e71f3d2f8739", "comment": "Malware payload", "value": "66c0770132e49158055e00a24f6c2ca496b9058359dad7507c1093d4f7e91d63", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940667, "uuid": "5250cb27-28d6-4967-a7e5-82b40363442a", "comment": "Malware payload", "value": "1f3ad4bcd244b06ca1a948a1518d1a63c2814a6d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940667, "uuid": "49e6ad1b-3adc-49b5-b7fb-2f8430b5e071", "comment": "Malware payload", "value": "386d39ac839909a9de8816e2a33518cf2d6a4dbbd2db03eb556193c765d402eadedfb2292059adaa9330617b279abee9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940667, "uuid": "36e07035-7926-488f-b344-d7b450f49b6b", "value": "T124456C09ED17A5D8C459D874CA16CD410DF83CDB1FE7D8AF888756252A2F6F6AB38308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940667, "uuid": "1d5a0c20-50ef-4701-bd4a-29b3c04c128a", "value": "46608bd2882c0ddbb0eb47e2a4cde6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940667, "uuid": "2d5a9843-fab5-4f7a-858e-93f359c667c2", "value": "12288:yy/DDwoT3n94CSo1BIpnSlDvz39tt4b3FuFqWvpjzb0uOfeQghoHID:yqDwE3nWZODr903FuFqWxjzb0uOfaoHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775940667, "uuid": "fbce20d0-47e2-4a44-bbb1-1ad32dcf85eb", "value": 1202992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775940667, "uuid": "dce9de7b-909d-4862-9040-07e13038a1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940667, "uuid": "acaba3b7-c44b-4619-8320-38b8472a809b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca97fc-35e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775938556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938556, "uuid": "40e8b6f9-c786-4b0c-9d5f-181ec492fcc4", "comment": "Malware payload", "value": "ae346ee930cfbae1bcbdbf8725c7754f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938556, "uuid": "594dd209-f053-420c-bca6-00ca0f559ce7", "comment": "Malware payload", "value": "66cfc5933bce9bd4b61d36f5eeca02274139a43a5b1cc2b2411fd5071c75923a", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938556, "uuid": "be8f639d-1252-4cd3-a45c-50d47cf5c4db", "comment": "Malware payload", "value": "cf1445780274178339e041bc44b45e06476b67f9", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938556, "uuid": "311aa22d-a654-4533-bd10-44472d2d9d65", "comment": "Malware payload", "value": "c0b4e60beff2bae75bb2f70e7a55eee57bb165c883f29a47cab60df367adccf1686e469765bc86a8bca19825932c9d1d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938556, "uuid": "fc01a952-ff8e-4ccc-a41e-c63273ca8d62", "value": "T1CEF533D277AA1E3FE0607E75CDC5D96C0D1B7F8A5E945218438A1D87AF0BAC90382396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938556, "uuid": "af8edfcb-10c9-4514-831d-a620b592682d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938556, "uuid": "71eb723a-e14f-47b8-8328-e68300f1255f", "value": "98304:NAbM7gOir8ophZlrx/dche3AKxEqQ76olO:WmgOi46hF/iBKnQ7rlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775938556, "uuid": "088b9cd0-c5f9-4196-a626-6e17e94cd720", "value": 3526016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775938556, "uuid": "851f6d8e-7952-435c-b5f3-b2e146029d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938556, "uuid": "c1e07658-8fb0-4380-bfb5-61e74744c326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e365e5d8-35c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775926376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926376, "uuid": "a886ac54-1b94-45bf-88a9-e801ae333872", "comment": "Malware payload (Mirai)", "value": "09d643b69f6ad2db4aeaf920026181a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926376, "uuid": "f4aa3b9b-4155-4b1b-b67b-48481e60cdcb", "comment": "Malware payload (Mirai)", "value": "6778881b2ad8f19c826cd3c188e757ef2353264aac2d711c1cd8190cb35fa297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926376, "uuid": "11b3219e-e22f-41a8-bff1-96dd003c0df6", "comment": "Malware payload (Mirai)", "value": "613ad50e06224457db5d4e1b55099c2c3776a593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926376, "uuid": "f968f080-09ac-411b-8563-3772c1956049", "comment": "Malware payload (Mirai)", "value": "042478e80d5a0b874425a34f77ce489d99c6bda34325246946d4bd27c50bf0e392050682d393a713d2da0a9bf8eb326c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926376, "uuid": "c06ab450-09fd-4192-acd6-d908a867bb05", "value": "T198B37E49F747E0F0DD460570105BFB7EDA388D762220DE6AE7E4BE766D72E029802A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926376, "uuid": "53273959-2261-4951-86ee-59c1de040ccb", "value": "1536:jRk+ELOfUfuZkDhsNS2rzw+NGMwcLU731kIz9f9chgaQ2RTN9r:2+EL2UC848gGBqccxTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775926376, "uuid": "c3bdede7-1804-48d7-9175-ea161fe83381", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775926376, "uuid": "3375d3d3-e3ef-4e82-99ee-1338f69308aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926376, "uuid": "b18d6eb7-c130-48cb-8ee7-a63f92717ec6", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b034db72-356f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888923, "uuid": "213b973a-9e7b-4b4a-a49a-32f6e7a5bc0b", "comment": "Malware payload (Mirai)", "value": "dbb6b6bd2982f28d96d9b9b37281f742", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888923, "uuid": "e05bea7a-b1eb-4cd5-be24-10a0e4bebb90", "comment": "Malware payload (Mirai)", "value": "6984cc12c00a60f186ec8be8d4e5630ef4228cc78b0e19cabb5c760b2c9e65e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888923, "uuid": "b6708d25-856d-4542-b16d-1b9ff5b1194b", "comment": "Malware payload (Mirai)", "value": "958b977b98e0a38b0a9208521d99206a35a8d4fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888923, "uuid": "abd4e36d-02f0-429c-bca2-0642de59ef17", "comment": "Malware payload (Mirai)", "value": "f95707fc5dc01f863db5b93dff523993714e1c327a4a8fe5280be3dd8177f20e8bfbd7f3685044247df97f751273f784", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888923, "uuid": "b76ed163-d425-432e-bc01-6f27c917be49", "value": "T177F2F124DC462DAAFF6FBAB55991974037A00F5BF3368E351460CB43090F89A335EAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888923, "uuid": "710c4286-e768-411f-9583-9cbd78fc566b", "value": "768:sk9hrdmlHUKWzb3/fFnYzS1aIzvdFUqbKP4yGCe/Dy4uVcqgw09b:sk9Nd6HKP30sRgqU4I+Dy4u+qgw09b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888923, "uuid": "4e165152-abe7-48d4-818b-2d7da0364235", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888923, "uuid": "091c4192-9213-41ee-bba4-1c9cc62f023e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888923, "uuid": "82e18c32-7ee0-4e99-ab89-fae63e6849ad", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d231d4cf-3577-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775892416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892416, "uuid": "e65a85a9-fb87-47bc-b9ca-0718febd2da5", "comment": "Malware payload", "value": "d8471943f5681833ca6f4460b6bc8e08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892416, "uuid": "757955ef-db51-4ff5-8699-9b707ebb0105", "comment": "Malware payload", "value": "6a20a6ed6385d19d401300ee00c516528bda7373fbbcd90e23b018bc020c2d6d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892416, "uuid": "3df38b58-b03b-468b-b040-50578d0f1c84", "comment": "Malware payload", "value": "efbbe0de895381de65220b10711f30be875b7db0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892416, "uuid": "0fa3804a-2ceb-43e4-a3a1-78a3037b0b55", "comment": "Malware payload", "value": "4009f1038a34e91f2ac747222ffe6ccf7cb4b3892d57a7831aea21e69c5545b6d8a73a7bde9a81e6769e04d29ed2faa7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892416, "uuid": "d411deb9-0f0a-472e-9c4b-cab26ca86fe8", "value": "T18973F703E2E410FCE1C9D23893AB9E36DD72B8C955346A5E27443A122BF3E507B1E675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892416, "uuid": "f0c8bec9-5f54-40af-85bf-8942ddf0398b", "value": "39a800a085db32a22d0a075f2162f64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892416, "uuid": "daeb9a88-b88e-4d68-b8ab-243e040a55c0", "value": "1536:9u0jU4Vjj04erdbOdsXy+Tg7zh8ASlTbLxY:Q0jU+04erdb3Xyoq8AS5bLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775892416, "uuid": "77ccb252-db9d-4ed9-a6b5-554dfac9867a", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775892416, "uuid": "b767e01b-1075-4415-8acd-880c8092aa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892416, "uuid": "9836ad4b-accd-4076-807d-8e92cf8ee536", "value": "Kharon_https_443.x64.svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184a58d7-3575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775891246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775891246, "uuid": "8da14a59-6fc6-468d-a4bc-6ec4c28223b8", "comment": "Malware payload", "value": "b34726b996b37f241ee15bfc17c8211a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775891246, "uuid": "0b88be67-e438-4e51-b300-a1265173bfe5", "comment": "Malware payload", "value": "6a375ca8d3aad0f552cb794e7ee5d4ba556201b836fcde90c6d04739872f1b9e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775891246, "uuid": "dfd484e3-7025-475a-b47f-77ef3a5656de", "comment": "Malware payload", "value": "b648dd3f7f88e1a6475ec4d3066b4af501cbd5b9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775891246, "uuid": "2300f1b3-ef8d-4c58-9681-6496ba5174a6", "comment": "Malware payload", "value": "5f38d439ec36c08607f95dc5b65d86d5897fc492fc0fd3d20e8f955a30e4a7d819fa0b9de37568a86aa6fffabbcffc65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775891246, "uuid": "2611d686-6fa7-494a-8b05-090e40b6ab62", "value": "T1B3137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775891246, "uuid": "6df5f9e8-2ea6-4b38-81ff-c2e5865efeaa", "value": "768:b8+L9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b8+8cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775891246, "uuid": "3831f0d2-7d85-43ec-a0d3-c3223417f3e2", "value": 45507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775891246, "uuid": "1f8d2fe7-45c7-41b3-a57b-3becf21670ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775891246, "uuid": "fa13f40e-1a44-4549-a2a6-4207c309846c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b91b0a9-356f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888808, "uuid": "4371f4bb-0d42-4b4b-9e7f-32a0a2f44695", "comment": "Malware payload (Mirai)", "value": "279c1de5335d1a52ab3950e6bd31f53a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888808, "uuid": "61b9f290-5583-42f9-8318-78877c55365b", "comment": "Malware payload (Mirai)", "value": "6aa047730c733a7f155cc3ce1c97e9d11df6c6c616c871e3311974f74c738f09", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888808, "uuid": "97ed30f9-25b7-460a-9918-a7e3a5376953", "comment": "Malware payload (Mirai)", "value": "ec947f22c6dda9a2a31bc5ae3b08d8aa1856de8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888808, "uuid": "80d19a88-9798-4a29-ac1b-1e2100c12604", "comment": "Malware payload (Mirai)", "value": "cf43068c9864d0e58978658ba805af73bd5d3f413d3b20b236fe5fcc8e9e0d422e8397b325ee1d3fd67f2755dfdb0967", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888808, "uuid": "36105fcf-54d3-4cc2-9f76-65013b651d86", "value": "T1A5F2F1BC2A60A76CC879D3B999B243D09E07174BB1815C0F34AAD9D3FBFB1143217295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888808, "uuid": "be99eae9-78cd-4a70-a849-d9dc5ae22fd4", "value": "768:9NYKyukZoTMKezCeB5XFUDctqIApJ4hmXvPjJgGlzDpbuR1Jw:3YdWle55XSotqIAIhmPZVJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888808, "uuid": "65ebec9d-fd6d-40bf-b24e-2c8e74cb5663", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888808, "uuid": "9f3574df-b87b-48c6-a647-e3e6fe838185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888808, "uuid": "c02db4de-1dee-408b-8370-a14978240557", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76640c4-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775917255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917255, "uuid": "a22d43b9-0c8b-46bf-87b4-3f705ee1ad26", "comment": "Malware payload (Mirai)", "value": "2d3b73ef20b7d5acbb7f97bfab549c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917255, "uuid": "5ccb5f14-d573-47c4-9ac7-ba25ff61d1cd", "comment": "Malware payload (Mirai)", "value": "6b7fb6ce2c132671a7415bbdf5a6867820b09573bfefb76f199b5aefb88a7e7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917255, "uuid": "b89c6381-32fe-40f8-842f-0589d1155fa8", "comment": "Malware payload (Mirai)", "value": "475e90126bdbebff4c88e986b1e5a104460a64bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917255, "uuid": "0eba165f-689f-4249-a569-b7d7e67cf988", "comment": "Malware payload (Mirai)", "value": "ab7f8b757361ea92b9940cd467e4ec7a217f0444cabc9ec0a378d0f506ae15c92bec9461302b7cf82057fe60cd8e8c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917255, "uuid": "467384fc-8221-400b-8814-0d0ade624568", "value": "T1AB444C83F940CE7AF80BD37749574916F030FB7608520AB6B217BDAA9E3A1D61533E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917255, "uuid": "abbc8947-0d6e-4eb8-8cfc-1cb19b102879", "value": "6144:hpiOfStIpdFP2gPvdhgGya/Z5zQepSC9dLLC9+3:7atIbFP3IeSJ9+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917255, "uuid": "c0bab93c-cfc3-4c06-9c1b-012f55e0cfb0", "value": 268004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917255, "uuid": "81f50bdc-f7db-4d24-bd6c-1e3fb809baae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917255, "uuid": "61dc7b8e-9a63-487a-84ce-efc6a745f331", "value": "redis-scand", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2ac4e0-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917289, "uuid": "b5476cef-3689-4943-9476-c4f7dd40e665", "comment": "Malware payload (Gafgyt)", "value": "7033515dad7903099fd077456e6ef2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917289, "uuid": "27a08e64-3551-4aa4-933f-db22c2b6fd6c", "comment": "Malware payload (Gafgyt)", "value": "6b854b68444cc4b0fe9a3598a7478e5c417ac85d2bf9b44dfe0c45c23e17e73a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917289, "uuid": "bbf70b8d-822a-4f75-8fd2-b721bfc3cc0c", "comment": "Malware payload (Gafgyt)", "value": "54b8276417c30688ae26b898a24df0f64a6affce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917289, "uuid": "7f08d1c0-7411-436b-b8a6-0d7f96fbfba5", "comment": "Malware payload (Gafgyt)", "value": "5088bf5ae6d9d523a46bdfb3c246cb2b0f6911d1eb96a13723eb67da232a002e8fb0b8663db05e19442b72ccc025aef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917289, "uuid": "48e08a53-5c46-47a4-a252-ccd6d8f5d89e", "value": "T137248B73D926AE96C126A4F0B1F2CF780F03BD1649471E9A94B6DAF84183ECDB505378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917289, "uuid": "ba12ec87-8e8e-448c-86d5-957784d414cc", "value": "3072:Wt8UrxtRoxgx1K1r1Kv5p+v4YWpQPRKT5T2oHdQRUOPoCUW8HpL3wjyK9:VIe5AvP+vzWaPsT5T2oHofN8H+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917289, "uuid": "fc263ed2-019a-4e23-a074-ead003c4c161", "value": 221536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917289, "uuid": "0c53b880-f74f-4bab-882c-3ec44ba682fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917289, "uuid": "90284b4d-761e-4ad4-9476-bb0356976e71", "value": "redis-sbomd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486f69e2-35ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950597, "uuid": "9f8a3daf-818b-43d3-9d27-8f3234881829", "comment": "Malware payload (Mirai)", "value": "38c7b041c33b15906ee8f57372c8444d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950597, "uuid": "a00db9c3-56b5-4078-93fc-054997240dbb", "comment": "Malware payload (Mirai)", "value": "6c22d9c5c1efee5ffbc202d03c758c86929d5c3b05d2ccb8fd1bbd8a3f0748d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950597, "uuid": "14b5a1a3-96e2-4441-9f0d-4fe942d3b003", "comment": "Malware payload (Mirai)", "value": "3ccf73abf72d1d152b683c98b77c246a29ba3a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950597, "uuid": "d1a309b4-11bc-439a-926a-efe360c9376a", "comment": "Malware payload (Mirai)", "value": "6f86450c84140fd494b89a69c563ae2ab87ecc24b5fa9cf6a2bdbc53046627c1bb7ba1fca86c5017702e6d944fdfcac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950597, "uuid": "a57428ea-7b10-413b-a083-b401087c2837", "value": "T1DD244BC7F800DEBDF80BE73744530909B131B7A254925B377267796BEC3A095186BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950597, "uuid": "a4db551c-5197-4473-852d-19bd854667ab", "value": "3072:oFm3NkKys/4xjKPDgvbfYArS3SIzwyGaPD7k38mPU6NLxi0kySVXjbioLFeT8PTG:Ym4AStyG0D7k3ZPhLkymLjM8t+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950597, "uuid": "2943274f-8834-4c06-8659-bbbc1beac1d7", "value": 212472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950597, "uuid": "9e1cfd1c-deaa-42a5-988d-6c090f45682b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950597, "uuid": "1dbeff4b-902f-4fa8-a04b-3cdffc388c71", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4003f3a8-35f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775948006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948006, "uuid": "d61bd8c4-3987-46aa-b96c-25e5f8d10bea", "comment": "Malware payload (Mirai)", "value": "2ff635799fec71c7c895fdd0493baab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948006, "uuid": "2ce12f3d-1969-4448-96b9-bf518ec2f29f", "comment": "Malware payload (Mirai)", "value": "6e86970862b185d7a6c8c2cec3f59a5e45f5d3a33eee0361c0652ef16e0ea023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948006, "uuid": "892d6b3d-f13c-4db6-bfb0-e1bc69575158", "comment": "Malware payload (Mirai)", "value": "d6b1e50322e7399822fbc3e1761895ce4c8b6cc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948006, "uuid": "43d868d3-d586-4eac-9b0c-15d00b3a3051", "comment": "Malware payload (Mirai)", "value": "8e65e2c8904cad20f01f9322e65d1e6d1a492458d9fe71284c6ba4490ae68d02e30d3e2e303c4a74a5bfcf5f7ed45b05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948006, "uuid": "b49fff0c-ad9e-4a10-bf58-53db5198ca11", "value": "T1F744C509AB610FFBE8AFDD3746E90B01298C645722A83F753674D528F54B60B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948006, "uuid": "7212a167-6538-46da-947d-ce6a378c499a", "value": "3072:xDlhwaFkn04MxlJ3Kn8CV5gezLMz+f0GlVJEBGn3vYoId:xDlhwaFknz+KnfZzLMKf/dn/YoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948006, "uuid": "1e8dda1d-453c-4a84-91dc-876a6668f567", "value": 255120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948006, "uuid": "9f5e957f-2368-4422-a862-a30d952bb136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948006, "uuid": "078a0683-711f-4878-8271-7e4f3a74809a", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf4a32f-3599-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775906876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906876, "uuid": "5f07989c-be67-4b66-9683-71d20e23f73c", "comment": "Malware payload", "value": "efbd9cce4fe01dce2d589d0de945a74d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906876, "uuid": "1236e939-4fa0-4816-8060-66bb9e966188", "comment": "Malware payload", "value": "6eaf89d5c827d7498c0ac229b95e5b399182812dd2758623b008ae2f38da805e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906876, "uuid": "07f6cebd-9690-48a3-bd91-e89e174799c7", "comment": "Malware payload", "value": "f509223550ac50c73a01a0c0535bc86528c374b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906876, "uuid": "a65ef2fc-1209-478e-b442-74754c036ae7", "comment": "Malware payload", "value": "c14f96fc828fc09e204e53df7e3cd5b6e15e73e21b767c1ae213cee0717f9a3958c4a0b6d0f48bc3e105d05327c2bd49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906876, "uuid": "f061b898-1efa-42d0-b7aa-a33b212629aa", "value": "T178136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906876, "uuid": "e555c53c-cc95-4928-b16e-39d792ce464e", "value": "768:bPs9NyXsZztCV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bkHusZPcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906876, "uuid": "1aa6bf41-6b29-45ea-bd73-f63ce492d5d1", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906876, "uuid": "4a4e2b79-302a-4909-bcc5-a91685507b36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906876, "uuid": "3601c382-8c89-4df6-a569-bc72aca5852a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401392d1-3545-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775870696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775870696, "uuid": "98f47815-a094-441f-b90c-1060bed51712", "comment": "Malware payload (RustyStealer)", "value": "ca7b4c24aa5a7a7fb70618aeae7412cb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775870696, "uuid": "7051ad08-342a-491c-ad0a-fa95d25c81c4", "comment": "Malware payload (RustyStealer)", "value": "6fe4bc7fed5dfda60d4b30173d5364bc68ddcaf15a78de3ad7e365dbd764ae3b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775870696, "uuid": "3810dd6c-dd57-4903-8278-4228bc4146ea", "comment": "Malware payload (RustyStealer)", "value": "45953185d656a7a96425e83c244b276479e7c3bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775870696, "uuid": "5107d946-39b8-4b02-b10f-4475a43d07da", "comment": "Malware payload (RustyStealer)", "value": "47b315d825cdaad7374ea4b15e888d7028b12f207c10a2bf8058c2e79a9188ad4466920159cb58c4704f461568687642", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775870696, "uuid": "27fea1c5-4feb-4d61-b480-c706d938d50d", "value": "T109050222764448FEE456D4B843858BB29AB1B4CB1F3269FF13A541243F55AF72F3CA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775870696, "uuid": "3742cdab-cfb5-4740-8429-c2e35b6e127b", "value": "30e6d48c1c25414c928685f170e69469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775870696, "uuid": "bb7fe99a-5df3-4ab8-9f67-856552f55c8a", "value": "24576:idnNx7T9Z6kzIc4AC2M2v7UyxVkckgff8XM:idNtRkpyn1ff8XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775870696, "uuid": "d0c519bc-9feb-49a4-aed8-0ff08198460b", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775870696, "uuid": "0d41edbb-f530-4bd4-838d-3e580902c1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775870696, "uuid": "efcccff9-b659-4057-8c2b-0adfd949fbb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a221de-358c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775901259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901259, "uuid": "8eb07358-5ca4-4f03-87dd-4de152086e31", "comment": "Malware payload", "value": "287e83fed7bf5b9f1b7050818210e65f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901259, "uuid": "5a29fa87-ac65-4251-bb97-7e9d423340eb", "comment": "Malware payload", "value": "704d391277e5bbd97f64eca06dbf717f6f415b82d995453b595f4c753def84f6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901259, "uuid": "3e60ddda-ad0c-47df-87f2-2240b335996f", "comment": "Malware payload", "value": "921f8af40e1932d050d684942337e1a717313e3e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901259, "uuid": "2676b1c0-e8f1-4b5b-852e-59fcc999bb20", "comment": "Malware payload", "value": "788bb5c093b8234b54a0b2225f74407c5ff55daf6fe69c98743484150c84a7fc17b086071f9a5f7637534c5cc713a379", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901259, "uuid": "90243084-e387-49d4-af96-1fe32c30627a", "value": "T103D40A7DAD10A626F70CD0BAE287D7534FA53801033ABAA3197ED7241106872DB677ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901259, "uuid": "c5831d3e-11f4-4c26-9c40-e6f287debf56", "value": "12288:RL+1MJ2KStSAPnrnbBTKiTBj48k13OvykAhAQCAvLALrgE:RCSJ21BDbBTt6lxu03vLALc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901259, "uuid": "6d01ff5c-c251-44f1-85ba-df91b57e49d9", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901259, "uuid": "556ffd70-c7ab-4a7b-9b2d-8ab670c84f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901259, "uuid": "93579f3f-4b84-4944-bca4-f61d1e66dbaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4beda9c-3597-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775906138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906138, "uuid": "4833a499-df7c-4433-8cd1-052a7a49acc8", "comment": "Malware payload (Mirai)", "value": "e91b05a8a88bdcd2c7b54e50feb83df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906138, "uuid": "cbcda372-fcbf-4a2a-b943-96fd79d3ecc5", "comment": "Malware payload (Mirai)", "value": "704fb321b03d0a7cd33d31d14b4def637ae1e2983bf6f686c677b168db6db0de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906138, "uuid": "6b72069a-118e-4e9c-9322-d86883421c26", "comment": "Malware payload (Mirai)", "value": "3778d0db1ba31bb691d30a8d6c02c987d0c058a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906138, "uuid": "902f5b9f-62be-4c92-8862-d82e29f3bf1e", "comment": "Malware payload (Mirai)", "value": "dba8998f0f17b7ead5509e727852f4821096dc921490ce3942ee4e21e5cb983d1cdaafec283ecdbf4ae20fb9dd9320a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906138, "uuid": "6ee76c86-9507-46c6-ba77-1b075b6ee8fa", "value": "T1C5243A46EA408F13C4D627B9B69F4245333397A4D3EB73069928AFB43B8779E0F26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906138, "uuid": "adfa2188-0e81-488a-b6e5-c143e08a69c9", "value": "6144:wGiooZ91QFbawess3mb9yf+N152L/gBM/Rr8dqMQ:wGi1QFbawess3mhy2Vugq/gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906138, "uuid": "a92ab1e7-88af-4148-8dc3-4c86092e3474", "value": 228273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906138, "uuid": "4665f653-f43e-47e8-ac4e-3d62696891d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906138, "uuid": "2b290f1d-e7d1-45e8-bef3-db15312e4a80", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b7878-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911171, "uuid": "e5590c33-45ac-41db-a3e5-ae9592dd8478", "comment": "Malware payload (ConnectWise)", "value": "ef34250d53e1e7b61f21af61b117c28f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911171, "uuid": "4c1afe74-a623-4838-8e05-7c9d8bc18b13", "comment": "Malware payload (ConnectWise)", "value": "71061a0a92d1dc56ec87f4f92a8369e8ed0fb7e8a2efd8810acd765331c49763", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911171, "uuid": "3ca7d68a-bd62-451a-a450-ac67d27d8854", "comment": "Malware payload (ConnectWise)", "value": "a8d34ffe74ac440609ea0eb7d9c9bc068111896d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911171, "uuid": "697103dd-e625-4e0d-9ff0-5f83368d2169", "comment": "Malware payload (ConnectWise)", "value": "deea3e06770ed81942a81fa1e464eb446276791469cb354e0440fa904ac64f3336f04671a14a0f26dd78f16a9437d565", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911171, "uuid": "0ce605d3-849e-4bd6-926f-35ea6d6b411c", "value": "T17B836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911171, "uuid": "40415cc1-f136-4fc5-ac34-0d881ce6cb5f", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911171, "uuid": "83fdfdbf-b888-4c2e-bda8-cb5462d46503", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv73J:IenkyfPAwiMq0RqRfbaWZJYYv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911171, "uuid": "8d500248-4888-4e09-b2cd-8baf3e883b37", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911171, "uuid": "bab5ab7b-c7bc-4904-a815-4e9001bcb460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911171, "uuid": "b919ae15-d973-4c79-9a81-b6d5baf209e2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ca6550-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911721, "uuid": "44f51aea-b9eb-4d9f-abc1-94b3e61c26da", "comment": "Malware payload (Mirai)", "value": "b5d08a8dfb8614240765be5b09423d63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911721, "uuid": "8c10e6d9-5730-4154-a478-fba378d1772d", "comment": "Malware payload (Mirai)", "value": "7115f282bf648970d39aefc2f2e06879e397ed64eb1bffde92e9505e28238ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911721, "uuid": "83ac7929-922b-4a83-93d4-1f2f26deac6d", "comment": "Malware payload (Mirai)", "value": "a1907490f73e867b012e564da0278e108787a39f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911721, "uuid": "6c4b216a-5dce-4b97-a492-c7c45287f6cb", "comment": "Malware payload (Mirai)", "value": "a8cf0997da0c07c2621c7d100b800994f7ad8e5aa4b1f5a4725ca10d82ed277ac5031f37a4ec4bb675c7abe5ba815268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911721, "uuid": "067cf7ff-27d1-4b78-b7bd-2892d54a221e", "value": "T19653F881B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA47B8690F1D97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911721, "uuid": "4f314edb-d872-4c5a-a59d-3ec42e72bac1", "value": "1536:wnMsHNFXQQ3ENRAKSkRh5TF58u3/vhWW5cnt:wnMOD1kF8u3Rv5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911721, "uuid": "cb76eff2-e84d-4a0f-9c0c-75bacf471b51", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911721, "uuid": "360646b0-6e14-4d98-98a6-2e7d53075dda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911721, "uuid": "6b4ce0a7-7354-4f30-8d01-bafee79ba335", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6493a6d-354f-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775875217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875217, "uuid": "0d3d5d1e-3dc5-41fa-8005-651f9f2996a9", "comment": "Malware payload (DCRat)", "value": "02a0e8ae83d543bdcd2b9c695f13824d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875217, "uuid": "c31e214c-ce35-47ca-906b-09987a7f6b75", "comment": "Malware payload (DCRat)", "value": "722f00dd58b96c7f2561af562aa921bfc6c439a23fd769e5885d6affdae6faa9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875217, "uuid": "851fba40-cc86-446a-93fc-fcbf2fc8e253", "comment": "Malware payload (DCRat)", "value": "5d596eb2b93081533b676f53da909f3134ea50ae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875217, "uuid": "91be8503-83a7-40bf-bc14-4adfe413f9e6", "comment": "Malware payload (DCRat)", "value": "8eae8c2342ca4699d6a77ba2365be4bb08bb3710ebb982ed16777222c107678668967aa9bf376d36735ca6f58b8b5962", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875217, "uuid": "2c8cbf2c-d1b4-4b1a-8d0b-e6361c9d452d", "value": "T10805F7057E44CE11F0191233C2EF4A4887B49C51AAA6E72B7DFA376E65123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875217, "uuid": "ff44a1e5-d111-43c2-be17-ac053d90294f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875217, "uuid": "c5aac20d-5db2-4fe0-b222-2111676e8730", "value": "12288:5pSG3p149A6wgX4HxZelPI9GJ7+13kgtxKQcZLvsTZFUFIiaQN:5pSQyA6YDelAK7+KQcZ7s9FUuiaQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775875217, "uuid": "9edf826e-f7a9-463b-82d6-4b141455ffa4", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775875217, "uuid": "e1d60d88-6d0e-45e1-b639-b34f107a6573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875217, "uuid": "b6063ce8-755d-49da-8821-a37714e95d86", "value": "02a0e8ae83d543bdcd2b9c695f13824d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f90d97-3601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775951405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951405, "uuid": "dc1c60a5-6f88-4719-91eb-f50aa7c726e2", "comment": "Malware payload", "value": "104a4f8c67f6ac569fadd6d259f7f03b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951405, "uuid": "1bd13171-bd6f-470a-ad85-cfdb6f876ed4", "comment": "Malware payload", "value": "728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951405, "uuid": "ada5542f-2750-4fb2-b302-85a89663057f", "comment": "Malware payload", "value": "b93ce9b04ae7c536722d1bf9e80c007c67c49058", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951405, "uuid": "5d3f3d89-595c-4ecd-a549-900cf356d1cd", "comment": "Malware payload", "value": "0c1a1f4813b6d2438e0261e97dd0d7d59980c3cb8cf1cff8257fef739fae230966a252a8d00301e5389c65fafc77d556", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951405, "uuid": "86e9ac0b-c875-4bca-a7e9-cd17e84c6d37", "value": "T19FA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951405, "uuid": "a510eca4-3379-4f93-8524-90e141aae3a4", "value": "38c192218334865e56f906ff44fbc4b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951405, "uuid": "df8a9f42-d657-45c3-b9b9-11e9eabfcdbe", "value": "24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775951405, "uuid": "7896f71c-8fa5-415a-84ce-38dabbf4a601", "value": 2106368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775951405, "uuid": "fe6804de-7abe-47d8-a561-c8e18dedb8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951405, "uuid": "069fdff6-ec18-4fa8-8227-4bb280d3c8ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edafe8e-3566-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775884841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775884841, "uuid": "1f23a321-a51d-4834-8a6d-b374d0e2eab6", "comment": "Malware payload (ValleyRAT)", "value": "ce859fdfc7635a372690f9633a9f3111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775884841, "uuid": "efb0f801-f8fa-47da-9855-5276e1b3eb5f", "comment": "Malware payload (ValleyRAT)", "value": "75d977c93f2220eb544fc7bd6335c5e44905d4610a54daed5193439fd356a7f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775884841, "uuid": "1997f531-3df6-42fb-b258-69ff659fe699", "comment": "Malware payload (ValleyRAT)", "value": "d908309a2f585d6f1408ea2c4eb24c81ba09ff04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775884841, "uuid": "70f88e7c-c0a2-4136-a21c-ec23e5d09a72", "comment": "Malware payload (ValleyRAT)", "value": "6663ef7c36ac4a6635f37eee9411b79e4a8e545b0744f7e35876a91bf16789182fa1d82dc6be0cc904237d4a4c6d62c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775884841, "uuid": "2660ba62-4870-4770-b717-621f9c4210f7", "value": "T18BA63321B6F8F1B1CA540D302F5153F2063C6ED2FB629AAB6F84766A19740D09E31B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775884841, "uuid": "77d876c9-ce9f-489f-bfe6-295676558375", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775884841, "uuid": "f47c91ce-e12a-4b30-af60-cbed8596c3cd", "value": "196608:0VZjIeuFmIRAnBSvCI5L3XCbBOYH2Sie2fuS1ColmtGPGL:4IeuFml38L3XQBnWSie2fujolle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775884841, "uuid": "7581ebf6-f0df-423d-85d4-e7dc3e2fe550", "value": 9639534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775884841, "uuid": "21fb6730-b7f1-4007-91ba-3b2634e3d0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775884841, "uuid": "f4c7ae0b-5f91-4594-8efe-ca088acbd451", "value": "75d977c93f2220eb544fc7bd6335c5e44905d4610a54d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb5c4af-358f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775902772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902772, "uuid": "7b3fd328-4c4a-4e60-8067-589a0ffaf0c2", "comment": "Malware payload (Mirai)", "value": "bae466cc2d0bc82e83e77f2fdb626b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902772, "uuid": "f205faa2-3d9f-477a-a427-85519b06c633", "comment": "Malware payload (Mirai)", "value": "77e4ad9997420c965a25e55901828ebb38c45a5c75001d6c89b6c3036f1de2fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902772, "uuid": "72b1787d-dd71-442f-8433-da2af43ffec0", "comment": "Malware payload (Mirai)", "value": "7b45630a8ec9206eb81ad23823170abf4b97783c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902772, "uuid": "b48bc50b-9358-4a8d-95e1-de6e51f00c52", "comment": "Malware payload (Mirai)", "value": "8fc640f28b8a2f3971076f3d652e45758b5550bee3243190b809f27adb82a04965cb46adb6b1f008f1750d4cbad194de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902772, "uuid": "ed683d1e-60a1-4801-be3a-c9daa2c2fb34", "value": "T175B36DC5F583D5F6E84305B12066BF728B72E17A2125FA43E3AD5E32DDA1502C70AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902772, "uuid": "2fe6e161-acbd-412b-8ed9-2fdc03d5885b", "value": "3072:w2kNaZCpEJmd36hchJ6tlilXIsh1RtBZm:wFNaNJmteKTBZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775902772, "uuid": "169ed887-3460-4f93-b9a8-36e6e6479562", "value": 115528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775902772, "uuid": "35612a7f-f17d-42ed-ab93-887cd06c39f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902772, "uuid": "7bff9a7f-80ec-455f-993d-f460baedb9e5", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a9839f-3584-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1775897875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897875, "uuid": "e06cf3fa-8a0b-479a-ba2e-6f8e332df833", "comment": "Malware payload (DiscordRAT)", "value": "01d78b211cdbdc8cbc3a043122506995", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897875, "uuid": "55260a10-ef5a-4e62-a417-b68de22a1ddd", "comment": "Malware payload (DiscordRAT)", "value": "7883b05a56f8c81ac93d576f8127703e20355f823f82c4ee53d5aa3606df6432", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897875, "uuid": "0b2720ad-bc2b-423a-9673-44e716451ed4", "comment": "Malware payload (DiscordRAT)", "value": "77dde75fadc7a83ac3d91a899662ef4e04a9ebb1", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897875, "uuid": "fd28d237-5936-4855-a8be-8e93c4dc8941", "comment": "Malware payload (DiscordRAT)", "value": "d64426cca9ceccf3cd25311c3a7b20a84da684acf6f83cdb43957de3858f3d26c873853ef51dda9b962a56a351d71aff", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897875, "uuid": "a93de945-2cee-4651-81a2-fff1531d5fc4", "value": "T17683A68877AD4D03F77F4ABD147041924B72BE17A975F68D08CC98E735A2B828C41B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897875, "uuid": "6ef12117-6d1f-4b69-9d53-d6da81d0b617", "value": "1536:L2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+2dPICeO:LZv5PDwbjNrmAE+2NIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775897875, "uuid": "a3eabd38-f9f3-4c1e-9f19-2e1dd9afec9a", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775897875, "uuid": "49386a92-6f18-4c8e-8652-dc9095cc1dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897875, "uuid": "4fef357a-d230-4a5d-b1ff-9c15340c4b38", "value": "ValexFortnite-cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c902d344-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911728, "uuid": "291cbf78-ce09-424d-a333-65d92b6fae62", "comment": "Malware payload (Mirai)", "value": "8ecea6dd87efb98c6ff0428741fed2ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911728, "uuid": "bfab5712-2cb2-4fec-9701-5ceedb47295c", "comment": "Malware payload (Mirai)", "value": "78ba70bf48faa258b93e88366ea58cdb095f210e51acfde7517ee081e1b16bb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911728, "uuid": "76e1dd26-49f8-4b54-a8c2-17eb35aec721", "comment": "Malware payload (Mirai)", "value": "e9e374b4ac3e37a326f22afb1d6a0fb109530046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911728, "uuid": "12b1f5d1-8aa2-4ef7-bedb-f5d43bd9f259", "comment": "Malware payload (Mirai)", "value": "7ea194742ffb189d3a9ba220433cd59ad55ecd095890f8ba9d8398c00963cdca7ab2d32fca64d263ea05c629ad5c8762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911728, "uuid": "5b35dc19-c829-4ae3-b64a-ad1b6cbda87a", "value": "T1CF630791B881A626C6D1177BFA5F008E372457D8E2DB33138D255FA0768AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911728, "uuid": "f971cfd4-749c-4936-ab8f-7debd71e5d28", "value": "1536:eOUTgPAejqDtrP924hJM59S1k+6/E78fhWva5CmWQN:eOUTgIejbQZ6/E4pEa5ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911728, "uuid": "7584e84f-9abb-4639-a4fa-11fbcd3a4c8c", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911728, "uuid": "df56aa03-47e5-4a55-a260-f66365f6e819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911728, "uuid": "b09652f1-3bfd-4830-bdda-4d027f8a5c5c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52482652-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "426e8cc1-6928-4a69-ba5f-f21d0b902f25", "comment": "Malware payload (Mirai)", "value": "382178e04c6c5e143556d0e9f994e5a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "3d6735f5-53a4-48b4-a7bf-61475e9ed481", "comment": "Malware payload (Mirai)", "value": "794f310c7608ae4d37e5adc1e81e24df266258221b75bbae72143aaa0f972fb5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "d7142fd4-1d88-4de1-8952-353a55c564c4", "comment": "Malware payload (Mirai)", "value": "61edab0d087cf54128ff1528d2e4d638ec7359c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896497, "uuid": "53522d24-c2ab-4e73-9e2b-4485e6c34893", "comment": "Malware payload (Mirai)", "value": "5f9bcac66f7b17404ccb91eb8f90cfbb54fc04ef380690d6459f19ef0cdfe793b200d768ff2c93f8833201b0cfc5da17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "b0db4b5f-1a34-4b00-b433-360e7585dd5d", "value": "T1A4C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "4bd969ff-5786-476e-b0ed-908114695446", "value": "3072:Mf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4kqe:Mf0tJBR4NSALD7rnCrheifqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896497, "uuid": "d62c5776-53be-4a7f-9890-0d4895d80ed0", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896497, "uuid": "6adb7f11-b038-4359-b867-9299152dc55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896497, "uuid": "b6cc91d7-c316-44a8-8ab2-3d5d6383ffff", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c24cc-35f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946840, "uuid": "4c0bd5b5-27e5-41f3-b281-a3a652e53463", "comment": "Malware payload (Mirai)", "value": "cd17ccddf640f13b27bccc94d6244da9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946840, "uuid": "0476e27a-86f7-4546-b48b-6c488ee1c244", "comment": "Malware payload (Mirai)", "value": "7a416069805e038aa1000e43b18aac8107502b1d5cc2ef223d294d1d55ad2719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946840, "uuid": "d26fb964-b452-4275-b897-b1d9f4ec74cf", "comment": "Malware payload (Mirai)", "value": "4a10eb756e1834760b4b9f9d43a0c06a1d56a42c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946840, "uuid": "bb9264f4-83df-4e67-bc37-79daf25e368b", "comment": "Malware payload (Mirai)", "value": "e6df93935fa57a2d131c5b134faa52b6f6fa5e58726cdbb44a81e574d337f7769ca82e5f4653f7c649c885f23b9992d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946840, "uuid": "e4d4e3b1-72b6-4ba3-b9f7-43cc3b44e3c8", "value": "T187243A0775D08DFBC4C68AB50BD791328933F8291B36664BB7A8FD951F0EED86A1C604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946840, "uuid": "fcebfa12-d104-4234-bafd-30c020122c5d", "value": "6144:6tnnBv+YCUqesi28JgrFTxpkvKHg+heN9KAM7pNNle:65nhCAykvKHg+heN9KAM7pNNle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946840, "uuid": "8f03769d-0aba-47bc-8389-ab9cfe3164ac", "value": 221204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946840, "uuid": "e661a97c-f4e6-40fc-b4e1-2f930941f340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946840, "uuid": "d6ccfac2-ad56-4dfb-a71c-54a4dd4428cd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a017b12-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1775931755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931755, "uuid": "f2163c09-87ae-4f29-a1ff-590f36722946", "comment": "Malware payload (Hajime)", "value": "0434ee67b69a9189bd11ced779a17c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931755, "uuid": "930d1b82-5f60-4123-91fa-ec55cc242986", "comment": "Malware payload (Hajime)", "value": "7a555055be675d93e8ad1ce7061acb222c383708f148f31c50b0cdda9da0ced9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931755, "uuid": "dac928af-90dd-4fb2-ad6c-e4cbc1b78468", "comment": "Malware payload (Hajime)", "value": "37a5c5a0c79b22db30f12eff57ad36af99ea8a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931755, "uuid": "5b4c613f-7357-443d-a377-203f18869e25", "comment": "Malware payload (Hajime)", "value": "f2af7ceaa69b86adb65b2c0dbbaddf53ad9f4a72a005e92f40021193263a579caaa10a1cf58d97bdf90b5085d5284fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931755, "uuid": "8134b956-b13a-4f39-b841-3e79fa30f02c", "value": "T10C42B0063E9C3B07E4A187F1FB396E75B2015E5E672F984BD954243154F316AF500C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931755, "uuid": "2f8dd21e-aeca-4255-8007-4badaaeb715c", "value": "192:YTmCc4HnYXvQ2mDuYedvuXH2oLxZ6qSAM9vrqj7/sBJ6HGpTJDqiwOrvw9Bpjdyd:YTYXvQDuYY2xZ6VTgDK4mpwTl5yeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931755, "uuid": "3af2459c-05d3-447c-a544-097dcfad280c", "value": 12942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931755, "uuid": "7bb518a5-30a8-4ff5-88c1-ea98ded85c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931755, "uuid": "535e2071-c9fa-4002-9029-ddad30160b28", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a33e1dd-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910979, "uuid": "7dfef2a8-b539-4d44-bb90-af7da873ffa1", "comment": "Malware payload", "value": "9a61d7fbb5b11f5e3503d56e4be0adef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910979, "uuid": "117a9a12-c517-4b04-8b48-3d6032263a80", "comment": "Malware payload", "value": "7a6b0a4886057acb016beaeba100f02dc0e07948328aa715176ec5d3519ed464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910979, "uuid": "38b1a92b-5a15-409a-8f0a-ec1527a6d78f", "comment": "Malware payload", "value": "e55b5d3946ed6472c92c6a34c9e5b82aaef71a29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910979, "uuid": "997f9da4-782d-4f47-969f-9dd5a6a628c6", "comment": "Malware payload", "value": "54dba775deec441da4effc1fb929de6e6386df60ea775e1123110f366d3eeddafbbf2526d2a2e12b377b167c8f3c819c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910979, "uuid": "51fc3dd0-82a0-4172-b69e-dcce079619f4", "value": "T1B964125E9AD60FDEC47FCD344B17036B238944AD93E2761613AC9D5CFA8C6884AD7E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910979, "uuid": "771951bb-ad8a-4882-b129-193b5b1d58f8", "value": "6144:PLJDT65zMT64RpADJ2089FCw6gBqVEfbtGw3ftl0cdIlDM654oAbd345C:Foz/0agbFj6gACbtv3fticdQY6aoad3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910979, "uuid": "551ee6a8-7755-4c2e-967d-d34cd0805b21", "value": 326117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910979, "uuid": "9989567c-24a2-4691-8c15-7dbf9fa81d4c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910979, "uuid": "874f8ac0-f9f5-49fb-ab98-56210fa35ea2", "value": "jc4z4ut4mb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4323e32-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888152, "uuid": "202ea822-fb08-4be6-89e2-ee6a14fb71d0", "comment": "Malware payload (Mirai)", "value": "d2ec10cbd60d45e6e01b844c59e1a282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888152, "uuid": "92a5e5de-c7e9-4aa0-8396-19a429834c3e", "comment": "Malware payload (Mirai)", "value": "7b9c0ff385f650793c5370e36b6177293e06f51415348823527bfb444dedfad9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888152, "uuid": "1e8af12e-958c-4a30-86f9-887076f0c8b3", "comment": "Malware payload (Mirai)", "value": "70518e2760a03edeb44b09ec564d87f7eb096ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888152, "uuid": "1b48cce1-7584-4b06-8cee-1086d4abca09", "comment": "Malware payload (Mirai)", "value": "92fa8c3a30600690da3bc0a4d6c233151220327976268e270ce0698c7c3e82bd26ed8c3f649e311f3d3c1e82db5e34be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888152, "uuid": "8b46a5c6-5f54-4182-a557-62989be5b8b9", "value": "T13BD33B4AF8508F23C6D652BBFF5D428C3B2A2759D2EE32039D15AF25379B85A0D3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888152, "uuid": "38ea1306-3596-42aa-93a6-405c08b72b5e", "value": "1536:cJVU2LTa1UIwpdJMjyIytT2C322fx4VY285Td7xCQp7cb5loWwyw/q1dgAJzVs3K:cXC9w5MjyI4aC3N4X6SQQ5dgAJmVox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888152, "uuid": "c6fa6e29-9294-4ecd-9e77-22f0eb237c7d", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888152, "uuid": "ea29ae69-044c-48d6-91b4-746df2fec2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888152, "uuid": "90182772-e79f-442d-89f9-8a33006cf2e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413b3f8-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911666, "uuid": "94e87574-d5d6-477f-9f12-0fcf288a5240", "comment": "Malware payload (Mirai)", "value": "b75c87542ebb550a0f6b0d269a04da01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911666, "uuid": "545fe090-4ec2-450e-ac46-09adafcb425d", "comment": "Malware payload (Mirai)", "value": "7c59e5e24c40a5097e3ed5cc7482fe206531d21fc015ae6648ecad6765fa2ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911666, "uuid": "9f4a3f32-0f99-4454-9538-9e9b83b10e3a", "comment": "Malware payload (Mirai)", "value": "0071e459c908677b92f8b8fd671a7fdca0011d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911666, "uuid": "af60f6b1-5ef6-46cb-aaeb-adfde0020e5c", "comment": "Malware payload (Mirai)", "value": "326c9ea4ac14ea180ba3ca91a9b993317373c07deba70c70b3bfcd20e720fccce7e0cbaad6cb79196dd12369c85b0708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911666, "uuid": "f91076f9-c2dc-4546-9564-a6eb460ad97e", "value": "T104732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911666, "uuid": "7270f25c-9c3a-4a19-ab1d-8ed157d43f92", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXKSKV6v3G78nN9WF:927jqCU8v3GI/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911666, "uuid": "6938d1c7-7b43-451a-b28f-6dd5328d1c7d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911666, "uuid": "b2b7ba87-27a4-45b1-964b-30503c9b7ee5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911666, "uuid": "2e3105ea-9061-42d8-976c-06640b42f54f", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd63d28-35ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775942952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942952, "uuid": "2dd03b7c-4c17-4185-8ad9-18cd8e2be3ee", "comment": "Malware payload", "value": "d3e9da5a62f1c39a12f9870584fb4657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942952, "uuid": "5d051521-d0c6-4faa-8f84-d1fc0e73683b", "comment": "Malware payload", "value": "7cbdc3ffa1f6afc407cc1f6b9a6f6be032505bb90dd9f4543c3c65b56ca30926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942952, "uuid": "0bf2ad9e-7607-46a8-a242-7e53dbd731b4", "comment": "Malware payload", "value": "8582d2534dfd761199c4fdf86239ddf24a98ac71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942952, "uuid": "e8b3bb7e-24fc-45ef-9185-24e87fab1a34", "comment": "Malware payload", "value": "a21a1cc8b0ad6858a2773fdd22746f244cbeb24758961756b0bc244812eaad823680fffc93aca7038a7bcb28ab1573d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942952, "uuid": "28c9f359-dc7d-4624-8ee1-33a01163a2bc", "value": "T127B4E04D77A5D8E7D9718E345C34869127326C972E404B672AC0B30E9CBB2F48E2BB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942952, "uuid": "906f454c-e0ac-4dd7-b564-687f69172a89", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942952, "uuid": "770aee66-cbd2-4fee-a26b-9edf64e38d77", "value": "12288:afLK8er5+nZoyb7ksUfhCOEq/zhMmCNIx9XQajoI:afLKQPosUfhCOEq/zhLDA21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775942952, "uuid": "fb056c89-c7eb-4964-98d4-41b64ecff377", "value": 513615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775942952, "uuid": "b7746fb6-f655-452d-9b0d-eed2626dab38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942952, "uuid": "714ae649-4087-4491-b536-2d1f7d5a2643", "value": "wrfvfjsl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e8b99-35ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950655, "uuid": "42f446fd-7421-4eb1-b7e9-997a7908aa7c", "comment": "Malware payload (Mirai)", "value": "008fd1b919a26f471e1f079c9712ef02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950655, "uuid": "c1efe3d5-6baa-4709-b1ca-d505ab7209c9", "comment": "Malware payload (Mirai)", "value": "7cf18dd4fc9217795344072c8c38a857a6f04461126e720a5c4ebc5138c3bfc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950655, "uuid": "ab301f7a-fe4a-412d-b892-84f14a926c8c", "comment": "Malware payload (Mirai)", "value": "0cbbc91c0167753e6c9290d07d0e689b577f6cce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950655, "uuid": "c6f9f95f-3691-4ccc-a5a3-93d82b68f65f", "comment": "Malware payload (Mirai)", "value": "e484ab993125bfcbd76ee061abcffdad7847fb18d98576505a9bbbfcabc34172aabdd9130f801409b85cd35a56c43e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950655, "uuid": "df624d00-d074-4071-ad96-aa63c92a98fa", "value": "T15614F752BD51AF23C1E232BBFB9E428D37156B69C1EB72069C227F5037C68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950655, "uuid": "6058270b-507a-43a3-88c1-6e6231bd5cdb", "value": "3072:RuJuWw7d8uHSXgX6bcbRyy8oyI+S3XU5mcdy8cAM+GtfkEW4yMBx33:RuQx8oX+S3Es0y8cANGtfkL4yox33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950655, "uuid": "8f3eddc9-f4d3-44ba-b2d0-1ef7c3750ff7", "value": 200676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950655, "uuid": "9538d52c-157b-4ffc-8fcb-e4d4b9261177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950655, "uuid": "04ed2516-5983-4bd0-a398-41fdce10daa6", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a0caf2-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775917308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917308, "uuid": "79d09c9d-cffb-419f-8e14-f133e7051a86", "comment": "Malware payload (Mirai)", "value": "8107e8a3260010cfc9ef8a91d988f671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917308, "uuid": "5aa8b523-d7de-45c8-9893-574ce5b1eda8", "comment": "Malware payload (Mirai)", "value": "7cfbf7d4e815e03c27b8f2f3326a78edf0f4e8a5800e2bd684162c400dbef97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917308, "uuid": "0663c81e-a832-4c24-b161-115a85d5d445", "comment": "Malware payload (Mirai)", "value": "f70303faf182149ca366d4ddac3f7f7fbe62a262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917308, "uuid": "036358f6-d0b8-41d1-8709-22526815b6c4", "comment": "Malware payload (Mirai)", "value": "52b62bad516e3ca0f007891ead45e71bc409a337556db0a57dc383d1d6a0530432a4f98438d66945e57a68990bc0aea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917308, "uuid": "ac389fe9-ed9a-4ac0-adc9-51b1891d4de6", "value": "T17924BE97B20F1491C8AA02F84BCB9F5C6A2369078D27C5EA6D2D663E3B735DF18153C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917308, "uuid": "2e8667c7-4f81-4dd8-8487-aa92b4064f85", "value": "6144:ElGo4TQsGmkIrNBS2fDeqmlOXMaue/TIrKtFCaC9RQqa:ZfGQrreqmu/PIr7D4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917308, "uuid": "211cf507-9232-4171-8f59-a67f6765e026", "value": 223148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917308, "uuid": "9d8de9cb-1189-4fe1-b99d-94ea4733a567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917308, "uuid": "25dd1813-3c0b-4bc6-a74b-d9e2f33f5665", "value": "redis-swarmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b58461-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917305, "uuid": "caeb19dc-3291-432d-be00-89737118ae4d", "comment": "Malware payload (Gafgyt)", "value": "16a8f9247b4fc6f1d430efbd5499fbd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917305, "uuid": "bde01da2-790e-484c-9a7d-c2495ac747c1", "comment": "Malware payload (Gafgyt)", "value": "7d09c7018e432a78f17dfe7eccddecef02e32e6e5ff94d7cd00bb737403bff01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917305, "uuid": "33ba1937-6ff1-4595-9218-e4988bc71778", "comment": "Malware payload (Gafgyt)", "value": "bc993c8f9801773049db42a957a14db1372afc6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917305, "uuid": "2d35f2a5-d6d1-4470-9bec-288d31e5d904", "comment": "Malware payload (Gafgyt)", "value": "306a4e00d60bce6c7f3b9053f4790b0d0df354def117f643f8e47451f384ffced0c00ac1e1da2d32e9a8aedefef8fa17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917305, "uuid": "69378229-de2a-46c1-9d9f-2bd5e91ddf57", "value": "T1B8A3016DEC52F783D54D8FF7B54F42A7629583C2C99B785B914F0A8939483131322AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917305, "uuid": "80fb75ad-d1de-4dbb-afc8-d368b8b79ca2", "value": "3072:+WuCd0DEpSVJrgzWbSysv4LDxX9hAzgdWEO6YKCEQ0:+WQDEpSVJrHbl7LDxXrAzgdlDYKu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917305, "uuid": "8a74f5ee-fb68-466a-ac4c-187c5124e2da", "value": 105300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917305, "uuid": "e7033ed3-928a-4250-aa78-9ca43a6231ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917305, "uuid": "2904fb34-1aaa-4b11-b47d-42d7cabb861c", "value": "redis-runcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9724052-3582-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775897126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897126, "uuid": "b2a5c765-41fd-494e-8e51-73f2a55528e5", "comment": "Malware payload (DCRat)", "value": "100a9d361d20372041de26b2b29833f0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897126, "uuid": "b510c96d-5d56-4191-a31c-acd2c402329d", "comment": "Malware payload (DCRat)", "value": "7d8f5c1fd340e6ba008bb376f2356b14b4abb2243283ea2eff91d6bf9338509f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897126, "uuid": "92c073fc-bf00-43a3-a01c-698ee3a2fe49", "comment": "Malware payload (DCRat)", "value": "b788489c1f6caefa2ec2d8ba259362759e2c0616", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775897126, "uuid": "f02eef56-6fa9-48e7-80cb-05b16cc6ad31", "comment": "Malware payload (DCRat)", "value": "0ba82498b7006c7cdcbb05c2529b5d0f6de4b46ad52de679e072f3f1d09e90f1113425eca222f3bfb0b990f0cf2a73f9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897126, "uuid": "0b6cd6cc-2fcb-453a-9d10-5f1b37a1f827", "value": "T16F05E6027E44CA11F0591633D2EF49488BB0A9516AE6E32B7DFA377E15523A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897126, "uuid": "aa3e42cd-48da-46c3-8a36-d54c3a4eeaa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897126, "uuid": "89fb90cd-8daf-48bc-97e1-4d2fdac89e6b", "value": "12288:xAvAUyZ9oqLzQ9Iv12cq7VYgHC4JJaC9skmob3wrC:+c7oqcIv147JC4JJa2SobWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775897126, "uuid": "e0bbe2c1-436d-458d-adfd-242a207c0372", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775897126, "uuid": "b912a52a-dc3d-4625-8943-1e299bccd7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775897126, "uuid": "c560295d-2ac2-4198-a8e6-c530cb7b86e7", "value": "100a9d361d20372041de26b2b29833f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30418879-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775900735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900735, "uuid": "be0da674-15e6-4c85-b6b5-c8aff0e5f0f1", "comment": "Malware payload (DCRat)", "value": "0fd6d35a85513c2e86a0a94ace158b7a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900735, "uuid": "6ad07930-b885-4167-ad78-57461e21c055", "comment": "Malware payload (DCRat)", "value": "7e1ddc85e590fb78e99330fb3ae333777794de8013c5436bb7b1bb4b2d3dd54d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900735, "uuid": "abb77191-c4aa-435d-85a5-ea3719cffb2b", "comment": "Malware payload (DCRat)", "value": "cdff3c8d7fda3735603d2e82879d493488076aee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900735, "uuid": "bd8c5b6e-7565-43a6-9e88-1162595610f2", "comment": "Malware payload (DCRat)", "value": "bcf5cbaa8941e3eeab0d7e19b229babe0331c45ced054d7e2f9891963cf01d34b1533666b88c8487086e3d05bac62980", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900735, "uuid": "6dc01903-8404-4796-b5ab-823017a3c692", "value": "T12386E0F6DBC97421C0D78C3F95391D1668909C8E2CCCB726DA83BE5C96732A91C97263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900735, "uuid": "50401844-851e-487c-a750-40fdf9a6db2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900735, "uuid": "fa4bbf36-a9ef-4b81-8d22-9d2cfdea49bb", "value": "12288:+poIY///1UFuwYp4bLJXmr8j9+9rOTXw4sXWS7TVhNa4iK5QeRG3REA:pIY/36/Nm4xiMXwZrNniKVG32A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900735, "uuid": "6a36af6b-388b-4ba7-a341-20d5a9b24bbd", "value": 8388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900735, "uuid": "24d6379b-83f8-4095-b9c5-d49f28ecd48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900735, "uuid": "1c523a3d-d257-4cb1-86d2-0693bc4b9348", "value": "0fd6d35a85513c2e86a0a94ace158b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51766871-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "8c6b8c85-3357-4d97-bb5b-f49e5d68145d", "comment": "Malware payload (Mirai)", "value": "7aee895fb4df044f2e697e2c7abe7608", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "8fb5ac46-cd46-4a7f-b3c7-a8cb15a4b9ec", "comment": "Malware payload (Mirai)", "value": "7f5b422a58ebbceeda8d20f2d9b69d44e85dc9e815cc63a7d9abd902bd9e7491", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "775c8ff4-ec92-4734-8b42-a0d46815578f", "comment": "Malware payload (Mirai)", "value": "7cb42a141d7478a143336122766788281802a223", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896495, "uuid": "1e3a992d-6945-4dec-9181-63248244430e", "comment": "Malware payload (Mirai)", "value": "d6606234ff18b41f09f052c081e2cee0344a25c885658458d6247920f895b30618f74f7d79af7c8b275d2ef47e21fda3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "8db7ef52-6dcb-4bf6-b6c3-daeb8a1abbc9", "value": "T1CEB30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "ddd7959e-f3f5-456e-bbb6-08e7a300814c", "value": "1536:tUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvA:2ixnUHz4Z+5ypkn3E8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896495, "uuid": "677dacf9-f251-4359-929a-50934ea84be4", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896495, "uuid": "60d49748-5bb4-43a8-988b-9bcc78f97d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896495, "uuid": "6f5ab406-9012-47d3-8843-d08ac860cd1d", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a1574a-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896695, "uuid": "47cc2db0-9dfa-49d9-ae27-edabc36b98bf", "comment": "Malware payload (Gafgyt)", "value": "d5748b730509ba018ed884efbc6928b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896695, "uuid": "49453a07-9106-4484-a7f5-407a35dc66fa", "comment": "Malware payload (Gafgyt)", "value": "805f6789f61452ba21938664d171c61c4a6f37dba2eb714d4c11afd1a43feabe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896695, "uuid": "c019954e-6e25-4ac5-8c43-87583bc8fb75", "comment": "Malware payload (Gafgyt)", "value": "82034a14aa2b2adcfc3fb327e28c0975b87d5e71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896695, "uuid": "3fe74958-407d-459c-a56b-acfc3ac5c1e8", "comment": "Malware payload (Gafgyt)", "value": "6f1f52b60334b362a1903edce90eca48011a8288b57a7b4773a5d13a0a542e9602bf2f90ec85856471535f46de3eaab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896695, "uuid": "8a1dfe08-0ea1-45fc-98f9-797d81f1bbc0", "value": "T1CFC30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896695, "uuid": "b1091301-ab46-48aa-bcb9-aac4995a4e69", "value": "3072:hQrFRNfuLrGhEPOD0eg3gNlmBoHQuQekQnYW:IFzuaEGQeg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896695, "uuid": "8eee27ce-b17e-438d-a3bf-05f9ae58ecff", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896695, "uuid": "94439c86-02ad-4061-af4f-754232a25ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896695, "uuid": "c423d790-b014-4533-84cc-a84d34a69236", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984c8e70-35df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775936987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936987, "uuid": "633b9bc1-9942-49b6-857d-13c547976497", "comment": "Malware payload", "value": "fd34d718f244c22c8237ad327c9c240b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936987, "uuid": "0d927f48-ed9c-4efc-b5f4-b33377a974e8", "comment": "Malware payload", "value": "80a15362aa0d386255a9c5dadfdd737b639c05d2f2a5f911ff88736ceea29a79", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936987, "uuid": "e6b8bdfe-9e24-4b61-928d-aca2e8b396ba", "comment": "Malware payload", "value": "abcdfa73873aeacb46fc93eb17ee44139dc7fcb6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775936987, "uuid": "53d2e5bf-c9c5-4344-baa1-ee8341544ba6", "comment": "Malware payload", "value": "c2c5c8d5363cb6fbc726cd3ab47b603fd6a5a30d90d6f037d5bbafe65c174288c74da3f04b86a25913279aca55b40362", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936987, "uuid": "1170725b-b8d2-4e2f-9d4d-c754726d06a9", "value": "T16152CF6935EA783DC826B23B8033C88C23A5FB5D16061197A47FE08CE14B971D4F765A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936987, "uuid": "3437695c-cd5b-480e-85e0-99d64b2c9472", "value": "384:NUwevPa4jFhZ+TKZhj5yFLXqVgqUtMbwW:NePjFhZ+TohNyZXqVroMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775936987, "uuid": "0e35d691-eb49-4602-9fc2-82f3fa99102d", "value": 13310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775936987, "uuid": "1dcdbe2d-feb5-424f-94fa-12778ccc24ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775936987, "uuid": "801a12d1-3ac4-4798-97f5-3614b082ab14", "value": "IMG-805068627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beda37ef-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888089, "uuid": "72bb58de-5aa7-4408-86ff-92fbc82ac0fe", "comment": "Malware payload (Mirai)", "value": "182ca1c3436d87a01404bc33180a95db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888089, "uuid": "d56b2ac6-2795-43ff-a172-e366c8f7fd4c", "comment": "Malware payload (Mirai)", "value": "813079082d04bf82dd529fa6f5a20d0e7086d824d69bbca2b107255c51f9ccad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888089, "uuid": "51c54956-8006-42cf-979d-a22fa1b59034", "comment": "Malware payload (Mirai)", "value": "d215de7ce58359084fc7335b9238d38f765babff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888089, "uuid": "7dcd33d4-3530-4790-8afc-57c2a26887b8", "comment": "Malware payload (Mirai)", "value": "e9ee5fbb53c08b6488a1033c61b0a3008b6ebdd442c57eabf5354eb29395f02acfb671d8090a624528f1653101197f38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888089, "uuid": "ab903155-b97e-49dc-ad21-d39ceff9cb2d", "value": "T14A133A1351BD6607C0F8E27D02B35757B1EA765E90909B1F7E3A0ECBBA413900F6AA74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888089, "uuid": "d4f5494f-7553-4d56-9fab-5f3f95cbe75f", "value": "768:b16rlwk75BJ31zURv8j3eCQ7Haukz4zEcpuOOdAdkZcbXtliYPd1:bUrlwCJ31zURv8KCQTaxz4zvsElP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888089, "uuid": "26c6ab30-3f06-4da5-bc94-9504677e0ccb", "value": 42876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888089, "uuid": "5ab4c0d4-3171-45ec-959f-1181389ce2ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888089, "uuid": "f7ebedb5-5e3d-4323-b638-c84ee8320ea4", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a571e3-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775916826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916826, "uuid": "828b5eba-4f20-4894-9b19-1a3fd5f14161", "comment": "Malware payload (Mirai)", "value": "d37efef1594fc57b697ceff4e811fa3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916826, "uuid": "6db2518f-7d60-47e0-8692-4c5175c88efd", "comment": "Malware payload (Mirai)", "value": "81a7362a89e0a01d423c6d402ff21ffe0e3d472edbbb6fbd35b602e08040c75f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916826, "uuid": "782c8811-7a19-4da6-b98d-d25d42c350f1", "comment": "Malware payload (Mirai)", "value": "b74d84d52e4eab6f78793df8e77eca3eabcdb2f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916826, "uuid": "4546b554-f3a8-4993-acf8-7b4314376e1b", "comment": "Malware payload (Mirai)", "value": "21001c1fa4313cf3305dd337e78fd26f2b1b7fbf31b4cca5f454a415fb2c001a99a259607359ca0f798f8ed80e2d0b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916826, "uuid": "a33fc76f-de36-4cdd-86dc-c3b9dc81e101", "value": "T1DD833B17F5929ABEC0F5D031476BC031A772B4A152325B2B6B98533A7D43FA41F3E862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916826, "uuid": "aba023a9-52b5-4ffd-bb19-e0c7e6f540d5", "value": "1536:uUm6maiamXsDaAIxyH8HrJNM0EMoDHDKvCXNgCEk:uUmaid8DaPxTH9NbyDHDyehE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916826, "uuid": "1d16721f-bb38-465e-b37f-eb45429992e6", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916826, "uuid": "4e84beee-6197-41d1-b03b-f2545e405965", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916826, "uuid": "3240b811-1a08-40cb-88ae-4b549dac2f91", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d83012e-35c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775926044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926044, "uuid": "f76e45f3-c220-4610-86aa-532874edfc64", "comment": "Malware payload (Mirai)", "value": "ce88f29d8540103c8a4690c83383e94c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926044, "uuid": "a4d847e6-bce0-47d2-82cd-0f00baba9f05", "comment": "Malware payload (Mirai)", "value": "81c7098fcea81cb792261aae39597099caefe223b03818561aaa360aebda78e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926044, "uuid": "08a7533b-d007-43dd-ac09-9c041903a5df", "comment": "Malware payload (Mirai)", "value": "5b4c0fd8d94cb8ba8aae4cc730e2ffa009f4efd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926044, "uuid": "35e115f6-e386-45fe-a3cb-8fd5ffa79889", "comment": "Malware payload (Mirai)", "value": "1fdab317d379362828324e461e206428ed2e391219abf7abcf676d6511094aea1cdbbae74d33bb342d04d02d84702884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926044, "uuid": "9702d2cf-9290-45be-905b-8a40cb7c06d4", "value": "T176B30748FB43A0F1DD0B4E30205BF67FCA345E558535EEAAEF847E15AD33912640BA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926044, "uuid": "5595c193-4469-4aa8-aaef-23e922a08e5b", "value": "1536:zwROC+YBejhz8+knKjLX6K/WWttjs+UFP73/9GqcNFOSUE31kgz9qOAmzWeQ2k+g:zpdYivXXj/HfrWPzlZiPqUnC+Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775926044, "uuid": "2745e1a5-ccf3-4fcc-84f9-ba0c39c7f75a", "value": 115608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775926044, "uuid": "3f99b9b2-31fd-40d7-af70-59d0b02640c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926044, "uuid": "43d19db6-811b-43ab-9188-f4ab13a16ca5", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8bc518-3581-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775896457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896457, "uuid": "6d3b2611-3631-4027-b789-9c28be243788", "comment": "Malware payload", "value": "f937d7a18f40930af0e64598c6bf2e5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896457, "uuid": "2ad121ca-7660-403d-8a8f-56e9a287436c", "comment": "Malware payload", "value": "82033d8685dcfec5c1a81b0099eb8ba285ec997ffad334e4850596da1732b8b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896457, "uuid": "5bd692b4-6708-4f34-bf4a-848c51b245dd", "comment": "Malware payload", "value": "83c73e16b49adc29d43c4f1077e14a270de4804a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896457, "uuid": "7c882110-577f-4ecd-a03b-797b0fd18111", "comment": "Malware payload", "value": "9db20bb5ebbb40fef3b888c57f2cbfa324b98d6b8adda0f9cda4026f17bed7eb14d45cb861e243c3e4967a836c4c601d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896457, "uuid": "6f8bc098-d36a-47f0-991b-64e82d5bcb8b", "value": "T17806021189C42FB9CFAC571890FE160EA3F04E8F546AB989FB73BD47AFA7540011B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896457, "uuid": "3f2c6ec2-1530-41e9-90e9-86cae20fd670", "value": "49152:hic17IHt8SsyDF0/sDpiBFmH0ddnati35WKTefmm:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896457, "uuid": "41d91596-1874-4d91-a6cf-9eae93e7777f", "value": 3942405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896457, "uuid": "8219f6ff-c5ae-4649-9b38-ff7099afabd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896457, "uuid": "beb26dc9-20e6-4223-a149-3b0eb3cf1f3b", "value": "Aanbod nr. 04-58042.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fea5c9-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775900993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900993, "uuid": "a7450d1f-ef51-403d-98f2-e96a07db5724", "comment": "Malware payload (Mirai)", "value": "94dfc181e0a2b1a3d21a32572544c48d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900993, "uuid": "5f0ccfaa-0b5c-4b15-b4cb-73f68c19bc9a", "comment": "Malware payload (Mirai)", "value": "826cb382436767188930b2b968ba12dc668ac3fd073c8ee592abd8e667934903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900993, "uuid": "86c656fa-fd12-498f-a77c-cc211bce28f3", "comment": "Malware payload (Mirai)", "value": "6f22cd941466eb97178c458e160898db4726de28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900993, "uuid": "cb181430-8089-454d-91c9-eb731f624ed8", "comment": "Malware payload (Mirai)", "value": "0d2f4f54729b68556cbecf313cc0ed4ea1b5adaba9548f2c691e93a807ff959a49f82196d690f438bc58a06eefb69746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900993, "uuid": "7763f742-651f-4950-8682-7f88ee556183", "value": "T127046B69BA4F7C42D2C3D3F4CF9B4F64352735B18E5691E23E12132DC8D29DA89A0B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900993, "uuid": "7893de92-7580-4544-be8d-e169fe5c4f97", "value": "3072:yBXEmbvutXf1aJ/DyH+wx1DzlnqIcaujnBmolq:yB0ovutvphx1DzdqBrBmolq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900993, "uuid": "0f91a6eb-77eb-4c01-91cb-8f02caf8e3f2", "value": 173960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900993, "uuid": "20c0de80-54ac-4a75-8dd0-267bed28eee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900993, "uuid": "bfad020f-55a5-4dbf-8f8d-c1663b00205c", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9869a51-35e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775937445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937445, "uuid": "29e59de5-27d2-43e6-96a3-c7fdd49825af", "comment": "Malware payload", "value": "0f00127b41bc8b826463b8351ec95043", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937445, "uuid": "dfc2adfc-ae19-404f-827e-e95dbe3a9c61", "comment": "Malware payload", "value": "83033f57dfcd0560977abd42726931c391e1e242b7c7462f5af1160c67b34afd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937445, "uuid": "cd212202-2abc-4929-8b0c-4064fdfd6809", "comment": "Malware payload", "value": "2db4ae3b9fcd38da375ade396901ea7cbb296635", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775937445, "uuid": "62d0c615-e387-49d8-a19e-04476d29d5d6", "comment": "Malware payload", "value": "93145b6cf4fa23480ada7769402909a46c2fca007dcd44c6e732a98b5f82992a05b6c4d80acd4ff8939b47f0a6ea583e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937445, "uuid": "0139d976-5762-42c4-bfbd-5c65cdded270", "value": "T1D85733B9B8A7218FD03BC4318D393D0986B23D615E478E1A71AF7347A8777E0707A51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937445, "uuid": "76940521-c1ee-4f9b-933f-f3f5396e0cda", "value": "786432:0GcITwTRVPoR7ifZ/5wpYGoLlw0M96heOG4FYJzTaK+:BTwT7PoReR/5wpYGqrneOBezw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775937445, "uuid": "770aef9f-9dc7-433f-ac4a-f2963cd4d571", "value": 29507584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775937445, "uuid": "aecf781f-b6b9-46c7-8648-5f931817414a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775937445, "uuid": "2a8be6fb-d746-4688-8898-bfb5ebd6a9ac", "value": "Game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33bd35c-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911692, "uuid": "990b2d84-9579-4145-941c-0a3806701de9", "comment": "Malware payload (Mirai)", "value": "f680ffdf332a0dbdf2c679cf94f5d5ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911692, "uuid": "18e557d8-87af-4ce0-9569-934b749867c6", "comment": "Malware payload (Mirai)", "value": "8527666667490747e90f5dec87432f34c79146ae5f4c64f72017bbda5fe45c92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911692, "uuid": "ec513486-7477-404e-a77c-bd86a93328b4", "comment": "Malware payload (Mirai)", "value": "f28b586bf9f9d458be11fff17bd58ec46e0d8970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911692, "uuid": "9e8d0a07-5dd1-4ae6-8c90-12fe13e3ce1d", "comment": "Malware payload (Mirai)", "value": "4023e0dfb9e0be2602916b5e0f5b251dc7a08b12ac1fcc87da50d2d8f0479d36dcf5598cbb402b860d7c0fcc3523a263", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911692, "uuid": "0d6fe7ca-ab90-47b6-a6c2-e4ee32399210", "value": "T162E2E1F87A587131D7F016BA4D3E54AE268B0FF08196326319DCA6496DF24271AF81C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911692, "uuid": "48a35754-f10f-4eea-babc-e9cdb976a1d6", "value": "768:U+QuN7Vxj/DOiPMZmnE1mlHh2eNZdBB5mKt/ztMpNswkFILOroak9q3UELj/:U0V/DrM8nRlHh2eNZdzYpNsw5OXNLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911692, "uuid": "b143a860-e3b1-4ff4-a9ec-eba98d2c2d5f", "value": 31876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911692, "uuid": "d717cc4e-c5f0-4643-bc59-7d1a12e0bce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911692, "uuid": "6c2482e9-9492-4fc0-b79f-69dc72e1fbaf", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ba49a9-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911126, "uuid": "9f7a59c7-8683-4a9f-af29-ec4f592e7021", "comment": "Malware payload (ConnectWise)", "value": "3bda1a67398486424b6d7aa1fec2156b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911126, "uuid": "0c841f8a-5a29-4d5f-875e-077d25657a63", "comment": "Malware payload (ConnectWise)", "value": "85d92e9743529341a123cc18483b2cd2d370cf753b3fc6ee5d26be104591b696", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911126, "uuid": "5e058195-ec20-4cdf-8b22-9d7ae59349af", "comment": "Malware payload (ConnectWise)", "value": "bcfdcdeec29011e7deccc70ad3e691c8392841c3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911126, "uuid": "14b114d5-2dbe-478d-a385-8bacc4e09350", "comment": "Malware payload (ConnectWise)", "value": "bcb3d247b1e07c3b1c03e4c278c46033a581bc7b61202b71120c8f6274adf30fde56bc303801922697a9e275630cd09c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911126, "uuid": "37fb6d75-5d54-4bec-8bde-dfd5a51fd61f", "value": "T108646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911126, "uuid": "ec7c83bc-73a4-4849-9203-9703a72ed56e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911126, "uuid": "2379ebe6-35c4-4569-8c5c-334f5b944219", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911126, "uuid": "6f5249fd-ed74-4365-b747-f2460388db88", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911126, "uuid": "31671e81-e995-45d5-97e6-22fa0d1ccb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911126, "uuid": "2cb240b9-ec63-49af-841a-ea67db7b4b96", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8888b2e9-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916774, "uuid": "d309bd1a-5e8c-4545-8d7c-076371714b03", "comment": "Malware payload", "value": "fd752d8c98bd923253a6897a6a589182", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916774, "uuid": "10339420-d0a5-4002-b7d4-a54d4cde0869", "comment": "Malware payload", "value": "86b6b6182e63fa54ddf0618aa0e3e431d2e34af4686b330ec2273fc3d4bd5503", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916774, "uuid": "af1d77e3-8685-4429-b3ea-d040798f8e93", "comment": "Malware payload", "value": "3a0aa466222dde40ac984e1131c1309595a56cde", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916774, "uuid": "152cefc9-8a62-4989-92c1-dd728882e022", "comment": "Malware payload", "value": "2e4d71860557daa1df9df4355c97f61ce1c90db01bf050411d9926b9ffac6d63f6952e6ed2b62436923fd68d0e6c0fd1", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916774, "uuid": "c91353e8-de65-40c8-84fe-3922f9add983", "value": "T11706BE01B3C40AA5C497EA38CB17933AC2B2BD224776C1CB5A96D30E9E77B514F79B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916774, "uuid": "b601ec53-af69-417e-bcab-d399614def46", "value": "5393cd8fbb1590123a47d6d1e70a4f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916774, "uuid": "18455019-56d0-47a8-a17e-926ef3ab213a", "value": "98304:JwhoT6u9ndPQTUivG4gUyKLgMrUc+rpa0S15XF0wayGhTjX5mMS+0qffVxMCms:JwhoT6u9ncvlgTigaU34dXbaJvlxMCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916774, "uuid": "31c3ea59-e7d6-45a9-941a-f9f645feaa78", "value": 3892224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916774, "uuid": "70b51845-29c4-4907-abb6-593165d09a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916774, "uuid": "b10b8fc5-ec2d-441f-90bb-989356490d6a", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893bba5f-35f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945122, "uuid": "097cc133-9177-4e72-a910-a6339c1d6e15", "comment": "Malware payload (Mirai)", "value": "37563f33f85336f55bb592292247fc0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945122, "uuid": "15f5b269-eace-44df-b986-c16d6fcb7a52", "comment": "Malware payload (Mirai)", "value": "873a2d51d36dc6bd9848f5ad0f16e58afd832fd35c80531dc64c768ed1671cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945122, "uuid": "1fa21ae5-3c74-4216-a214-9a543519d80d", "comment": "Malware payload (Mirai)", "value": "900a2564f839ab8c0495b44b259e4c135d5e87fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945122, "uuid": "268bf5fe-e191-4e53-983f-3d89958c8f26", "comment": "Malware payload (Mirai)", "value": "d5deb7b9941ce41b84b43f90026bd3754bb8d5c3125afdc1cd40d63562ae0c53e339b391c57b9c2e2db38445ccddfa72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945122, "uuid": "e8e3f339-bf79-4bdb-86eb-98507b4dade9", "value": "T10E042845FC518B23C9D662BBFB5E428D3B2617E9D3EA32039D255F20378A85F0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945122, "uuid": "4761543e-3a9d-4ff7-ad1d-fb125b7a87fb", "value": "3072:7Th8Q2sx971ESp72gnkaYd0GTA3ROV3/x9ex0EIZJqU6ZOt:71r2s7RESRly9TA38V3/x9VZJqpZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945122, "uuid": "1e53f245-3f53-4b02-9f40-b7900738a4eb", "value": 187320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945122, "uuid": "423c5b79-374b-4380-bf32-63e0755e9bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945122, "uuid": "475e1fec-46e0-471c-8217-c13c2d58d113", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8067e8-358f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775902611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902611, "uuid": "5023b055-8da9-4f70-8084-f62c57b956c7", "comment": "Malware payload (ConnectWise)", "value": "4739f92ad031088babe2e32002199b63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902611, "uuid": "2c8dfc27-de35-446f-98a2-51c3fb4fb19f", "comment": "Malware payload (ConnectWise)", "value": "879a8f4055f6ecb2a9970e1d401727d759cbd566d01ecfad5ec7772c3ef4603f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902611, "uuid": "e19ca02c-7bd0-4525-beb1-af18df158ebf", "comment": "Malware payload (ConnectWise)", "value": "1587039febbf0b6ee8496a232626d5bb9e02f32c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902611, "uuid": "0467c7ba-ddd2-4e42-8215-c2bf34eb47ef", "comment": "Malware payload (ConnectWise)", "value": "8945f1f43a61440ac45ea762c88eb8aa0c2f612533544c2d02c64283b1de19448a3e951d7a4a4836172fb44855789acb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902611, "uuid": "f3d0ff5d-ca40-4226-b0b2-0a156fdbde1c", "value": "T14F646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902611, "uuid": "5f266b57-83db-463c-9481-fc3ef64ce4b2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902611, "uuid": "1486f354-05a0-4ec9-b41d-c5a445570b6a", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775902611, "uuid": "212a00c0-b9f0-4872-aa65-8b242eccb21c", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775902611, "uuid": "ed0861b5-e764-4265-8273-b518de131107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902611, "uuid": "a3e7501b-ba07-4199-87d5-1400fc862a54", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54a9776-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911695, "uuid": "89bd2488-3530-4a86-88cd-eccf17f9b330", "comment": "Malware payload (Mirai)", "value": "2de89606bc6b6ee895f0679f185fb5c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911695, "uuid": "6201a00a-3b49-4e7d-9711-d8c47335efb5", "comment": "Malware payload (Mirai)", "value": "87bbfae179406433bf189d5401284f8a67593480f16823d1c78d8fd580187843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911695, "uuid": "0c802622-07b2-44e0-be66-68c341d73690", "comment": "Malware payload (Mirai)", "value": "b155ad58dbb1b15c37210afa7e630aff29f53a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911695, "uuid": "3e8fda7e-95c2-4e9a-87be-87a1519750a2", "comment": "Malware payload (Mirai)", "value": "f1a3990addad6cf0bce4b897b772a495cd84c422f373e47ede4cb783ebe7e71594ad081892f48975850e5f16fc5a68f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911695, "uuid": "0bed4eb5-194b-4d40-b935-ead6892933c7", "value": "T1E4D2E0BA870A45ABCC1CA1B85FA55B842C714F93F571BC2F7585CA8B530192C7C8ABC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911695, "uuid": "efe1b268-867b-4e28-96b8-89e8719bf00b", "value": "768:94ylAtv6pqmHAdy6acZX0hbzS43ne9WJgGlzDpbuR1J3:GMB4Lp0hbHlVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911695, "uuid": "b08da4fd-da16-4cd4-a572-3fdddb2822ab", "value": 28892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911695, "uuid": "d362a1d3-dabb-4438-b67f-380a9e4ab71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911695, "uuid": "a3a35be4-616d-4887-9a49-cb30c6890604", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65056913-3578-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775892663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892663, "uuid": "66f964ac-1024-4895-bd97-ab8f0fc76727", "comment": "Malware payload", "value": "cf2d0b4a46decde5c37d5f9ac2abc526", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892663, "uuid": "d74072c3-874d-4000-8a70-44b5efed4231", "comment": "Malware payload", "value": "8b03fdf1f0bd8fb8e88ec08d13f0b223519a9770b8aa745fac327d433bb942a0", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892663, "uuid": "34111855-3556-4416-9c65-a01ad3850998", "comment": "Malware payload", "value": "5e7781ca7d09b40e5ceed6e1f6d2ca5ac3d8fa68", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892663, "uuid": "501f5246-32bd-4e26-ba61-251f3cc9aa27", "comment": "Malware payload", "value": "9bef4987576f75b5e70d77fa136b98ac3eaf29c3cc24da408af5040098b4430a5b5325d7fa169be041933fae21d51c88", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892663, "uuid": "42850eb6-2924-4b23-b1d1-b1969402a41e", "value": "T19AD3FECB499E88ECCB1F7428851F5C93D65F9513091ECAA0BAEDFE443F12D6534AA8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892663, "uuid": "b5d4ce3b-1a1f-4a4d-9b31-00991bf5dc78", "value": "1536:MbWy9yN5RPcpqFFSm+cqyOfcxjHHb7K0jW+qn:NjFsyOfcxjnb7RjW+qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775892663, "uuid": "4774a925-ead2-4021-8ad1-226252e8a797", "value": 133502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775892663, "uuid": "59a9b87b-9779-4397-a2f9-d8d3667060c0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892663, "uuid": "8814e20d-7ef5-4fb3-a679-19c0e8d70253", "value": "Summary_Germany__95.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0364514-35f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946503, "uuid": "4dc17288-b6cc-401f-8fa8-b0a6c781d776", "comment": "Malware payload (Mirai)", "value": "d234e33d724620731264b9fe96111ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946503, "uuid": "020ec932-74b2-4940-aa98-6e8774aafdd1", "comment": "Malware payload (Mirai)", "value": "8bfb00aa025648f1baf72ee0328199fbdb8409a62267c8d42a6496feaa3b17ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946503, "uuid": "9db58b07-2bf4-430e-887f-5a403eaa0b44", "comment": "Malware payload (Mirai)", "value": "b09bd95cd24effcaa0c4e3270c55bf82cce423cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946503, "uuid": "811cd145-7940-4ef0-b5fd-79bfb7fc107d", "comment": "Malware payload (Mirai)", "value": "81a74ea48db813430cac442d858c30319a07116b3dfb2f018792227923ff64dd09e36b95ceb30139b19ddfd57f8fff0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946503, "uuid": "0d8963ab-9a85-4728-8b05-e69d3b802aae", "value": "T16F244C93B905DEBBF40EA77604D307217232FB6549431A32B317BDB5AA3A3D4242AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946503, "uuid": "e6fc2570-2eb0-4588-8c86-d990553a7829", "value": "6144:D5JBwUW3WjyLJyIlRhxTgj7L2vJSRPfY4KH+Ehh6a1A2nONsl1:DzBgxLhUnY4KH+Ehh6a1A2nONsl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946503, "uuid": "041ab02b-f346-4f66-8dbd-65410fcf40fb", "value": 227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946503, "uuid": "ed98d51a-fa03-41dc-a689-eeced4a1cd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946503, "uuid": "efafc629-a4f0-4627-8f42-586149731aea", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01d70e8-35cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775928840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928840, "uuid": "f4cd995b-4ba2-4778-bdc1-5265c67e9b7a", "comment": "Malware payload (Mirai)", "value": "f91e326e81ebb459fa5518d7577cd344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928840, "uuid": "5f50f556-c162-4dcd-81c6-bdda16a61345", "comment": "Malware payload (Mirai)", "value": "8d31441e92b735e9a664b8a0adc5f723f1b35297caec4f0d41aa6d12eb32e2ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928840, "uuid": "20438273-71a1-4644-9175-3651aaf8892e", "comment": "Malware payload (Mirai)", "value": "baf525ad0023dbe993d0e3de3e4fe40fec114b05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775928840, "uuid": "13fc3de6-f480-4357-a1a7-0102a71a111a", "comment": "Malware payload (Mirai)", "value": "0e67b62027e5f16d29a7f209a71c0b9c1dd0b2988fb1df0ece59bc87e58d8a5c822dee01b8d471f0b747d786fada7d00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928840, "uuid": "da553038-a6dd-4560-8b06-0c2bf537a7e7", "value": "T147041945FC509A13C6C252BBFB5E428D3B2617E8D3EA72039D255F24378A86F0E37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928840, "uuid": "38381759-c40b-48a7-a251-340b4bce3b53", "value": "3072:40XtWTe3Db+Gu2gr96awR/lL747LlqDj46/UN4VGUr:4OgT+H+Gohg/h747RqDj4sUN2GUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775928840, "uuid": "b549bf6a-7325-4a18-9e8b-a839094df001", "value": 175008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775928840, "uuid": "68fb3a87-c3e2-4895-b1cd-0e521a5d4847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775928840, "uuid": "baa1a2cd-251e-42f7-b8e9-4cc167a25f7a", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae60d129-3577-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775892356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892356, "uuid": "edfb409f-6c8e-448c-9e88-52ecf43708ef", "comment": "Malware payload", "value": "7b0e540e27bcae73420a3e2beebe1560", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892356, "uuid": "7555a6c6-80e8-4245-a1bd-0131e91e3b65", "comment": "Malware payload", "value": "8e3f7307deb54940e8bec734cd1760f9cfbe07d1f1bc33135cbaaa4959de43f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892356, "uuid": "9b38e8d1-6469-443c-b1a3-c9ea77fdbb06", "comment": "Malware payload", "value": "beb628d40932084e63e730b81657c2dc270d713b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892356, "uuid": "873de7e6-99a5-430b-8b75-f5c059ffb6da", "comment": "Malware payload", "value": "501635574a67695f39aec31dcc97ec443e0ed8bc2e7e78980060abd99989786b825715ce7489e3311a58b484f66428eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892356, "uuid": "3537d1a5-1096-44ee-8908-7997de908e91", "value": "T1E273F703E2E410FCE1C9D23893AB9A36DD72B8C955346A5E27443A122BF3E507B1E635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892356, "uuid": "729b92fd-d1dc-4656-aea2-5df0bde2499e", "value": "1536:Iu0jU4Vjj04erdbOdsXy+Tg7zh8ASlTbLxY:X0jU+04erdb3Xyoq8AS5bLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775892356, "uuid": "ac4d14f0-e415-4bee-bb05-6346c3b55add", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775892356, "uuid": "df9ec799-5c37-4684-b4cb-549652e5f3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892356, "uuid": "488d6567-452c-4c63-ba30-68b4c026bfb8", "value": "Kharon_https_443.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dcedd6-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888102, "uuid": "1b4d6e6b-89bb-4ade-8c4e-46dbb4a55bff", "comment": "Malware payload (Mirai)", "value": "52129c56a0290cfb45aa89ddc1f2eb45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888102, "uuid": "25b729cb-a8a0-45f8-b03a-c32b6bd3074f", "comment": "Malware payload (Mirai)", "value": "8e450350920a77a4433f09a433a610156e85193fb1776ae4c62d016ec62b0779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888102, "uuid": "afbe2a6a-4b20-44de-afa1-c8719e855591", "comment": "Malware payload (Mirai)", "value": "e3d1c8f341478355ff56277ae98b9f2f2b2af542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888102, "uuid": "8ba8b659-12fb-41fa-889b-2584c826578d", "comment": "Malware payload (Mirai)", "value": "b13fd0d9546e5b90d1e31ce61bb1e854c4b6ca97f28e7b1c7bb2b6989633e56bddaeff5bbf31ed3a818939064899af13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888102, "uuid": "ce329b23-5e95-453d-81fc-7b39a2699c13", "value": "T1F95301B1E2236948C5103E3EE9B4874032493B73BAFD7A72B7994654D8531CAF6883D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888102, "uuid": "2ea74e04-3a5b-4ac8-ad99-dc282eb47bb2", "value": "1536:tbNmSv81yIBPQJm+W/Nxu/25JC0L2LG4QkqGHdpxz:VNm9TBPKtONxU2XCxLqkqG9pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888102, "uuid": "cff68fd7-9855-46af-bc51-bbdffe9b3065", "value": 62604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888102, "uuid": "ba612180-0565-4fd8-8c9a-bad514b60302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888102, "uuid": "20fbbbb6-6c08-49d6-8522-3f09aee40703", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3eeea9-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911732, "uuid": "b26098ab-b77c-4aa4-b332-c9c1e871926e", "comment": "Malware payload (Mirai)", "value": "3449db12e0f0698a76f8469e2eaedf74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911732, "uuid": "d246ce94-2529-4220-a72f-c677ae864e35", "comment": "Malware payload (Mirai)", "value": "8f512a427ec19fdcec1cefd2616d9e3f29aedd7ab24e7fe1dba8465ee1695f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911732, "uuid": "feffddbf-e503-4f4c-9364-f1c71e41e65c", "comment": "Malware payload (Mirai)", "value": "623e4eeac427e059a07a4ceddc0ababf24b077a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911732, "uuid": "93743b7e-459e-4537-9691-5be1df2bde1c", "comment": "Malware payload (Mirai)", "value": "b473273ec8e3d6fca5cb873335f171ee4aa5df4b040680c218a3644244105aa7b8af3375d6369e7f9ea1af65cc05c488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911732, "uuid": "0e30454d-987d-4356-8f6f-9e1eab2cb561", "value": "T176E32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911732, "uuid": "782d1c01-8000-4546-9209-313d91a722a5", "value": "3072:XIfgBeOdIRs/E3jDwF/fXEdaDGtmLFadinpMX/kctM/9pkNkdlQ/kP:YfgBeOdIRs/E3jiUQGtmLFeiSX/k6M/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911732, "uuid": "2522de7f-9863-4138-8c6e-11866209f8cd", "value": 143861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911732, "uuid": "4bea7297-a710-4a80-9902-d86839fc1f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911732, "uuid": "d3ba8467-1747-4900-8a66-827704e7dc09", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f1b415-358d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775901675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901675, "uuid": "c3f38234-2643-4746-a1ad-65783bf1b121", "comment": "Malware payload", "value": "f48c52eb33fde22617f7221b2185b9df", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901675, "uuid": "6aff0dfc-6b8d-4d9d-8473-3be7e6b87b9e", "comment": "Malware payload", "value": "8f721a5c91ab2fb2e27f20e22f3e587184b916a2fb7c19e5e29de9690be63b65", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901675, "uuid": "54cea760-3cd3-44fa-81eb-4a18dfc764c8", "comment": "Malware payload", "value": "39261590ab4619faed56bb44769624b7199f6d4b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901675, "uuid": "bd838783-825b-48d6-a437-efe98ee9368c", "comment": "Malware payload", "value": "a8ebd0fb60f6194c3aeef3c9872cfaeb303bbf70f3f79921b3effb04d8aa71e4b18e9d28a204515a572eabea7cec13be", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901675, "uuid": "ea344240-eacc-4f40-9f6d-bd818dd08f20", "value": "T13E844BA6AE8001FAE62EE138C4A77319E7377C3927E28F8F51D96D152F732544E29340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901675, "uuid": "1dd06412-d6e0-4b76-89f2-ae021c45d848", "value": "10dd6864f54dce0b385834998bbc5c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901675, "uuid": "c044a1f5-9c71-47aa-9761-53f0fac64a24", "value": "6144:47bs7PkjxWGthQErIYg+nX7O28q2ijYdVEIQa:47bqPkdJIYgaX7O2X2sY/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901675, "uuid": "517d1415-b4e1-4459-985b-b1f09725f4f6", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901675, "uuid": "a56d6694-6753-41cd-9c8d-c0025817f3e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901675, "uuid": "9ebed9cd-e235-4320-9fd5-16fb207b0839", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1fa2e-3598-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775906611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906611, "uuid": "8bda64aa-0f29-448b-a7a4-102722ed2878", "comment": "Malware payload", "value": "059509110e3775c7798b14a431b53e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906611, "uuid": "826b17ee-3758-4889-81c3-0ab67c2d83f9", "comment": "Malware payload", "value": "90614262df107e781c812e79b3778fa7c676b9a2e4716db75966471e92b6d640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906611, "uuid": "90208eb1-8a71-4479-968a-472055fa5314", "comment": "Malware payload", "value": "6ca27727861a926f1c8d30c15538c3d2269f4014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906611, "uuid": "1587ddd9-bdf4-41ba-8205-152e3b7cbb90", "comment": "Malware payload", "value": "df7a93e4c87330ff2d4ae0f60ee1b7d16be798f303aebeef8fdafe2e3fd3789551106650939db82ca2b9fbba2e9da1b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906611, "uuid": "e1f8bff8-4c04-4f5e-9cd3-ebc8572e863b", "value": "T131878B0773E60095E9B7D1388AA74503D773B8639731CADF329D06551FABAE09A3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906611, "uuid": "d379eddb-8de2-4c97-895a-8a0547a0abb7", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906611, "uuid": "84a6a743-f406-4599-bea4-5ad826cb912a", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfD:fMguj8Q4VfvKqFTrYHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906611, "uuid": "ff51a07a-8898-434f-8e91-0af38f583cbb", "value": 38599647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906611, "uuid": "7ac04e8c-cef6-45f4-8d29-4fbda013c736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906611, "uuid": "429bdf21-c68f-4865-af11-7a0c0df6460a", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd554d5-35d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775930826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775930826, "uuid": "cb131b35-50f8-4d2d-8891-c613992df7e5", "comment": "Malware payload", "value": "806e3f5f1c576f65b763031624322d55", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775930826, "uuid": "42a184ab-422a-4fd3-9983-15217a393c39", "comment": "Malware payload", "value": "9154b59c4f1c1f113a7774c4657fddee268bef7dd6573fe3cdcd284afa857552", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775930826, "uuid": "02f5dc38-da23-4120-b427-7bad04c2eb23", "comment": "Malware payload", "value": "d59476c7e80b9053aeb1170615c240fe5c35ada3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775930826, "uuid": "ea4a692d-3ccd-46c5-b2d5-74348ca792b3", "comment": "Malware payload", "value": "b7e6e8508300139794e789059c07d84ae5c95916632d88e7a78a9c33730fc16c977f06ec3d83044a293c0d86ea47f09c", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775930826, "uuid": "81884160-e43c-4d88-b95b-74fa66d7e36f", "value": "T102363781BA92D5B3FC91F2F9442A0A4EF3259476B700D75334AFC0A92F4B6B09E615DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775930826, "uuid": "b7c0f47e-add4-4f51-9d22-4511f9354249", "value": "38da35ee8c1d3ecd0eea38e8e732d889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775930826, "uuid": "7c824f3e-395b-48df-9f30-be4e6f65c1e9", "value": "98304:BC7JOmSMDaAyZQOhQ/wOOlq+lp6KgfTLn:4SMDaAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775930826, "uuid": "7394f95e-dd08-4679-a6af-df2d40f80dcd", "value": 5255168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775930826, "uuid": "02dd3f79-bff5-400a-911c-d797eaaaf39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775930826, "uuid": "b07a8b59-07e6-45ff-90be-465ceed324a2", "value": "gerador.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a497e7-35f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775948248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948248, "uuid": "38815980-a6e0-4606-b1e8-2cc933ccf447", "comment": "Malware payload (Mirai)", "value": "b8f882dee172e459828f5ce9110064ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948248, "uuid": "fab74806-2be7-4e91-8b6e-d5a314e37828", "comment": "Malware payload (Mirai)", "value": "964ccca68a7be3418236d543a1a0ebeaf64f307b01242b37bd068179283605f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948248, "uuid": "53432e71-b77f-4135-b075-d52121033e4e", "comment": "Malware payload (Mirai)", "value": "cc564ac6fb23ce83947cbb58a6226d4eb06f2b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948248, "uuid": "9f070ebd-b9c3-4158-9694-98f4dddcab9f", "comment": "Malware payload (Mirai)", "value": "8f71cdcfd2810f3644642b3860c3249eeb8f36cd228bed6c93f7fb31a3b9901e25f3bbc465647c5b7f0f2217581eff38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948248, "uuid": "6953e708-b427-4329-9875-e10c1eee3e16", "value": "T186543A46FA418F13C4C627B9F69F424533339BA4D3E7B30699286BB43B8779E0E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948248, "uuid": "59b826fe-578c-418c-9cb9-8ecbaa063785", "value": "6144:tiF2baIEdVT1b+rN2/aY5UH2cGbbAIOnV+M7/rxlTNSBqGEaV/GiSSumru23ac4V:tiIbardhcN2/aYK2cGbbAtVr/rxz4/ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948248, "uuid": "bc66d4bf-084f-4fb4-92a0-81cc18d2fca1", "value": 279387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948248, "uuid": "652be9e9-4103-4f07-b0d9-759a3b23ff99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948248, "uuid": "70d29b1a-bfc3-4b21-9302-1fea2c88e56b", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a821f1d9-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939161, "uuid": "36322a2c-0241-4d42-8e75-4f256fa0f6ab", "comment": "Malware payload", "value": "b758e1797418cd8bee346345bee017c6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939161, "uuid": "386e3f93-b572-484c-ad44-b09a6efdf651", "comment": "Malware payload", "value": "971d3d0caab68f9e419916989676fef121264cd589d254270dce59dceebb41f6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939161, "uuid": "b5a0fdad-9778-45dc-8a87-1ee3f77ac0da", "comment": "Malware payload", "value": "686c7a1710f243bdccc4e4e41e26db06420d7ad7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939161, "uuid": "3ce12bfe-0089-4fa1-a80c-ba24e148f9c9", "comment": "Malware payload", "value": "f6d9972dafed8fb82a7c0fa8abb0615c85eae25886dc76fb85f4fa1e55040d6e56aea043f8441bcecf217ad0bc002893", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939161, "uuid": "c3505039-f220-413b-8e39-2aeab412ec07", "value": "T1BAE022E88F55FF26C0700536C12BF32A0F1BB91A6A41B2E200E0A4D1EC711893E36266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939161, "uuid": "c63b4136-af79-436a-8e60-cf3b36f63b9e", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWXIVhFyC6w5fJWXobTHGPebRJ:4xtJCUOblw7BJYXHpQtXIVTdbQebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939161, "uuid": "2ee6365e-2232-465f-9c86-31b2a38af75e", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939161, "uuid": "4f537046-7840-4152-80bb-1cb40e64ad83", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939161, "uuid": "8b08c3cc-3ecc-434c-ba6e-fc3972918774", "value": "form_99131.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5fe387-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775900998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900998, "uuid": "6f157f07-1c9b-4175-803e-aafc1d769e99", "comment": "Malware payload (Mirai)", "value": "1a8a550c12a7979259caf5807c48d19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900998, "uuid": "2ad68006-3465-466b-bc14-ada997c2f4dc", "comment": "Malware payload (Mirai)", "value": "974908931f93cfe7d743be2d42c2cc944c8454dd50cc0c13255085be2da7d147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900998, "uuid": "7ab2555d-801f-4db1-bddc-8ff27824a4d1", "comment": "Malware payload (Mirai)", "value": "cdfdbf424654fcd945c036d0400d6492e147b91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900998, "uuid": "0455bb04-34d4-43f4-b7ec-ecf3d160fb4e", "comment": "Malware payload (Mirai)", "value": "83b8d6b8611eabcf697c55e8dd1fb31e895e6f352e0d5b6e3fab91aa8766c893b6aeea9be81ea459a644091db2199133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900998, "uuid": "0b39e73e-f46c-4f6d-9c24-da12875279d9", "value": "T102D37BB3D8356F98C295C4B4B0349F785B23969182872FBA26A7C3B54053DCDF509BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900998, "uuid": "cb404b72-f934-4c28-bb70-46779f1d4b0b", "value": "3072:uWnWOCXHMLzX4iA8I5EEaOo7jrWF+Xzis:uW70H2zjA8IKEej6Fyzis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900998, "uuid": "af4acdec-a57e-40c2-a1c8-7c5e092979c3", "value": 137824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900998, "uuid": "e351d934-4ac5-4a8b-bd84-a5fc88a329f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900998, "uuid": "21a08409-42e1-47bb-9525-8cda3fa869ba", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54625b12-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "67b1e60b-000c-40af-a99f-b6cbabbb2f23", "comment": "Malware payload (Mirai)", "value": "74bc64749320aec191fb63947d22eaae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "f1a40270-5112-4531-b908-1bec07c8a97b", "comment": "Malware payload (Mirai)", "value": "98caf242aacb958df3757e671697c9a04bfc2590264afa370d0523e11171bb37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "819b926a-1300-474a-b598-63cc9a9867be", "comment": "Malware payload (Mirai)", "value": "0a872ab4384346bf87c36e1d23c29c02f4953b64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896500, "uuid": "8716dbb9-07ed-4302-ae8a-dcb2f218ff11", "comment": "Malware payload (Mirai)", "value": "70a7f7b01b2592ef06a266ca724f0ea6451df58f5c9a085a5868c2190655d718eb7b4e0a3c4443388b4dd94c2e7e2c0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "73e47b8a-821b-45dc-93ea-8768b00b06b6", "value": "T1B0C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "5e668f83-2de7-485e-aa4e-f308d8ef04c4", "value": "1536:6wB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dBJ:6iB4exMF7oZKJnCNYa7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896500, "uuid": "24669083-90a9-40ea-8c8b-3e782337c679", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896500, "uuid": "a684bdca-4209-4b14-900b-f587238acb26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896500, "uuid": "e561c36f-d059-44bf-b3b5-044277f3c0d0", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e100139a-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888146, "uuid": "724dfb7a-1450-4231-a623-86fad3866e45", "comment": "Malware payload (Mirai)", "value": "e7835e34ca66598c8af8e50c74273938", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888146, "uuid": "be12aa96-3038-48c5-b097-f6252883900c", "comment": "Malware payload (Mirai)", "value": "991e9b05a960df84a7710e9b949cb20e077d5ebe1db04993966785b8bea04e7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888146, "uuid": "6685b2de-6e7f-43f1-8451-a9c0cf7f1f79", "comment": "Malware payload (Mirai)", "value": "bd6f7d41711b43afe0fa2c54cba1824f4d067e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888146, "uuid": "05a9fe81-cbd9-4941-afca-582ad675b556", "comment": "Malware payload (Mirai)", "value": "8ad3a2adaf1f6e81833105ae34c271ae4042c67ca1578fc57051ae7d9b845e80fcf22443fbf187b6e79c87667041b6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888146, "uuid": "6e418a31-3c5d-4d84-a7eb-615f60495aa0", "value": "T1D7E31A46F8819B12D5C512BAFE0E124E37231B78E2DE73025D24AF71778A9BB0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888146, "uuid": "a76ee440-459d-47e2-b3a2-7f957639d589", "value": "3072:dePyauCJwyWXeTCmTWtbq05FchvaOogc8uzU:oyauCJmXQWtT5FchvadauzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888146, "uuid": "4aea5082-3b0a-4594-bd24-e62eb1379783", "value": 150172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888146, "uuid": "fa8b8293-0ebc-42a3-b7bf-a18b4aba9ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888146, "uuid": "31964d5a-c495-4792-a446-a800a2e4bcfa", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba847b83-353f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775868325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868325, "uuid": "129bd15a-6501-4669-9948-d57adb58a35e", "comment": "Malware payload", "value": "724c02695ee4ac0bcb499e135a385f9c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868325, "uuid": "a494e887-f145-477b-a4d3-a33236098b67", "comment": "Malware payload", "value": "99afe99af3286c0aeddfaf8aa77423615e9c016770756338f62fa883e996c5b5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868325, "uuid": "f1937503-ca09-43f3-b969-02423a1963ed", "comment": "Malware payload", "value": "90d52237da5c5d00fd1151847ea46221bd0dc2ab", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868325, "uuid": "e9dc3e1e-d2af-4e42-8ba6-c9622a7c4f4a", "comment": "Malware payload", "value": "c4cded718507dc8b9dfcc09c9ea30265001080607678ae267aa2fa8f454af67e962e6b3e64a90e8805ad14c8396cd463", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868325, "uuid": "338534af-d26b-4fb3-8d79-5bfbd38f426f", "value": "T1802623A55921F0A9C071052778889E20C382D9B59544BF70518B17B63FFDBEA2FFA60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868325, "uuid": "c9f47b06-c15e-441d-8636-523a36f4696b", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868325, "uuid": "b0bd262d-d1de-49be-82c9-63402d213ad3", "value": "98304:3inLSRdTYpxPMF7diQKUoj7L7e5pliSqw0tJ9QfYW9JI+TNB+SF1Om9Zvj:8SRtutMF8iKL7e5qSN0l0YII+TNr1OmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775868325, "uuid": "3c8c8c9d-09c2-4c82-a719-b9e36248d8b5", "value": 4504576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775868325, "uuid": "f1cd0f71-6302-465d-b8a5-628d5e186808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868325, "uuid": "4b1f1244-73d9-4932-96e7-3e7d471cd195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d453c6c9-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901010, "uuid": "e20a90ac-e7c6-48d9-a56f-49d4d0b7f293", "comment": "Malware payload (Mirai)", "value": "347d585059183d0c837e838bbd4d7131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901010, "uuid": "877b1e39-3270-491e-bdc9-129519f5a515", "comment": "Malware payload (Mirai)", "value": "9a57af7ece0f977eb5b1f10e440e4551cffcd208c29cb8b7f5b75f31856a184f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901010, "uuid": "a29d9b64-62ed-4d0c-a3ff-790c8c993fbc", "comment": "Malware payload (Mirai)", "value": "c8969f9ab6ac6c98c5d8c980c580464b46f7e91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901010, "uuid": "a9562e91-3dab-42ef-8795-7c60a4273b34", "comment": "Malware payload (Mirai)", "value": "b717863ffc4e8521d565f128ed999cb539a40dab645baf8a1dc89ecc76c7073563ae59bba12fb912cbffbc1349b6cda1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901010, "uuid": "e609043f-af0a-412f-8b19-73ad76c96fc4", "value": "T1CEE32945F8518F13C6C622BBFB5E428D3B2A57A8D3EE72039D251F21378795B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901010, "uuid": "8410ceff-e9e9-42ad-8e8e-423c4a092f2d", "value": "3072:nBdiyE5V2+MRGYBN/4KVjBBszxGE4qj65xg:nBdiyE5gRpb/4KRsz8vw65xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901010, "uuid": "133f2d26-1233-4670-b58a-dbff9f1ac68a", "value": 154176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901010, "uuid": "fbbd15c0-e893-4154-b37a-85354ea02edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901010, "uuid": "021b2aad-329d-43cb-8322-098d209df2ac", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de440121-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888142, "uuid": "166a982f-a1e3-4dfb-a245-b4599cce680c", "comment": "Malware payload (Mirai)", "value": "c8f92a0c66005ea97e67e9ecbb5bdf40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888142, "uuid": "36d8436d-485f-4894-b486-2c7031505cd5", "comment": "Malware payload (Mirai)", "value": "9b0eb285ec0b8d4c2c4383cd09aebfeb4cefabad2d093c44e60273c002e54635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888142, "uuid": "f1b5b957-31ce-45ca-b231-d52da0c79666", "comment": "Malware payload (Mirai)", "value": "f8d5d4d13970c7261a9e49ee8c8710df34f134f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888142, "uuid": "635870db-0e70-49b3-9331-a8a1a8047807", "comment": "Malware payload (Mirai)", "value": "d9e90ab88f6efdc2f5c9fe7b57074f0fbf629a18f1487c72b74105e18eb18a22860f501b903c10cdb257aeafbf8fb69a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888142, "uuid": "f2610c6c-588e-4750-8e58-54df055cc543", "value": "T1CFA33A85FA83C1F2E81704746066BB3FCB32CD954036CA49DB9A6E35DA37842C71A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888142, "uuid": "5f39c425-66e3-4035-8dab-ffa899a5170b", "value": "1536:Cfa586Kxfbru/xvWWlW2bq3O7pd7H1hyWSA9W+obEt1i4:SaW9fb6ZeOfq3O7p/QvAI7gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888142, "uuid": "e11651fb-c18c-4699-aac0-90ae7f21bc5e", "value": 104648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888142, "uuid": "56fbbd93-74d7-4ea4-bc45-05e7beea9a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888142, "uuid": "e2054e2a-00c0-4cb3-be08-8a46bc11cc42", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6801ae-35c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775927577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927577, "uuid": "62573d9d-b7a1-4d12-965e-6cd88d82aa42", "comment": "Malware payload (Mirai)", "value": "3192a04be35cd7cf455c5b2e371c594d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927577, "uuid": "ad2f7a98-de91-4b73-b5c1-b5671744cedc", "comment": "Malware payload (Mirai)", "value": "9bb2730b71470149ed0bab3bda8ed31f17ce8fbf1972cb71edb8774d3b7b9b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927577, "uuid": "3daa7cc9-6be1-4c02-9c16-920931e96f35", "comment": "Malware payload (Mirai)", "value": "2f66025209955160c650f0bf0063257ee0358373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927577, "uuid": "d6d45030-71f3-48bb-b937-94e008960e3d", "comment": "Malware payload (Mirai)", "value": "00a3254f3fffa6ba8306e6e65c89a64975f874515282e55df5185b7469f35fbb557d73bce82f246ccd529023d9b026a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927577, "uuid": "47702eea-662b-4a09-98f8-ca0f98d81c19", "value": "T139146DD7F900DDBEF80BE73B44574906B130B7E214521B377267796BAC3A0951827E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927577, "uuid": "c896743e-8fa6-4e2e-b965-e8d3b0d56d70", "value": "3072:WzqEm3zHhWLBcLsvwf+J5Y4nz7vw1pZsQQIIyBJn+qVFjbiILZqYtYyxCjAd+:yCjHk+wvRvw1peQ3/n+4LZQyxIAd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775927577, "uuid": "6a5d3686-8284-4eb6-beae-4737efd74739", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775927577, "uuid": "1e779de5-ea4d-4ff3-accd-b9bfc82fc80f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927577, "uuid": "75a35e9d-eb1d-48b8-8975-76356ec038bc", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2d7984-35f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945449, "uuid": "55f68f0e-0417-4579-b2c6-4b4b4d83eeab", "comment": "Malware payload (Mirai)", "value": "9d6804b97182eb1f7583ed658c67b9d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945449, "uuid": "a8c3d2ba-5550-4ca2-958b-b61359629703", "comment": "Malware payload (Mirai)", "value": "9bcb073abb53f738eb0d7972ddb2c4113907deed40c3823687ef59078de3ed00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945449, "uuid": "34f34e36-be3e-4f51-a76c-410bd1901f2c", "comment": "Malware payload (Mirai)", "value": "088c46a1f0e563fbd8d2b3e508430f3e2d56f9bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945449, "uuid": "61c3839a-f9a6-40d9-8809-b9fa091b38a3", "comment": "Malware payload (Mirai)", "value": "3046bbb0d1f927999a35baebcfbf66da6699c439d0e73b091810b562450ea2437022f59b45c2b69518aba3603aeccaf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945449, "uuid": "8d0b1f13-6cde-44fe-8322-653f9a93e1a1", "value": "T1D1144A13A8A55F97C096AFF662B38A740753E8150B571FBBB62AEDF40603DCCB409364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945449, "uuid": "bec822c7-7399-4431-89ce-a22f6ba0cfd5", "value": "3072:PRXC60YnHBJqUQJn9ubKR3tWofe/oT7R4vw6D44+rhhxz1AMhONflN:PRNpHBJqlJ9FYqpT9N6D44+rhhxz1AMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945449, "uuid": "3e1e01d1-4377-484b-aa44-903ef5c8b5d0", "value": 191977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945449, "uuid": "05578aa4-143f-4563-a470-ad0c1c2a6ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945449, "uuid": "4c499aec-65f5-425e-8e74-8f8f42ecde44", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebba0f5-355a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1775879714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775879714, "uuid": "47651f32-5a83-4e48-a958-e82c7ab7414b", "comment": "Malware payload (RedLineStealer)", "value": "0429e093135f1a8ae7b625fdbed6e062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775879714, "uuid": "7a6b2844-5e7a-474f-9582-54846c250ca0", "comment": "Malware payload (RedLineStealer)", "value": "9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775879714, "uuid": "d8e0d1ed-2c7e-47b7-9750-e07e86c41c3a", "comment": "Malware payload (RedLineStealer)", "value": "4f2c037aedb250361a0bb41b95e47be2dfdc3c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775879714, "uuid": "5bad6208-5d41-4e47-a9a7-00ddae7421fc", "comment": "Malware payload (RedLineStealer)", "value": "1acbc8030378ee5206be64ef8bd51296f2772dc32cde053649b1b7fc90d4144564e7801d9904b739ac5c22a1343f9c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775879714, "uuid": "46ee90e4-096c-4152-9525-8adf778fd639", "value": "T1FB15F144B2E8DF02D4A65BF48C71F3B003F51DAD6421E3068EEABDEB7838751585968B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775879714, "uuid": "52c0f837-2353-40cd-98fb-253cc3baf906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775879714, "uuid": "2e72bb53-b4bc-4eb2-8bc6-d74bc6a33c5e", "value": "24576:ror+2emolYrmrbuRjBc0XMM/0uVYJR7/gmt:r+0TbG60XJ0a6R7/gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775879714, "uuid": "219a13b2-36b7-44f0-80a0-a4e26d634a18", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775879714, "uuid": "7e6922d8-1511-45fd-9273-22498ad74ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775879714, "uuid": "65a9ade5-d780-42fd-ae65-407a9fd88488", "value": "0429e093135f1a8ae7b625fdbed6e062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83e05c4-3595-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775905258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905258, "uuid": "76abdf5d-4b06-43c2-8c9c-8ccb69e6df52", "comment": "Malware payload (DCRat)", "value": "10e32a706efcea06d3983ec753fe765e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905258, "uuid": "829627a7-e815-4399-919b-a1a54d25f78d", "comment": "Malware payload (DCRat)", "value": "9dd8f8fa41fb24f9525b2f6d6def5c95c316ee6654b23a83a963d889fcb5d323", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905258, "uuid": "3b8fbcce-d970-420b-834d-0a2f2dfab473", "comment": "Malware payload (DCRat)", "value": "c798be13db2d3843c04a5c312b89246c7deda1a1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775905258, "uuid": "f87da95a-9507-4348-937d-6d60bf3287b8", "comment": "Malware payload (DCRat)", "value": "7c826268033249c86b3c46dfe86cfff766b19293ed98b7a8789dadf90e7364c03b9584268d74152564cf830613be5866", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905258, "uuid": "e25b48dc-9ba9-4ac5-8d23-4823544ae9fe", "value": "T15C4539017E44CE11F0196633C2EF494887B499516BA6F32B7DBA37AE65123A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905258, "uuid": "8816f4d1-d7c3-4df6-8f99-389e56a00cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905258, "uuid": "c084119e-e8c9-4c1d-ac95-3141a30d04e9", "value": "24576:M9R7ds7G3kGYiKIJVhpeUZ2cb+iLxqtKDBpmljv:eR7domKmHlJLotKdgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775905258, "uuid": "e9ae451b-6e9d-4357-aaf5-7e4ea178f091", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775905258, "uuid": "59bd7141-854d-408a-99d7-782574172d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775905258, "uuid": "5bfacbe1-43a7-423c-8d41-f629ee16aa23", "value": "10e32a706efcea06d3983ec753fe765e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb7a4bb-3593-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775904384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904384, "uuid": "6f8c2e54-4096-4c39-b73e-6248b1b92806", "comment": "Malware payload (RustyStealer)", "value": "8af9175266cfdd09b7128f18ff0c57b1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904384, "uuid": "a94f610e-7e2d-4d04-8889-8aa553a83265", "comment": "Malware payload (RustyStealer)", "value": "9e714ba3e2f8fe053550bb0234fc7e3fa64ce41e601bff83f0f47822245312fc", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904384, "uuid": "461bc256-4cad-40e2-976d-ac1f68a51889", "comment": "Malware payload (RustyStealer)", "value": "ccf05e5b514c30c9ae71d4e59e8b6949f686983f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904384, "uuid": "1f458113-be27-440d-b853-a91bed60ab68", "comment": "Malware payload (RustyStealer)", "value": "e038b5cecb523439419acc08e2c8c5972a988da172a7871e1ec73f9746dcaea38201459c69c615969a6d0db236f7851b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904384, "uuid": "4c546d5b-3b44-4fb8-ac4b-27eee70794cb", "value": "T170051227BA9494FDD415C0B8838542B29A727CCB4B2169FF06E821743F19EF62F3C655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904384, "uuid": "7591ac27-9f34-420f-a50a-15817daf1cc2", "value": "4d8256b7d2af5574544ad03e0b3ef087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904384, "uuid": "956f49f3-3d21-4d75-9c1f-4c347eba5c9b", "value": "24576:URaKJofgZq2dKrml4F1bF/B8JmWS9eEydq:URXJqClKF/B85we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904384, "uuid": "53a2f721-6056-44e6-b29c-3d4877df16b9", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904384, "uuid": "9966712e-6bc8-470f-82d2-d0131d164274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904384, "uuid": "af1c0070-034b-4fb5-ad7d-a03dbf11d653", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03e817f-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775917243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917243, "uuid": "91839116-d544-4364-8134-42395c361afa", "comment": "Malware payload", "value": "aa5cec3ae751276336059bd56ccbf310", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917243, "uuid": "c52130db-aade-4c3b-9210-53fa452db3c8", "comment": "Malware payload", "value": "a050da85bf79761096f7f8680bd5c6608d23989d52da06e58f8a593969b87777", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917243, "uuid": "5ae417a3-2748-4704-9c3a-eec832c11cf2", "comment": "Malware payload", "value": "32886fbead11d95aacdae8163bc33a8e689c141d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917243, "uuid": "ba512f1d-eb16-4583-825b-6e16541bbc5c", "comment": "Malware payload", "value": "763fb9e7f83e78a148fd65edbee7ac91964b31db4890b19c9df2cffa60ca979b0e4f7c080ff6c5bbd5c10aef6a907138", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917243, "uuid": "6d0c1f66-a283-429e-a857-1efdf12ea320", "value": "T16D517589F0282C747B698FB9BA679741E1C8805D5C0EB51CE0DA5CE1B45D280336DFB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917243, "uuid": "442d1150-0c68-4189-bd67-c8a5d4126098", "value": "48:GC6XR/VxNt8yR7ONp8ZaiX3fEuHFz4/zL6eCKADjE9hUcI5Sw8WOcg:bSR/Nt8y1ONp8ZHPEuHF0/KeCvPEs2cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917243, "uuid": "ffffda17-445a-48b1-bc3d-64cacdd0dfbd", "value": 2986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917243, "uuid": "848f39a5-a37a-4e0b-af22-f863f75f563d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917243, "uuid": "4e61a464-70e0-45ee-824f-2e6cb42891a5", "value": "z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc7a3ba-35f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775944194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775944194, "uuid": "bd4a9488-e52e-48c1-aad2-41f929d706a8", "comment": "Malware payload (Mirai)", "value": "7a576b8ee88db15bb10be465d1b608d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775944194, "uuid": "6abffbfd-783d-45fe-8975-9cb504aabda6", "comment": "Malware payload (Mirai)", "value": "a0b8e360dacef8f07ad5376f24c32db347dbac14b9b9b0c94c9b43d478686edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775944194, "uuid": "282a329c-7f95-4e07-a79a-e437ff981d0d", "comment": "Malware payload (Mirai)", "value": "75f37484235b30572f17edcd02fdf7c5203ead61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775944194, "uuid": "da492335-318e-466d-a0af-77b3642d10c8", "comment": "Malware payload (Mirai)", "value": "28bcf13d4179a8653a2e07a0aa9343a214b514453497b019156f68faf9cc7e32c0d777941b4e4105961ebdcc0723cb48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775944194, "uuid": "c499a501-f5c7-4387-bec0-fe9d1e8a83a6", "value": "T16544F8066F910FF7C8AFDF3702EB0A11248DE41727A62B367638E978B60A54E55D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775944194, "uuid": "52d69351-70c4-46c1-a000-5acad1191306", "value": "6144:i2Rkz0w51LV9kpBw3AOgmsK6yB1hWF5NqohWUkzn7MwA0:im60wvVip0gyB1hWF5NqohWUkzn7MwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775944194, "uuid": "72a409d7-229b-4a5e-9c7c-564d12f31ceb", "value": 261444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775944194, "uuid": "e8adc0f0-ca08-484c-a48d-4f6d4f3529bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775944194, "uuid": "fc6ffc77-ba1b-4045-970c-70729798ff57", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9da2b4f-3594-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775904912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904912, "uuid": "9a2e3757-9fd4-4a15-8dbe-3b2a0321a7a4", "comment": "Malware payload (Mirai)", "value": "7dcb92493c99cc8955834bf46fe5c6e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904912, "uuid": "8e30f830-6649-478c-8ee6-41551ded6d5e", "comment": "Malware payload (Mirai)", "value": "a163ce2ad547eb3f45f00a9cf6aee4730babd8e998ca41c7c62ee3807d4c9963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904912, "uuid": "cdf528ca-f832-4ccd-abf3-557d88f07b78", "comment": "Malware payload (Mirai)", "value": "397ef487d6031a7a33c9db048204c52f542dc9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904912, "uuid": "1852e264-5fbc-43f9-8634-5537342e0273", "comment": "Malware payload (Mirai)", "value": "d7693c7364a04188932114ebb1d57081a541f73629d81cadac74d45269e18cd6153a0035f0273fa055dc3fe8b501afd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904912, "uuid": "0d2e4fdd-f977-4bb9-830c-b656ab7b9f3c", "value": "T1A7930948F64390F5DD070D30605BFA3FDB30AA61D631EE6AEF44AA51ED33912641AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904912, "uuid": "1ef8f874-88ef-42b0-b6b6-8efb02a66dc5", "value": "1536:exYOHGyg5xSzzs+qVCozBNCF0a3mxGjf5nbyrzSnNZQ8UJ31kHdTBYQ2AMOIr:XOHPgt3NQ02mebEeN4yxRMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904912, "uuid": "4b7ec9f8-7427-4df2-94fa-4f4ec55293cf", "value": 95128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904912, "uuid": "a482ef30-5088-408e-9a22-0bbd8aabbc81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904912, "uuid": "d04174ce-f4eb-4565-919c-75c7b4f64f52", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f971e94-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931738, "uuid": "d645761b-1553-4aa5-85db-e24ddc196c32", "comment": "Malware payload (Kaiji)", "value": "0df954759bd65fe0c260820c257a084c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931738, "uuid": "8db01a52-fa82-492f-88d6-cb9ec0c87dfc", "comment": "Malware payload (Kaiji)", "value": "a2ce4bfd8411324b10576d228b04cb8036e61b998ae9162e6f81ab65cf7416bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931738, "uuid": "e88cd2ff-5cf1-4f0e-a2e0-1611f560e54e", "comment": "Malware payload (Kaiji)", "value": "3c287e6495d7cb75304f0c43506d4d9124f444e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931738, "uuid": "fa3a365c-8a35-4710-b241-b277a8846335", "comment": "Malware payload (Kaiji)", "value": "f97d0d96aac2fe970c2c92b9981186f962110a0ab1ec8df3622cd00387e1354540d02e91de1b9e8b17c57e5bff220ca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931738, "uuid": "53c21fb2-6dd0-4cd0-8bdd-974c33db8a47", "value": "T166952847B89156A9C0AAE234CA664252B761BC991F3163D73F10B3F82F33BD45E39358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931738, "uuid": "c13737dc-f2db-42d4-97ed-ecb60b29d7f4", "value": "49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38J4B+g2vUqHOErz1:tPXZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931738, "uuid": "a61087dd-23d5-49fa-8502-70824553f4f9", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931738, "uuid": "ad65f568-981a-4fde-ab9c-82550a76fe87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931738, "uuid": "5b73182d-8591-42d8-ac5f-e349d95a52a2", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0694fada-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910973, "uuid": "4ca57b73-2c98-49eb-9a6c-28388cf65616", "comment": "Malware payload", "value": "f5ea76cef9e7589ef807a3c3df7a7f49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910973, "uuid": "49faafad-bd98-4d0c-9d24-594c41ef4ec0", "comment": "Malware payload", "value": "a3b97c95eb07e51588c6009112021739679f6c96c02ee5fa0154800e271c58dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910973, "uuid": "6ba9c63f-da47-433e-a696-6916ab6582ea", "comment": "Malware payload", "value": "e287f9c852c6175ccd8f0df44b47fb0cfaf9d5e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910973, "uuid": "bb001da0-9dd3-4e06-bce4-b7c7b13c9b13", "comment": "Malware payload", "value": "4dfa1b3decfaf2b96057e3276bafa5c22eae503b662b4c2e5615dd7a5aee06f72e02f7be1556b6c434e6461359050b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910973, "uuid": "6ad0b108-6555-4851-ba96-58944f4dbf6f", "value": "T1383412EDF4445FA2D6D5173DFABD40883363832893E9710A9E115E383B5BA018E3B996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910973, "uuid": "bae8ba32-8ddf-4c11-9c6c-12621cc89c97", "value": "6144:m9lCt54OknftqM5ofV9vMfIzjz/E63lLVi2+PjtJSmjUe6oU:0luWff8M5ofV9vMf8zcgL8pPj6mQpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910973, "uuid": "6cef1910-2feb-47c2-8cd8-936668ae23de", "value": 251184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910973, "uuid": "b3faa3a8-7342-449d-8a41-34cabf95ebcc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910973, "uuid": "c78d1ba3-2300-4d18-8b8e-b9554aa29a51", "value": "9sf2t3505q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d3a31b-35c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775926373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926373, "uuid": "148c2ab3-d998-4b04-b3fe-ceab70a989dd", "comment": "Malware payload (Mirai)", "value": "b43e9e264eefcfd1fddbb45e6dceb578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926373, "uuid": "66407a68-de39-442a-add1-8d9d177cb586", "comment": "Malware payload (Mirai)", "value": "a42563b839b97321eb5c54828242d4f499deb4b49cb57e58463fda859d31322b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926373, "uuid": "9220e016-a3df-40b1-92bc-e26ebdfdda80", "comment": "Malware payload (Mirai)", "value": "d4e5c6a7982bd98c9209a23b506695a6fb804e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926373, "uuid": "60f9d966-2842-48dc-84a0-1af9df02aa26", "comment": "Malware payload (Mirai)", "value": "508eda2e3d61f01dd5a801d46f719b0e83f606b1c28ac312e0addb5c39f4333836629dc1412765414d6a8a811f2f6693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926373, "uuid": "596c9617-9fd1-4dce-921d-6628ad24f1b3", "value": "T19034961E6E228F7DF7A8C73447B74E249B5823D627E1D684D1ACD2105E6024E681FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926373, "uuid": "c03d4648-4ce5-45ed-a744-936f530f093a", "value": "3072:dliUY+qxLztvP+qtKK6935Vcy6XXQUlgjuyjCb93y1QIKmpis:jU+izEqtKK69phsg6vb94QI9pis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775926373, "uuid": "1a383a8b-348b-48f2-a427-6c30e90d7947", "value": 231692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775926373, "uuid": "0679cdb7-e3b0-4ba6-b559-a2af89a1b06a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926373, "uuid": "b4da1660-9547-4b13-b8c5-2645ff50d478", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431bfe64-35d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775931261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931261, "uuid": "050f8a54-3cbf-4a18-9bca-2bdfb7334b11", "comment": "Malware payload", "value": "a7f8b4feca18ee3926a7c17bcfb4d3c6", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agent", "colour": "#4AEB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931261, "uuid": "3310525b-f063-4456-bf19-75c61f3128e9", "comment": "Malware payload", "value": "a46b201cff1ac3871d66c2451a7b23269fc33941b15745ad458a0156d6d7e2c9", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agent", "colour": "#4AEB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931261, "uuid": "53dd11c5-87c0-49cf-af0d-c6dbd485235b", "comment": "Malware payload", "value": "ec519e26e56e22eff9e7b2d87169aea85a21a7d7", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agent", "colour": "#4AEB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931261, "uuid": "afc28682-1cef-4cc3-bfa1-a3c20fdeb5a5", "comment": "Malware payload", "value": "260869534e159a6708ddc19d5af60b0dc493e864b479e225629253871d8d3bd27f9cf383004b0c9c0010746f17e672e7", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Agent", "colour": "#4AEB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931261, "uuid": "21e5fe1d-58f7-4cdb-83a8-e10c1ed26cb1", "value": "T14774E30762DC3CEAD8369278AB7783C5D72EFC5542A0D62F02E042969E3F153792A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931261, "uuid": "f2e1d186-2adb-43ad-a727-80ae42c662e8", "value": "2b1dc46b252499ecb6425fa447f9ab1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931261, "uuid": "9619898f-78c7-4a38-84f6-b716414fb0dc", "value": "6144:bfwGWW3k2UoAtwayT1ypSlH7iHFMHeoho+s:boGWW01oA2a8H7ilDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931261, "uuid": "95a41abd-8f54-43ef-bace-ea5e5d4cf700", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931261, "uuid": "30058f5d-fff9-44b7-8683-49882d0a814d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931261, "uuid": "13bd9fb3-b6f9-45a2-821c-b1321b75b2a7", "value": "\u6296\u97f3\u63d0\u53f7\u5668q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1aafc4-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917267, "uuid": "edab9c48-671c-4faa-9ff6-a0a561c0c67f", "comment": "Malware payload (Gafgyt)", "value": "f66e43fc61981e58bf646819d573b3ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917267, "uuid": "5474b7ef-a608-43e7-bbd0-2ee3c6d75b6c", "comment": "Malware payload (Gafgyt)", "value": "a4a849e0ca34e464e936d241eba13e5857b87fc20db919bd68806aa4a8ed5144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917267, "uuid": "5dd31e46-639f-48b1-9cd5-e9d787e8fe2a", "comment": "Malware payload (Gafgyt)", "value": "97e21de0ce13c41604dbb7ffeb5ad12547b59a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917267, "uuid": "86c1e252-55e5-413d-9f62-71c18a31f09c", "comment": "Malware payload (Gafgyt)", "value": "2ba56058b58b5dc1d67338e3e70ad54cf9d78238e7ae936a007bff6796238848089c5517af080676e763f7981c618eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917267, "uuid": "51ce9b0f-2a2d-4674-b266-3c713ea0ce86", "value": "T18B8312F395DA5BFDC3459D322755BE442C2A38003F662EA231855A3490F11E6FAD8EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917267, "uuid": "31dee941-a1e3-4790-8988-99f96b4a6a82", "value": "1536:Ke1GvN8gvSjXi1iaBq6gKOYQkCQtYrC0YywRI5Fr3+keScxPIr8hNnL:fEFknu3JIa0CYFjim83nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917267, "uuid": "cec26dee-a2df-4ef6-bedf-a1b3e21fbb85", "value": 88508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917267, "uuid": "2eff4e63-7cf9-426c-a85c-49ca4c9b5a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917267, "uuid": "d15883fd-245f-4771-afec-61b21b2374e5", "value": "redis-initd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0268b2-35d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1775934042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934042, "uuid": "7801f5ed-3d10-49e1-bd7b-1266b6e74987", "comment": "Malware payload (Blackmoon)", "value": "45841e22722864de7017d65f944384d8", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934042, "uuid": "c4969452-0f00-4265-8048-5faa43aed3bf", "comment": "Malware payload (Blackmoon)", "value": "a4b98f96d11162d515dd7426a1a43f6ed2c67a3d4c3b6832ebc36be3826efddb", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934042, "uuid": "8b8d9c1b-6881-41d1-a61c-f4ec77f741bf", "comment": "Malware payload (Blackmoon)", "value": "afa20c98d5a2ed844dc0dd8ebda080fb02dd88b7", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775934042, "uuid": "41788ad8-8b65-4664-8b3f-950acaea53e5", "comment": "Malware payload (Blackmoon)", "value": "44b7f2adcbece706a9b365e22c9259037812d5c45a487697f96ac92f4900e667246b1b5bf2986ac61073d52880173af8", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934042, "uuid": "98f6dbd4-56cd-46f2-9a52-75ef59d3786e", "value": "T1B335AE14784DE623D23D0231A5D088EAF4A8D1E9AB9090F3738BD53F975A6E2913F15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934042, "uuid": "9b76bf85-03c5-4760-a2d0-e825ba8984b8", "value": "616155c4f123b125853046ac8a5f0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934042, "uuid": "03ef913a-e69e-4384-b35b-1fcc81bc575d", "value": "12288:wz45KcybNHMY+xt2y4Fp/NEammePHHONxSzDrk+u73DlYefkoMlX692OJ1vl1pH5:I45KfNHXTOuNxSzXZuTDOro42TPdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775934042, "uuid": "4e7cffe8-25d4-401a-b197-c06c0bde9f3f", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775934042, "uuid": "72e30d78-bd55-4bcc-b800-d542779e3355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775934042, "uuid": "474c4cfa-1314-48be-8fe2-46a767fdaa25", "value": "\u98ce\u8292\u4f1a\u6240\u6469\u65b0\u8336\u7167\u7247\u6311\u9009\u4e0a\u95e8\u4ef7\u683c\u88682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e7aae1-3598-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775906413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906413, "uuid": "67f1da86-a25d-46b6-a072-4da0a98e51cf", "comment": "Malware payload", "value": "2cc835399634d1f8f50e465201bfd877", "object_relation": "md5", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906413, "uuid": "9b2e0a5d-9306-44b0-8a1d-b06f9020bc29", "comment": "Malware payload", "value": "a5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4", "object_relation": "sha256", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906413, "uuid": "a093b2d4-3ea6-4137-9926-1c44803088f1", "comment": "Malware payload", "value": "4cad3e674682d3d70cc875977f23d71f41ceb55e", "object_relation": "sha1", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906413, "uuid": "72f64257-701b-4c80-b710-30f4fd5b6aae", "comment": "Malware payload", "value": "59717de63f8838c85dcb12be9d3eee28317e5af3efe7793776157d7fd3add284256e58eb9acf4bbcfd892646101c1f0b", "object_relation": "sha3-384", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906413, "uuid": "ce79024a-f093-4c28-b612-79441c14f88f", "value": "T1FD924BD9493850C6DDABA83182EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906413, "uuid": "b2ff332d-c376-49f2-8351-86391a39d95b", "value": "47c3554d0dee53d4f925ed52484bea12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906413, "uuid": "afff9978-c427-4e79-892e-b568c9bad88a", "value": "192:0Np/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:0N85rVXcLr7GBJ1ah3yqvDyR9za/io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906413, "uuid": "8d1c406a-71ac-4c15-b773-bd4a8149725b", "value": 19672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906413, "uuid": "853138fb-9ba9-48ef-b7ef-5f4a347baa97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906413, "uuid": "9929da31-38f1-44bb-802f-82601d49f4ee", "value": "PoisonX.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb46666-358e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775902289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902289, "uuid": "cca9adf5-872a-4e11-9db4-6fabd4e5ed57", "comment": "Malware payload", "value": "5294f25631d20b68ebf3a9acd4cc1f5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902289, "uuid": "f293155f-5d0b-49b8-af8c-b259a97be8f3", "comment": "Malware payload", "value": "a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902289, "uuid": "e71d49fe-0372-4bc2-9996-8aeb807e6347", "comment": "Malware payload", "value": "4026e7113258a4ee50991da4aff21c061e779563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775902289, "uuid": "f2c3d8a6-3a47-4188-b9ce-71553566a93d", "comment": "Malware payload", "value": "c4d11ed925d72324061485ff34abb9fa950d8ae9c353a23d5f5033cb1265916c0eb6b0390e2da8d3e53ccdad790af8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902289, "uuid": "9c5d4130-3b27-4b3f-98d3-769ae701e6de", "value": "T19E06331581EA41EC80D88DFC9D152EF38F55EDF028FB0484A9F7E69208F79D29792987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902289, "uuid": "f586d2b6-36e9-45d4-8757-cd0be6cf6927", "value": "98304:zenAd0WS0Zelbevq7hwc8UthyhjeomOwsb3Pu:zenAd0W5ZwUJxhBwMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775902289, "uuid": "aca7cc38-5945-4ff4-a618-13b5985c5d41", "value": 3716336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775902289, "uuid": "382317fe-de11-4458-a82b-9120a5b7d735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775902289, "uuid": "b01d4e19-a4fc-4ddd-8d20-eab5b85f7990", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e831306-35d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775933910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933910, "uuid": "4d798c4a-4524-41ae-8d56-945271895b12", "comment": "Malware payload", "value": "cde7c6c5c307034cf66bb22f595a7308", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933910, "uuid": "833e249f-bd61-4932-b69b-be4acb5db054", "comment": "Malware payload", "value": "a5b4236c1cb73f74e699be14378ca9c623055cc7bccfe24bbcf20c5554c2435b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933910, "uuid": "7abb4b96-3a61-41fb-ae36-a1b217d65df3", "comment": "Malware payload", "value": "5438b5dd6ab76278ab71270fd69e11bdc61c1c73", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775933910, "uuid": "948319e0-6632-4d40-a865-cd6a1b665738", "comment": "Malware payload", "value": "774eef6102bd3f55cf2d3c3920de12188f7e7d19fac2c0901fd127325e5120c8a8e37ed33fcf5bce9e9608c8fe43439a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933910, "uuid": "52b0fe9d-e338-4159-b6ae-e0fca1642e4f", "value": "T13F512A2EED0079B0C54305784AA90D0D667E634180D21FCA642D2E81AD9F3AE1BF6B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933910, "uuid": "3440d8d0-2af4-40fa-b178-354fd3e7db0e", "value": "48:9ahJjGDLBQ2xT6Nu3xxPxgyd87gRotZU7VSiQSEVkc3z:YKpQ2hFhxjdutZSSTVkc3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775933910, "uuid": "c2689ac8-fb4f-4ef8-b7ef-bd89ec8c0607", "value": 2498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775933910, "uuid": "375fa172-9e00-4fcf-a94b-75bfc35871a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775933910, "uuid": "87c89793-3d86-43b3-80c3-6d3372e27a3b", "value": "photo-771444503.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4956bd01-35c3-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1775924829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924829, "uuid": "19f6e485-3975-4a0e-b5a3-d6bd496d5eda", "comment": "Malware payload (WallStealer)", "value": "55b8d276d83e26f5ae00ffd2ec4d120f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924829, "uuid": "66bf5d0b-6eea-4d4f-b24e-06aae3fc244e", "comment": "Malware payload (WallStealer)", "value": "a61a712091bac8a431c78a3fa827b25b123bc4f64542a68167178b0f665b7687", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924829, "uuid": "1f6e5451-9d64-40f3-990f-3f97bb4df79f", "comment": "Malware payload (WallStealer)", "value": "4fb40ff07c39329de2eaabe6d2f880bf3eefc7bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775924829, "uuid": "000f6196-946c-487c-bf94-ffdf28a67e7f", "comment": "Malware payload (WallStealer)", "value": "a161291b202d972bbb88ddf249d666867497202145c30d204e48cb70a27d3cdd98afb56923bc97a5547a21d058427ae6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924829, "uuid": "aa487a76-7600-40d9-8b7e-0f9a929bc5dd", "value": "T1B136E102E2964ADEC46BC0F8C5112E67F4BE78310B18AB377AD84B646B52B3057FD746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924829, "uuid": "1a344216-1abe-4040-b365-d63f9d0aa413", "value": "c05cf134dc19034ad65ea00a44098560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924829, "uuid": "eecaec81-bc00-4a87-8675-ecae8dfb8a3a", "value": "49152:KLl7vZMSM0VmI2z24jI00zIv53v+TK+Opx+qXOlWn4l2lhZ71p5zcF8qea6LF0fN:YGTJOll2ZfcFgnmfJsJY+tN9mOuWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775924829, "uuid": "330e640b-6296-4283-aebc-985ac42163d4", "value": 5271056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775924829, "uuid": "b2f4fc35-c87a-4ef5-abc8-a11379ff7b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775924829, "uuid": "17b9188e-6a67-4e54-b903-e04b4028c7eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb78fd8-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911686, "uuid": "5acfa7d6-ff5e-432f-a9b8-da5d1630b5b6", "comment": "Malware payload (Mirai)", "value": "455d378eb89bca2a4b7a63898a9d40af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911686, "uuid": "3b2345fb-c7d5-424a-a957-2af87074811c", "comment": "Malware payload (Mirai)", "value": "a637860195f34a4840613826376d9e6962590ef7fa328f6dd4822eda3edf3305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911686, "uuid": "714cf5d7-fd2c-486e-9e61-827f9cbfd510", "comment": "Malware payload (Mirai)", "value": "dd225ffc487aa31cee6a4ae6756db13d6af3e117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911686, "uuid": "92920fa7-679b-4671-b94d-4ad4f68951f8", "comment": "Malware payload (Mirai)", "value": "0f96fb3cedf6727a0e184582d504a267bcc5eee1759ae7d4d3dd52c4a59b74385278782821de2f7f087a6e66d6bcab15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911686, "uuid": "19771aa0-c730-460e-9961-8f6da722e932", "value": "T159C2C0E5D0263D9AEEBB5F605E8B56D277AA9B0EF723CED171589F41007744B32402C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911686, "uuid": "d87cdc99-9efe-4392-a6c9-721b4a04da01", "value": "768:LG959yM0HW6d0ZAEHVeq1IGofo9MQ4uVcqgw09S0I:TM0HHynHVeqhNMQ4u+qgw09S0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911686, "uuid": "2cb4fc16-1660-40e4-b580-dbfd83cec112", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911686, "uuid": "6e624a93-be21-416d-9a97-f4f701bf23a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911686, "uuid": "a4cdb8c2-4b9e-41f7-8378-af760cf1d462", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc46dbb-35f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945452, "uuid": "1560fc11-2d9f-46bd-af59-9f72d1b465d0", "comment": "Malware payload (Mirai)", "value": "0461a143cf4393c76b203156c8ebeec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945452, "uuid": "fd79cef1-399e-4225-9052-f1f83d6eb7ba", "comment": "Malware payload (Mirai)", "value": "ab8698d92fdd39b087cab09295c9c31715ea02d27d1da5ccaa6a4606bdfbc11d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945452, "uuid": "a084b7dc-bef9-429b-9519-13fdfff039b0", "comment": "Malware payload (Mirai)", "value": "036c44e5188fffde37bafbc769260105016c4c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945452, "uuid": "6ad9fe52-df5d-4f2f-ab40-4e3ef5056828", "comment": "Malware payload (Mirai)", "value": "5875305ffad64cccd5acc9ae86d963f4aa2b0020ee192aa7b46dd680612be0ecdb1400732bd3ce953ac60979fe8cdd84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945452, "uuid": "2d686c27-ad43-442a-a39c-b0d7487b0424", "value": "T17BD31818F647E0F5DD0B0D70205BF67FCB305A518935EE99EF94AE25ED33A12600AB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945452, "uuid": "e7a99f61-45f4-442e-9141-b7df6c4fbc57", "value": "3072:TLHnPyJI2rwJfmCpOvR5joCVjVZgO2BCNdG:HyJLwBmAOvRjr7gCNdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945452, "uuid": "61082f16-f6a9-4a45-abbf-a954b64c48b0", "value": 136220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945452, "uuid": "ffed2915-39b0-4323-b472-bf6ab35580c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945452, "uuid": "3b31e234-9267-4575-aa47-067f50031e57", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3605339b-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775896449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896449, "uuid": "ec9f8da6-5515-4ebe-82fc-a3d05f9c46f6", "comment": "Malware payload (QuasarRAT)", "value": "f93111d85996a519240294264521bcb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896449, "uuid": "e0aa7ddc-717c-452d-adac-1eff9bbef7ce", "comment": "Malware payload (QuasarRAT)", "value": "abba492096dc11f66969609fd9fd12775f41c2117d1e9011d02ddcac11e9bbfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896449, "uuid": "99f4274d-f1a7-4c5b-8936-84536cc6276d", "comment": "Malware payload (QuasarRAT)", "value": "6f81914075508ba0a457465555f61feeae316543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896449, "uuid": "de5f6ddb-f61c-4dc5-81c6-6fdf1dd0bbc5", "comment": "Malware payload (QuasarRAT)", "value": "378b4e58001600fb37e07e62e966d6a85901589de59fb6db7c7307e2047dda3400367f1fc32eacf4d13490fde6cc4c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896449, "uuid": "989b7711-2d25-4356-8807-cee444aac78b", "value": "T1E4B5335237C1CB71DA389339E0E7033263E7852366B7D3590989C6C90E52AD8FED6D89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896449, "uuid": "c8f1e55a-9af5-4c42-a7d6-e382b93e8f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896449, "uuid": "1230cff1-5648-4d06-ae5a-216055fcb4bc", "value": "49152:w+hp/PuDKv5vz6sma+tcUF7N+HOHPCgP92Z16Z9d7LRULk084UDUT:lFe45vzp+Gw2OHPCgFG6Z9d7LRUYGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896449, "uuid": "5fee5e84-c20a-4f94-bb35-5edfe32369dc", "value": 2337728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896449, "uuid": "4f3887e2-c2b1-440a-8682-7d98f4dba690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896449, "uuid": "793a4b19-4c0f-4f56-99c3-213f2cebbc93", "value": "abba492096dc11f66969609fd9fd12775f41c2117d1e9011d02ddcac11e9bbfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9201fd-35e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775940891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940891, "uuid": "33afc9a9-0bda-4e8d-b871-f0b129553dca", "comment": "Malware payload", "value": "1ecb17992d564060744b9dd86a2a8c66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940891, "uuid": "daf97c8b-5298-4a63-8475-8494d25445f6", "comment": "Malware payload", "value": "abe539b40cdc77ccde78a5da70514db62206d571d58aca7717bbeb2dbc2c0bb9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940891, "uuid": "0da07316-80f1-4181-8ef4-878d50fb0203", "comment": "Malware payload", "value": "6fc3ccc5712f4c3f51f740443a79bb6499f51dce", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775940891, "uuid": "51f61bd7-8260-469d-a73e-6278ae7b3a0f", "comment": "Malware payload", "value": "63ee881b9b81067d7583e580e9d71e98b938b1c55fc6a7aac73619b4220291ea0f2395d0f180e53661f2a5081abef843", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940891, "uuid": "a5985bf0-cdf7-4107-b725-5edd59fe7110", "value": "T1ACF2E0155C881599E9046375B8B25E80990276CFEDC27D4973C9BAF83B011C48AFAFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940891, "uuid": "ea52a492-be55-45d6-b099-afafd9e81942", "value": "768:iZwOJ1GXMuhbTb+6WBVI9u8xGyfy6cuP1mAL+KfunZpLtI:iZj1EMmbT7PGqp9mAChnFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775940891, "uuid": "fbbf5934-c2b1-47d6-8edf-5c0f90d3badb", "value": 36905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775940891, "uuid": "4062977c-880b-4041-ba70-5f78cef1adb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775940891, "uuid": "225afa4d-7666-46b3-bbac-1c18f1205691", "value": "Dienstangebot_Radakovits_D_08-04-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58215548-358c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901231, "uuid": "fa899120-75ee-4cdd-9693-0ff71d59dd92", "comment": "Malware payload (Mirai)", "value": "9fb94ca98d54a53195e7546d9b6978b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901231, "uuid": "14d929cc-73e5-4947-97f8-00081043b88d", "comment": "Malware payload (Mirai)", "value": "abec5f80d1676d11578388af5d6ce58613271b5bf44f15afcaeacc5c4277ecff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901231, "uuid": "b653eb28-5baa-4224-901c-2b8ac5b696d8", "comment": "Malware payload (Mirai)", "value": "bd522dbeb58c636ba80bc15133bbb8acc2baeedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901231, "uuid": "0ec4e1e4-672b-4d3a-b77f-bf1df1f7da16", "comment": "Malware payload (Mirai)", "value": "27e029f66d8f5eeddccc024cd940499e0ee06bb13084c748991ca2ab5b99312fd693cf89ac531e43a9347738ef589053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901231, "uuid": "2bb3ff7d-fb40-448d-994a-3c7d1c894f0d", "value": "T16A14861E2E228F7DF7B8863547B74E20976D23D627E1D684D1ACD2111F6024E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901231, "uuid": "2ab6e5b7-37c3-4381-a0bf-28a4af933e18", "value": "3072:7GAjNnOH7skcHDSt45nsb6YbiHNlMw1ny0j9Z1eFhvXpy1bzyE:1nm+DSt45n86YIMKn15Z0FtpGzyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901231, "uuid": "85fe8549-9af6-46bd-8a60-10df08655c41", "value": 202420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901231, "uuid": "917a85d6-5125-41d3-83b1-5e30cf15349c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901231, "uuid": "effc39d8-ad8c-4ed6-97c4-ddd8053dd769", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da76558-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931735, "uuid": "85728c62-68a5-4854-babf-2e1a811761ab", "comment": "Malware payload (Kaiji)", "value": "1bdf48addfdc484b06ce224565adc7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931735, "uuid": "f14c3bbe-e5d8-44e2-b024-5014fab06056", "comment": "Malware payload (Kaiji)", "value": "ac5461d68abb723a2f5c8f5aca99c32e40d24a87fe788127800f734a4474d1f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931735, "uuid": "ac712a81-0a5d-4d3a-9c25-3fa830cd34be", "comment": "Malware payload (Kaiji)", "value": "308c359e077a79ee64a4c8c651da2f215129ba87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931735, "uuid": "8f2c3508-12fc-49f4-9caf-e42113e91cd4", "comment": "Malware payload (Kaiji)", "value": "45bcaaecb39f2a0630cacbe297a1c34e2bb012ea18a9954c57d3f2a7f747d658c0bc6415c775bedb1ca5b45b752a876b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931735, "uuid": "db035ee7-a7c2-4e50-8de6-11498a16e346", "value": "T12AA50857B8918582C4E42677ACBE81C833635EB99B8653266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931735, "uuid": "cc277b4a-fb4c-431d-9d7f-2c9ada14a23a", "value": "24576:gNwGGRggwEGpD5IaZIJzIDgliOAMUh1Rskiq1zpQHCaRU7axVL0rKEk3dVh/cviW:VrcNoLf3z82T16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931735, "uuid": "b551dae0-a085-4a84-b364-266a9439cc54", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931735, "uuid": "3845d0e4-1563-487b-9a8b-04c57fc88b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931735, "uuid": "eff40ea2-3748-4708-8c26-ce3e132eb65e", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc29916-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910981, "uuid": "8a7b3038-9e04-4df0-9292-0964709c9361", "comment": "Malware payload", "value": "db7f38118bd0a8e55524c8624f038102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910981, "uuid": "9f57787e-d6eb-4e13-bc8c-158745e60784", "comment": "Malware payload", "value": "ac740c8217966493091cc64df41660b2a82fee11d335ebe7dd4394a5ce267d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910981, "uuid": "5ab384c2-db0c-43d4-937f-6513b2eb814c", "comment": "Malware payload", "value": "56e5c5038e99a090237ebec513556e52a29c5ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910981, "uuid": "1525cf37-ec30-43ab-b6f5-9d57ce5e6d14", "comment": "Malware payload", "value": "1a954272215541874cdd019d6cd98626085f97243940df66e688b327828e50e2eca3b9ed1531076c93366139bb798973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910981, "uuid": "debf4b22-1cb0-409f-9105-aa3cce587700", "value": "T154440221F4908F62CAD2A57EFB1E124937974378D2E97314AE294E2437F2A074E35D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910981, "uuid": "e2ebee3f-a2e5-40c2-8ea0-759bc4468be4", "value": "6144:Sw5Qbb4+dscgKvj8hkuHnhOy+TagmjBuqRdwYfgr:z5SE0d8hVH8a20S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910981, "uuid": "d61e7a7d-66df-49ce-8c23-1543341a6ed2", "value": 253851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910981, "uuid": "fe3b6649-50f5-44b4-9e86-de5c8d8c926a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910981, "uuid": "cf24ccbf-9050-4473-925b-eeeedfeedafe", "value": "tztuz83uk4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79ab0d7-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911672, "uuid": "218cbe54-70a9-478f-a420-4b7fb4d7589e", "comment": "Malware payload (Mirai)", "value": "c70538c57e0c16098a5a0822f6ae6cf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911672, "uuid": "1cec654b-4983-4942-9e00-ca5c08d565f0", "comment": "Malware payload (Mirai)", "value": "afa1c938cf3d9cde029093d97f672de86e73c0c850a907be87c9a6978d5f0388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911672, "uuid": "ec1ad5a1-a30d-44d9-8319-b93a3d05f647", "comment": "Malware payload (Mirai)", "value": "65ab1f2019322331b18de5e379833caa94713862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911672, "uuid": "b1b237a1-51d0-4676-b077-0d5340c72760", "comment": "Malware payload (Mirai)", "value": "2253300d5f8489c21ea2b9d28e9e8e9df85369aec788aa91c4aff1589b072493ce9bd7f93206f0733f3e8cacae10ddd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911672, "uuid": "9b28104b-7821-43c7-8b14-52cc0ef252dd", "value": "T14CB2D014D982A4A0C37044B9BDBEC0D677AB86B0E0EEBA31552C435EE08AD4F46F65C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911672, "uuid": "7dd87630-9639-4376-a7bf-7d4975ea7013", "value": "384:ojQiRuQjrI2Up+sS6zXQYMnl9AgYXF9sulwcR3duRy4BBqQwWWFIgTJI2hymdGUF:o8eUpSF/sX3sulnRt8tBqwWFzJI2s3UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911672, "uuid": "b3e2ebcc-966a-49d9-a93b-0c115328a14e", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911672, "uuid": "3ab2ce03-51fa-4872-8710-97b16c545919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911672, "uuid": "a3182d6c-7fde-4c66-82f9-9d52b6e7b361", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a96b1e-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901007, "uuid": "db3412fc-85ee-4626-aff7-9961fd672cfd", "comment": "Malware payload (Mirai)", "value": "b75c113ae59b62a2e328c46ea771b36b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901007, "uuid": "7e51b2dd-768c-4cbc-b456-f87505b453d9", "comment": "Malware payload (Mirai)", "value": "afe6a470e2ed0c22b656b759cefdcd02c67dc1e141c36ab55909edaf1696589e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901007, "uuid": "fcce5588-42d1-4ee7-88c7-d80f2c082e71", "comment": "Malware payload (Mirai)", "value": "ca4066e5a97e883d541ff264b54abf5c055e2e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901007, "uuid": "1f1193e1-36b1-43b7-b6d9-72d5b3d70651", "comment": "Malware payload (Mirai)", "value": "7c317eb99f1be9b4fdfb32ec146ab3863aea0f97e1143a9889dfe54bf493f945d02fcd95a59a55ff192dcc0b7403dfe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901007, "uuid": "81b37ca6-b01e-4187-a3fb-82cd58535345", "value": "T194B37CC5F293D5FAD84315B1206BAF329F36C5FE2026EB93D3985E329D51602C606B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901007, "uuid": "77d3c271-9a35-4555-9d3f-0a1c5546e339", "value": "3072:lfO2tYScnGcBN4XLw3GUJTeUQeHmcUjg:l22enGYbUjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901007, "uuid": "0b310877-7a38-41ea-9be8-d5b7c99c9531", "value": 109448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901007, "uuid": "799e7874-4ef0-4c0c-83b9-a52d719ac9cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901007, "uuid": "9cf4d14c-b0cf-4552-bffe-269209a35317", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ad005-3594-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775904906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904906, "uuid": "1756556e-53a0-4d6c-a35d-e705103f1d29", "comment": "Malware payload (Mirai)", "value": "4f096eac7496d66ffcd36c5e6edb4d0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904906, "uuid": "c889b978-f97c-4f96-81a7-1b039106ef5e", "comment": "Malware payload (Mirai)", "value": "afed0816185a050afb6fde1a98fe0e921be849d5c637df261bf9ba4260732f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904906, "uuid": "a3a3472a-da7b-4021-bb41-4b65ec2e1cc1", "comment": "Malware payload (Mirai)", "value": "035f7139997a34fec3c26a56178f91ff5ddc5448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904906, "uuid": "96170acc-91f1-466d-b2ac-9c318056603f", "comment": "Malware payload (Mirai)", "value": "32bf8c71a526289a8c1e42bcbfed88944e4057900998f16489a0168b2ed0258d6656c9f3b26229850b269714b37f3bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904906, "uuid": "e99cb3a7-9a86-44b1-b46a-c3ed3fe9667b", "value": "T16624C61AAFA10FFBECABDD3702E90B01298CA45722A43B757574C524F55A94F09E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904906, "uuid": "b9b19210-941e-4c03-966f-e83bce0f9d27", "value": "3072:AKBZKI2PKdrSmmnR5zMXEBJXnLeXGqwLaqdiMyqN:AKBZKI2SxSmyIEBZLdqwWqoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904906, "uuid": "6e6d4c1d-c5cf-4c99-9583-c7012add8d41", "value": 215204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904906, "uuid": "da921712-0118-45e9-8380-3e976579d601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904906, "uuid": "6f3a7d1c-f183-4ea7-8bfc-92b14d943510", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591fec6f-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "d199bf75-0bd9-4c95-846f-3a6c0ed26e9c", "comment": "Malware payload (Mirai)", "value": "3191ddd7e514b90fe427b0688f9392f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "e7757e08-8b0a-4140-b478-58eb8c73ed94", "comment": "Malware payload (Mirai)", "value": "b0fa3aa1926fb19fc629cc51f85223f18ed2405c43456fbd28e3908070b8f1c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "6cdf8e74-e9f0-4fc6-ab45-adb101d1eec2", "comment": "Malware payload (Mirai)", "value": "0dd6c9bbcc64c879692136931365c875e90de483", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "70871768-86e9-4223-8122-b01b01f83be6", "comment": "Malware payload (Mirai)", "value": "7e3862e66cd45b82ac1de68fbb8cd994fb2bee74db0048703dd4ea5b019135a549c5a1eb42d364bfc6b250e9ada9a0de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "3ec084fb-647a-474d-8759-abfdde30f017", "value": "T1F232D517A7BBAE1BC4D033770193072162E99F916024472FBD0D1C8E2E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "d2e631ad-dfab-4ec4-af3c-28b2e8e47e86", "value": "192:xvrOR1CQOsz1NxfAzQH9iG0GhWaDpU/O7Q89AGSybLqeif:xvrbCzfaQ2GwIU/kwGSMUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896508, "uuid": "d343c725-5a6f-4777-a5e0-11aad0b55d51", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896508, "uuid": "26b32ede-0a78-412b-8eee-241cfd502e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "22dd2db9-d254-4536-9c2e-170f887387df", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6770424-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917281, "uuid": "31463c1d-53e1-44fd-9910-aba0853f6682", "comment": "Malware payload (Gafgyt)", "value": "c01065f8901629c7064478b62f4c61b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917281, "uuid": "7e7138c2-706a-428e-a3d7-0bdc471a211b", "comment": "Malware payload (Gafgyt)", "value": "b1625f820372c172040f7eda2b3de1173f57efb77d09363e11c28f51d0af86fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917281, "uuid": "35e2d96a-0644-4cc9-8c95-96eae93810d8", "comment": "Malware payload (Gafgyt)", "value": "082dc939a0b2dd7c87557197e841ca6cada7f044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917281, "uuid": "e5ea320a-9ac4-4583-a87d-95702c3ab0f5", "comment": "Malware payload (Gafgyt)", "value": "4c6a0ffa9ef94c8dd98a2486f5c6f9589452a2016461821acda4d429e845473325ef469db244c6eb47b54001bea93237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917281, "uuid": "db302eab-3e1d-4468-8e7f-5d920a25cada", "value": "T164A31221E1801E0DC8A380F1CBD7DC42B556ABA2E37DD144ABB78C6C3A1D658F93DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917281, "uuid": "9eee2a1e-f0f5-4f3f-8b00-c8ada555f995", "value": "3072:jIJiog6qyN/ZrOBziYUPD4ZM3GhyMjJrX7a7fhnjz:CRzhrSiYXq3vu7QFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917281, "uuid": "dcb69a58-6b84-42b2-aa68-89ecd8c4fc73", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917281, "uuid": "bd882a90-267f-48ed-bcee-ca3ae3a69b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917281, "uuid": "67860a99-76eb-4873-b11c-e5b91354dd90", "value": "redis-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667f0fc0-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931749, "uuid": "18e88807-9bfd-4bf2-8e92-304123167753", "comment": "Malware payload (Kaiji)", "value": "c851f0819ad44f8243b41909386d0b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931749, "uuid": "ead9d922-7a10-45ee-aa78-22a61fe4b152", "comment": "Malware payload (Kaiji)", "value": "b194e7945dee7198eca61d7cd8308b1a3a66eb01e48f5221a8a713024dab06d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931749, "uuid": "e8ecb5cd-d992-42e8-a935-5b22844a946d", "comment": "Malware payload (Kaiji)", "value": "37e3e468379c46935aa4148f1177d8a0b80da42b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931749, "uuid": "5218c471-bf99-4379-bfc4-18c4de04d5a3", "comment": "Malware payload (Kaiji)", "value": "c75f7c05164b6058330c3d953a1417f29fb699de353745ee884f10793a6f02e23bb69872ce42e23677627cdf89a7e88d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931749, "uuid": "83a108bd-9b1d-457f-930c-0b6ea944457b", "value": "T133B5D615BCC42BEAC02C5F7898E6896623A45D044FF2573625A4FBE9B8762347F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931749, "uuid": "1c84e57b-3df2-4018-b34b-07bb867fb395", "value": "24576:kO+PuaNFZRml7/I1n0rOakVXFYd+lCQYWz1v:9eN0xd+lCWz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931749, "uuid": "873b619e-caef-4e79-aa01-57b0fa6f6299", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931749, "uuid": "179f8bbe-4024-4a69-9408-bdfe9a9c2969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931749, "uuid": "ede06b04-ea5c-4c5d-be21-b045ff5a1689", "value": "linux_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03e0a1-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775917263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917263, "uuid": "1e27a399-a4ed-41a5-90a3-788ff0e2b2c1", "comment": "Malware payload (Gafgyt)", "value": "0ab0e90a8251a7d7d91002379341a850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917263, "uuid": "eec7bbc7-91f5-416b-93bd-d9d85a3f0c8c", "comment": "Malware payload (Gafgyt)", "value": "b355115b688745cfef10c22f8290f294a83c49df9220422bd91b4c3894fb418f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917263, "uuid": "5d47d9a2-28da-4ab7-8ae9-7de8378d0cc9", "comment": "Malware payload (Gafgyt)", "value": "f8595043c203f9c0c008b39e74125c13a5a5f9b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917263, "uuid": "724b09c6-57f5-41ba-9870-c199c1b5c27a", "comment": "Malware payload (Gafgyt)", "value": "7b69f0497034bdf9f7546837b47ae7a5d60194e4b8e2c990adeb9911480749a2c462542c4133dbbeaa4d31f1a0c0617c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917263, "uuid": "76ed3190-1027-4a4b-bdc1-cca987c5f5b1", "value": "T171A312EAC965CF9252588076987B41B8B0813733F3C51EE7A7134FD4FA92F610B9684B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917263, "uuid": "04b06a3e-812a-4aa5-98f2-f6ddc05d5084", "value": "1536:ZQ64C7yNBBRpxSihKz1g4n2Zut/cyHCBiqsDiaHnQNU2EXuF50g9lsiNah8Ycn:0RpU2cnIHyzqQcU5kPlsiN0cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917263, "uuid": "979c0e4a-6ff9-4c10-b993-b1535344d5ef", "value": 99124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917263, "uuid": "48a886a7-7173-4e1f-9eef-2947b356c1c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917263, "uuid": "96d3b924-f41e-49c3-a3b9-6a6eedccd2a8", "value": "redis-conteinerd-shim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb3fe32-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939194, "uuid": "623db9c7-22a4-4be7-8014-8236c067151d", "comment": "Malware payload", "value": "b3ee84f41b7f82459b2c5a3c2c4b4ec5", "object_relation": "md5", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939194, "uuid": "326519d3-a9cd-4724-875d-6d4c7883c338", "comment": "Malware payload", "value": "b42a7af2bb90504067d0574abce06fc1b1becc880d17677de998f1c821fda347", "object_relation": "sha256", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939194, "uuid": "1306834e-4429-45c1-b3b0-483a244d93a3", "comment": "Malware payload", "value": "6183832e20ada540bce5b1891578529b150be2c6", "object_relation": "sha1", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939194, "uuid": "550b3d91-7d5b-4523-82e5-d964ae596e9d", "comment": "Malware payload", "value": "b9ef7e56471ccf7a111d29859e33df35c2adaf002ac5380f61682e0c1a380bee492aa9d9072231d35f17a0c952aa6870", "object_relation": "sha3-384", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939194, "uuid": "050cf7d3-f5a7-48dc-a86a-ab8e89e8bdac", "value": "T19541B5EFE4169338CE43467401AA6C9DDF12E63B65029050FA8C4D45BF109B5F3A13DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939194, "uuid": "7b0b0710-b004-43fe-b668-592a0a8370f3", "value": "48:w22kMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:AkUP4ZkS56kUf6qo8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939194, "uuid": "ab0b78f9-daeb-4960-85d3-8700cddd88c2", "value": 2275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939194, "uuid": "2a94a9aa-8698-412a-b53b-ad5989e78724", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939194, "uuid": "e0705ccf-69cf-4048-9696-5d37c673efc8", "value": "form_99131.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76a2939-35f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946112, "uuid": "3ec14bb7-4a3f-428c-8af5-764b7115a1bf", "comment": "Malware payload (Mirai)", "value": "2f6cb25cdcc9f971d55c3c3c9636b4e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946112, "uuid": "9f0490d3-d2e8-4f25-8d53-1d7920b133ac", "comment": "Malware payload (Mirai)", "value": "b43979eb9c003b246944c463827028fb7468df847abb00d26a391cd90d8e748f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946112, "uuid": "586e6897-5f06-4187-8217-d9ad46cf7048", "comment": "Malware payload (Mirai)", "value": "4d601dec4776bf3459a84c6f82f4c7fd52cb5304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946112, "uuid": "260d42f9-61b2-4cd6-8837-1ceda13c1d2c", "comment": "Malware payload (Mirai)", "value": "66f61dd21b821a16dccd5131d7c15b6866b276da2141472467689f9ae9f581d051da062492447866d5dc2abb2930c718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946112, "uuid": "15a07130-d6bb-4067-b669-47fdd64b2150", "value": "T175246CA9BA4F6D43D2C3D3F8CF9B4FA5302735F08A5690F13D11132DC4D6ADA89A1A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946112, "uuid": "13916385-ae21-4e7c-a650-278733803451", "value": "3072:T2Uz8gor6s/tDJkqiKoGRRw0NOTQ8olSxIVVYveCCmKjVuQoqMq:sgor6s1h20NOTQhlSi/EeC8puQoqMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946112, "uuid": "42295442-3d08-474c-be81-0ba9547f97a0", "value": 228056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946112, "uuid": "e26e1a6e-6d8d-4781-ad8d-3029e60dd211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946112, "uuid": "1845bbb2-a682-4758-a510-ec333f2d0ff7", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18e463f-35ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775915635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915635, "uuid": "dd753ab0-be91-4f97-9fd0-4bc776be148e", "comment": "Malware payload", "value": "b00271e14367a2f861c5654e12ffab93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Greedy", "colour": "#F302B7", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915635, "uuid": "3fb018a0-735b-461c-82cb-6d1e2d22f682", "comment": "Malware payload", "value": "b4dd2e48c211409c79c5a5d950e884f35af5b117196b8a8b33cc9f2370a413be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Greedy", "colour": "#F302B7", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915635, "uuid": "d1478e82-3286-447c-bfb7-411e5b59667c", "comment": "Malware payload", "value": "8432f2e040d57eb93644e241076632622a7ce1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Greedy", "colour": "#F302B7", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915635, "uuid": "c8e7ea36-6967-403b-8a04-13a2ed6fcce3", "comment": "Malware payload", "value": "4b9243d4e0c5648c032661cccae56f3931033e97e8b0ed14fd9c051db5860b63886f03abcf96747c51041fc5a15e2327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Greedy", "colour": "#F302B7", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915635, "uuid": "84e340b7-f40b-479e-bf08-3329c28887d8", "value": "T160D6338566C205B6E6E7F23E827AD5AA8172B9105B32D59F1FE0476A3F131F18C37780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915635, "uuid": "9fa08a5d-4a9b-4dfd-bc1c-55c0954f4609", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915635, "uuid": "8c541837-4bf8-4182-b48a-0a872f9a01dc", "value": "196608:VchsqlGN6AputbW897G9rqx7eovq5XMP6PzFcPVzzzGHskNqSPrVZRjMF9YBDuC6:JqH10Udq1B7iRzzGHskqSPxZpi9LC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775915635, "uuid": "4a4ebdf7-4f66-4435-bcd4-eb0e2b268028", "value": 13590424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775915635, "uuid": "5b542ac7-b4b3-4f22-96c4-c59881391a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915635, "uuid": "79fa7055-bea6-4775-b146-02ab0a534ca9", "value": "Extractor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57c64e1-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888100, "uuid": "c55ef485-ee54-4ae9-b39c-5d13e588d854", "comment": "Malware payload (Mirai)", "value": "c56be4ec7371a441b09102f2ac848f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888100, "uuid": "09bc1103-6220-4cd6-9dfb-ff29e082fd05", "comment": "Malware payload (Mirai)", "value": "b540656b69cd2684eb0bb0f610a255c87ba647834aad5bc00f0f8b44dcc665af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888100, "uuid": "0d273d21-5f0d-47ed-b7e7-1f3c854c49f0", "comment": "Malware payload (Mirai)", "value": "15491f963d30983ac4e4564e40fd37b5dc5da00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888100, "uuid": "4fb98a4d-bcaa-4f70-a08f-931dc74754ef", "comment": "Malware payload (Mirai)", "value": "c80af6046f532d73fff2e4d00c7b5bb617c3d59448ae04a27b0c72374b59f6db86687b1c164378b10d038042b8ce3553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888100, "uuid": "d7c50ac5-5ce5-447b-95a9-589883bf3a30", "value": "T1AB3301B135A6ACA095BC2936B9306153B1A19E15B3CD2E43514CCEF7ABC3E14BBB8D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888100, "uuid": "976bd517-c71f-4b84-9861-ed823de8ac12", "value": "768:hRgKgXaN9BfA1q9aFohHOPkooyF1XqHkb5SmJJ3WZ1EUsL0rcnR76XDs3UozO:wKc0Bl9a+tOPkooyf5SmJYfsv1zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888100, "uuid": "b6c13b3f-9d4e-4b07-91c1-6b8a4669474c", "value": 50504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888100, "uuid": "3f2646dd-215f-4c4d-8ae0-abcf5bda95af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888100, "uuid": "623199c5-b199-40ea-96a6-fcef0fb12a37", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38da67d1-35ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775942410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942410, "uuid": "01256115-1ccc-42ef-b9e6-bca4ba41b25d", "comment": "Malware payload", "value": "d6fd3360597cb2429f4b0a3c4231a44e", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942410, "uuid": "30f6174e-d350-469d-81cb-9c973449f33d", "comment": "Malware payload", "value": "b54371228b9a9657abe03b118247942d5b61370b36bbdd6027abc178b8a09e35", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942410, "uuid": "74cd71c6-c511-49ad-8185-895e41b5d03d", "comment": "Malware payload", "value": "60ac79d017cc60bf920270e1684ddcc1364a0917", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775942410, "uuid": "211a1792-fc6d-4a09-8f4d-7edd382e6b6c", "comment": "Malware payload", "value": "c571575d75f82e530877e143c0088f0e9ea7edb95d96d522b5d0ca554798aacd7b5184c9d1a709e37bdb90310cb28d08", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942410, "uuid": "373c326a-6137-467e-a14a-42470ccb824f", "value": "T17AA4B32561FB157CE5A762F0663D7310822E34ECDB6D4A2E329A214B06F4F78CAD6317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942410, "uuid": "29fd4fc1-c1f7-4ab6-bd5d-322693cb90a3", "value": "6144:MmotOpUQ2Rbv7rBPadCJxrR7iuehcJhswhO:MmySUVv7r0CDrR7nehcJhswhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775942410, "uuid": "1881d557-51e0-4e67-ab15-e01dbe80dffe", "value": 449346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775942410, "uuid": "fac861ad-8584-42e1-b8d5-fbb28761651a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775942410, "uuid": "56d41a23-586e-4b88-8f26-5dfe836e37db", "value": "NVI_utasitas.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cd1dfb-35ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775915822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915822, "uuid": "eda07a9c-571d-4df5-b6cb-ee1db477c17c", "comment": "Malware payload", "value": "b42b0e684cf18dd32c9e8de845f71c51", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915822, "uuid": "95f228ba-fae0-4fec-8233-436f7a506cc2", "comment": "Malware payload", "value": "b6b1ce9973730392b90cacf3e22a9a784787a3612702d7187ade56ecf125f042", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915822, "uuid": "5d587792-a98d-4f44-a18a-5cf51a436a3f", "comment": "Malware payload", "value": "b190acf8bceb8a2e18a60ec252b9e09e725d5ace", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915822, "uuid": "0e4ff279-c63f-4ffe-a542-2614723ccf7c", "comment": "Malware payload", "value": "5f46bbe2e8ec203100710a957d3ab8882c0f52e10fbc0e5de21b9ac208d4b7fe32091bf4a42a625589c2b00324bef127", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915822, "uuid": "a82a3211-d6e3-423e-85ec-58ff5382fd8f", "value": "T1D646339786971010DC1BD6F55EFD0078136A7CBF224349A72BF6B3896FD2A21F762980", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915822, "uuid": "b5f8a964-a72d-421c-989c-23833a3dc099", "value": "84d5cf8a39032294dd3b1147642f1ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915822, "uuid": "fd86dac7-2f6e-43d9-b725-c986a1eb88dd", "value": "98304:UbJ6MuJgKlweaHcDFJ1I+arQbrVXA2FaSYoxf5xxvFkVDDiYeAE/US8:Ubuj/aiSEbrVXxFfL52Fej8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775915822, "uuid": "b70771c1-f2e4-4a64-aad0-aa5734fca289", "value": 5745678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775915822, "uuid": "a977082a-6372-4569-af06-4ad007a6d25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915822, "uuid": "262dde2f-207e-4e6c-be5a-0d7400ac00e0", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1805a56-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911689, "uuid": "ba4dc23a-5b6f-42e2-9b60-6e48eaae69dc", "comment": "Malware payload (Mirai)", "value": "0c2ed169d024a81a64463a1081db2d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911689, "uuid": "52ef42e1-f73f-4d1a-be9c-e4bceaab2370", "comment": "Malware payload (Mirai)", "value": "b75ed0fad5a35ddd1670f520d643e473c042eeb916e3fd5fc52e8ddeca11ed18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911689, "uuid": "491d8139-8a8d-4975-a8a8-f7803a6b9a7e", "comment": "Malware payload (Mirai)", "value": "b85fb7b1fe217c07c633477f5ec57ddfa7e0147d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911689, "uuid": "0c33e2d5-3618-49f7-9caf-bb306469e496", "comment": "Malware payload (Mirai)", "value": "223214520e070e75aec5195dcca444c984d4501ea84e846234840319b4ea7ee2887d0e159a46637d8cb1d42162279c70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911689, "uuid": "d03ec2c7-119e-4c33-8edb-32b5feade6bf", "value": "T1D4538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911689, "uuid": "7704a8c6-30af-47dc-b556-265d7b979dff", "value": "1536:zag/Vdf5F1LwtkbDOoQ3veifs3guba/qzCEZaCw:zJzf5TLNQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911689, "uuid": "6da6e49c-f0ea-4b45-9ffd-5c88568cb297", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911689, "uuid": "1cba390f-c1bd-48f2-b3a3-047f994318c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911689, "uuid": "78d24e85-aa5d-4f57-838b-9ff57505072c", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39515b70-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775938975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938975, "uuid": "3919c2c3-afe1-4ed2-adf8-5d1eab3ebebb", "comment": "Malware payload", "value": "b3ca9650e5448cff1809489a198e6c3e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938975, "uuid": "6e74cf5c-e7a9-4108-b9b2-5ec8e1802e6e", "comment": "Malware payload", "value": "b7803b4cd3e87f9449bc3fa671a5831185da87fdc09a1410baf0cac1819133c6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938975, "uuid": "3db15985-9581-45f8-968b-2450364a2be1", "comment": "Malware payload", "value": "bc228c410d38275f3b659ef2236deae8f259a722", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938975, "uuid": "def40715-d0c4-4b5d-9447-076e56fe5a48", "comment": "Malware payload", "value": "23c50caf654ef09c41dc43d3bdcd3c530e9415c504d084248c494adcb48520e97d7f9f7b17d2a437f2efdeacc0f528b5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938975, "uuid": "8dbd04cf-d283-4538-b401-17a700a11382", "value": "T1C4C28E52BE94F07897CF7707B6B4F89159787BB1908DA90CA0DE908167DCBE0B63C191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938975, "uuid": "2c229288-d20f-4d83-ae14-ec8427ace7fe", "value": "384:J3CD2nsmEHoLQcmkflB6g9zFehf9oCtqQqA7P5ZU2nGCthpFcYbSGP:8aXEHo8BkflR9hwf9oCQQqA7rGCtndP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775938975, "uuid": "78a8dbec-3197-41ea-a1e9-3af1cd0026af", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775938975, "uuid": "0c9b1d72-a507-451f-a85b-a12b6a491f4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938975, "uuid": "ab081353-db93-42d3-944b-d0c91be36725", "value": "form_59474.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded69985-35a2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775910906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910906, "uuid": "49f68be1-c721-48a6-b881-fdf9459f238d", "comment": "Malware payload (ConnectWise)", "value": "de51d66447334c99986ef8de320fc600", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910906, "uuid": "0b2082e3-5bef-43bb-96a2-4e2f3fd3321e", "comment": "Malware payload (ConnectWise)", "value": "b7c810b1521d47625601587c1f9c8ecb4d8e0856ca338806c18236109f88c600", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910906, "uuid": "bfd7e832-f68c-4537-9084-6a9a7d35b231", "comment": "Malware payload (ConnectWise)", "value": "5beb67895880ea82b84a992a0adf5cee7a043d40", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910906, "uuid": "1e13af89-8526-4325-85cf-3c787abfafb0", "comment": "Malware payload (ConnectWise)", "value": "de6881b24360552f7a05bf6af9f077c001823c18f134103739be9d43bf05d36b1681cb82920fb3ddc766096352e13344", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910906, "uuid": "b63e3f4f-dba6-400c-a4f5-c0161125ff0d", "value": "T198646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910906, "uuid": "0183968b-76b5-46b9-b6dd-4d0c3afe964e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910906, "uuid": "3b5b1b94-96af-4dbf-a8c8-1f976ca12728", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910906, "uuid": "9c299951-78e9-4212-8030-8c24e6ed1772", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910906, "uuid": "13372eab-eaa8-4616-87a4-e09c140e72ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910906, "uuid": "14b8f8de-0602-421e-a52c-23d4761e6e29", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3fa4d1-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911388, "uuid": "57a41c18-b974-4341-bb7d-4fc2af5a3b86", "comment": "Malware payload (ConnectWise)", "value": "f579c9cf5a0954bfc5f5d734e3fa5f6b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911388, "uuid": "8a94591f-5a79-4ace-922c-2e113a7b288d", "comment": "Malware payload (ConnectWise)", "value": "b8cfcb044b0a928bd39d083dca2688e0786c8ab4d028c1c597dc1da3ce8373b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911388, "uuid": "4153fd2e-46b0-49dc-9981-10efb757056c", "comment": "Malware payload (ConnectWise)", "value": "6bb7f3247ce42a92a41e56ce240757726683f042", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911388, "uuid": "5f5d7686-592b-4854-b53b-72d4bfdfde96", "comment": "Malware payload (ConnectWise)", "value": "3aee54c05444ba0f5fcddfc4440563067859dc4f2b4ab0218fdcd8191cfedefc290551fb4ffc05e21fbec056086693a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911388, "uuid": "82d82b5d-5acc-43d9-b2f3-4e69e7541af8", "value": "T188836C43B5D18476E9720E3118B1D9B4593F7E110E648EAF3398826E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911388, "uuid": "a9054087-0156-4695-9f74-c470a1792f27", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911388, "uuid": "56a298e6-235b-4165-95ea-ca633999b361", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYl7hJ080:IenkyfPAwiMq0RqRfbaWZJYYlzf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911388, "uuid": "880db737-e201-4b7b-82ca-fb2a0d0cc51a", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911388, "uuid": "319ce410-584a-486d-be24-68c0e798f475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911388, "uuid": "68c0e5ce-ae3c-4b58-8ea2-be2ab0ffaaf8", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583ab91e-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931725, "uuid": "08615350-06f1-40de-a883-944b2f6175fa", "comment": "Malware payload (Kaiji)", "value": "c67ec08fc2cbc6ae09d047d7ba038816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931725, "uuid": "13994c6f-1657-457d-90c7-52c163aeea85", "comment": "Malware payload (Kaiji)", "value": "b9746f0b66dfb150588536ce9807deb8fe51bce515c988fab399d536c8484e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931725, "uuid": "0ae1a383-9d4a-4844-9206-de352c34e7a0", "comment": "Malware payload (Kaiji)", "value": "851807aa7df44982e44b26c08d615a918e74d0ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931725, "uuid": "01e48494-980f-45ef-9c0e-6bf3408d802c", "comment": "Malware payload (Kaiji)", "value": "5fcf9d1384db0d027bc28bc8c019b58255e9c378102aa21b1a860b8265ea4be65980bf29214658523fb516f0b4e59efb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931725, "uuid": "cdab049a-5ae6-4d91-9038-4fdefad897ba", "value": "T142B53A137F28D70EC71521344DB2CB94676A6C8A07D6A517BB81F319B8B20AC4E6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931725, "uuid": "983a9245-db27-441c-afbd-90d6c1be1a03", "value": "24576:cdz8hxtvZ8T0p+gpvRYvyVW1Z0WWJ/RVXbwqel9OFI+TcR:TFpW8gqelga+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931725, "uuid": "e75087ee-a9a0-427a-b1f6-e459ecedd960", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931725, "uuid": "3eba02d0-8b16-4add-b6f9-b4cf416f6bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931725, "uuid": "996b8a08-5fdd-475b-9a91-60a938fffdfb", "value": "linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31491e1e-35f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775947122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947122, "uuid": "e61318cf-4ec7-4c16-88d3-8c37adee17c2", "comment": "Malware payload (Mirai)", "value": "34cd040203dbcd54b77e76d18876339d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947122, "uuid": "058e3cbd-a2d7-4690-bc76-a170c592f536", "comment": "Malware payload (Mirai)", "value": "b9c1f40107034e13bae56d820f57a049439814cdecacd989eddc0d68d2d35a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947122, "uuid": "b1051c89-50a5-4715-867c-e21e47076df6", "comment": "Malware payload (Mirai)", "value": "5bd0abf03032aa552b57d7ec580842b4f902fbd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947122, "uuid": "f323494f-a641-4c5d-b1c4-185070eb5a93", "comment": "Malware payload (Mirai)", "value": "3f00ff23525ead50c82ccad6743096d388a37f2e97326384ede28535fe2987f2d698e4a4530c58175f6f56ad5e2b4d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947122, "uuid": "5b8982ff-0acb-4ef8-bbab-fb27e9cbd6fc", "value": "T19A141945FC518B23C6C262BBFB5E428D3B2617E9D3EA72039D255F20378785B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947122, "uuid": "bcbda2f7-4c1c-43c2-9936-ecf59db6bb68", "value": "3072:A4aRq+OJ5FyFpnz72mHca9TQkyAG07k3tBEE1zduq7NIX:A4aR/OJ5kFpnZ9ZDyAGCk3tBEEnuiNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775947122, "uuid": "9c46fbdb-2017-4e67-833d-f3c84603d1e8", "value": 190552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775947122, "uuid": "522c5cbb-fa99-412c-8494-380034f2f0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947122, "uuid": "1d4463de-9874-4d56-8cf2-05e045b17274", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c1425e-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911676, "uuid": "f9ee4a56-73fd-4910-8cbf-2b46d51f5127", "comment": "Malware payload (Mirai)", "value": "2314bb1079285d03d31c3a18b470251b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911676, "uuid": "5b5af002-1402-4ca3-b627-1f4b0d2f94de", "comment": "Malware payload (Mirai)", "value": "baf819e5858760621754db71f5ae755dc707b303e99a7f23bc0b727a3692d9a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911676, "uuid": "b40cb453-8787-463a-b292-61ca1338e437", "comment": "Malware payload (Mirai)", "value": "f5e6fcd65fc437074bb25c40ad7786a6a8972c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911676, "uuid": "b2370503-014d-4d60-958d-5caa94c3df32", "comment": "Malware payload (Mirai)", "value": "fdd7de1620aa20c5c73ef5fa3c09e50bf044f15ce6bec8db04a6b9b42dc5436139a273181ce9ca1aead514269b6956a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911676, "uuid": "49f370e4-18bd-4c0e-84de-462e003a6fc6", "value": "T13FD2D0FCA8B155C9D61D18BB90D827B02EA7B481720F6FA587125D8E6E3DC87F5500BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911676, "uuid": "8e7babc9-4033-4bef-88b7-5c488b6acadc", "value": "384:Q8pVWtmRsLYEpB6V8S628FLwrl1Yv72U6XGlxlFhGwkMukRVXN69jrQfTg1RWGVI:FMYHb625m7j6XGlxlTwHkRv69jdWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911676, "uuid": "a9dae125-994d-4e6e-80d8-a0b1e34718da", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911676, "uuid": "3e440653-36ad-4f63-96ca-d7d074010d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911676, "uuid": "bd8bf51c-f16a-4f99-9aa9-dac6f1c7fc70", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474e8837-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911511, "uuid": "577f10b2-1842-433d-9d61-60d8016c2dcc", "comment": "Malware payload (ConnectWise)", "value": "82f1f4eec6e19321169e54505227dad8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911511, "uuid": "29cd477c-3afa-49f9-a6c1-3f9a6662bd22", "comment": "Malware payload (ConnectWise)", "value": "bb3a253f4b335ce27ed12673f3b2c3d9302747fca4660dab0522aabc27521083", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911511, "uuid": "c17bd559-6c95-4262-b5d4-2daae1ba7e43", "comment": "Malware payload (ConnectWise)", "value": "daa63d1bac86d5cda6ff0881ab505df72525fd99", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911511, "uuid": "dd88cc81-b1ee-4d92-8c8c-a231d74110f4", "comment": "Malware payload (ConnectWise)", "value": "8255b52c4edc9ec827b953139cf0b91ac131aa71e12f50294a1e70dd8541b6defe2067013c84f7798ca9d8a4593f0e4c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911511, "uuid": "af75742c-b218-46f4-9194-694735f8cca4", "value": "T1F8646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911511, "uuid": "1d309a3a-1882-4904-b5e0-952ba8b58b28", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911511, "uuid": "42cd8d00-4f19-43c5-a636-52dd9f18f186", "value": "6144:VmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cPmG:g1iw7gryNkSV1hy1Z1u2JLa9cPmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911511, "uuid": "14f1c33c-ebc0-4c76-86f9-26d288da56f2", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911511, "uuid": "5f4847c0-aba1-4b72-8228-41fded97cb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911511, "uuid": "6fd90ea7-a1c5-42bf-b15e-e36e11f969aa", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b52c7b-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "89240a6f-224a-4b3d-b3e7-df66f6f91ab3", "comment": "Malware payload (Mirai)", "value": "d4595abe30c8e9833f681e531369bdbb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "b861c0e6-5fd0-446a-bcc2-810f7785ebe8", "comment": "Malware payload (Mirai)", "value": "bb8ae922e4436d0f332bdc6e57c3455d6925403b17f6e0a2f1c503141904d077", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "900ac7f7-4949-4d23-876b-25c1aa2d157b", "comment": "Malware payload (Mirai)", "value": "cd88cd1be0dc9fefa119a8997c2f2c9961721a34", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896508, "uuid": "b703cd81-36fc-42dd-8512-80acdd5379db", "comment": "Malware payload (Mirai)", "value": "3271b5f3a500875a4741e579137248318d3064e946d4f76a8759cd7b3d9136e0e145a98e4f730397eb229364f3438927", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "cf4ccea0-570a-4c84-a703-45decc447225", "value": "T19EE3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "dcebbfeb-1c15-4ab8-887a-d5bfbd75ef83", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+JonZy:axlw1xAop0YfRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896508, "uuid": "3c5a0bdc-8f52-4b79-b60c-5414ec1e43c8", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896508, "uuid": "b6d48c7e-5665-4719-9332-ecd204718310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896508, "uuid": "cd8081ed-8fc0-475f-9fd1-b3fb4b7cbf55", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca8377c-3594-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775904648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904648, "uuid": "a2619f18-22cb-4017-9ef8-70f1d4f4a35f", "comment": "Malware payload (Mirai)", "value": "304f15e974d827c63ce034efb768b762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904648, "uuid": "b283b912-77a3-4ef6-a3a0-11d5f8691ee3", "comment": "Malware payload (Mirai)", "value": "bc4d8a7bde5c8d1ecbde11dc96e8e946076b633090b74b61374cdf3bbfed0a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904648, "uuid": "07774909-936f-4bfd-847f-c86d0cb5a700", "comment": "Malware payload (Mirai)", "value": "ef8d2bb12c12b2d7c20ca29cb38988f1d938c281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904648, "uuid": "c93183e2-412a-461d-a3ff-c248ca5af5fe", "comment": "Malware payload (Mirai)", "value": "0a73f8fa5cd7d9de70cef6ff1f647c2dd54deeda013e31730bfd8ec47afaa374c2374126faff6bc03721addd839c555c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904648, "uuid": "daff3ce8-39ee-4f03-bf1e-f28f93676d14", "value": "T141043CD7F800DEBEF80BE736445309097130BBA264925B377367796BEC3A095192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904648, "uuid": "76b07bfa-de86-401d-b323-0988af0d2ded", "value": "3072:Yh5w795MKw1ssaRULEn5dJmNCmeVhjbiOLzjPgFSyXV0Fd2:4YZsaRULE5d6CmOLZyXmFd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904648, "uuid": "132e8299-77dd-4150-b9af-7b8e3211e55d", "value": 178720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904648, "uuid": "2721965f-14a0-45d5-9177-5d74ebb15810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904648, "uuid": "f9776b14-2b15-45fe-b76a-c8b68e90c1fd", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b81f9f-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896690, "uuid": "760ce72f-6b62-4e4e-b462-98fa61469882", "comment": "Malware payload (Gafgyt)", "value": "cd8a6eeb9a5bbc6360e1d162d175a323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896690, "uuid": "73724723-b5f4-4022-abc1-f7f339884b5d", "comment": "Malware payload (Gafgyt)", "value": "bc5b11bb3c869b9a0d4daf066660a34521869f5a955b44d1f58e683039eedb79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896690, "uuid": "584f347a-e93b-43ea-8564-1f196a5b848d", "comment": "Malware payload (Gafgyt)", "value": "b3c966d8800574c5ca722ef0836bed61bb0c6a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896690, "uuid": "d396dc2b-4a6f-4773-87c3-c8e579ed5997", "comment": "Malware payload (Gafgyt)", "value": "1f6d2e18a2794ed92bbd9f79ee6efff8aa8bb631e42e7a5948c6f390bf52eb0c57eba3725f7ac16253d0eb24d82321e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896690, "uuid": "7b7a1946-d4e1-480d-a87e-38e03cf7a58f", "value": "T179E3966E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896690, "uuid": "cbf2b5c0-eaf3-4cd3-8664-4e9b60b1bcd6", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hF:vY01ZkXAQT4NE9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896690, "uuid": "ec5c208e-cad4-43f1-a5b4-87b96c91cc22", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896690, "uuid": "36edc993-2444-44bd-91df-1d636dc1861f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896690, "uuid": "a79a6f81-84e2-4765-b048-b6bab1b73134", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b6efb4-35d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775931215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931215, "uuid": "67d34532-5fa7-43a2-b221-dc680e3f66c9", "comment": "Malware payload", "value": "d2bca72b56ee5a730e37dd037e7ca359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931215, "uuid": "f470410a-cd25-441c-9027-0acb64957bd8", "comment": "Malware payload", "value": "bc78b8628b1162d35f7dc3a784aba65d3dc6a054f83b4dc53e924f0cbeee913b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931215, "uuid": "7656af79-4cfb-4abd-b170-cdc5d7714102", "comment": "Malware payload", "value": "55514b41b3a0e436b069567293ab33c1819736c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931215, "uuid": "32d445a4-377a-4881-a4e6-ee3afa487b04", "comment": "Malware payload", "value": "397f26f4dfa79647321d081425ea55066299bc8444d68df551e21f2aa4e99ec187a0a727be41ff16fe1a74bdd9c31215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931215, "uuid": "a912c2b8-a890-4705-82ad-5edc0f9dfb19", "value": "T199157C46F2F374FDC067C030879BDB626932F46551222E7B21C4DA352E96E601B2AF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931215, "uuid": "06ec2aa4-e242-4606-8c2f-b285776774b5", "value": "12288:N0cr5GKlXKgYwWz4h2roQaqZs2I+oRemy0IQ+EYDX5kSrBkrTUNN:N0cr5GoXKMWz4h2rNpZsqoEEYD11kr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931215, "uuid": "c4ed4296-d9e6-460c-a3d5-da93aebc9091", "value": 934968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931215, "uuid": "f4ff0b4e-0cff-4511-95c3-ce2c01c91fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931215, "uuid": "9e199bc5-ab1f-4557-93b5-b50ecc28b531", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de24cff-358b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775900892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900892, "uuid": "a921a860-3310-4e0a-8fe8-558c4ffe8cc6", "comment": "Malware payload", "value": "959a3d6407f2ab313678656e67f8ab28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900892, "uuid": "6234a4f9-3b11-4836-9a44-41de02d9bb3d", "comment": "Malware payload", "value": "bc879518748f2747b4898b4e6938546975692363573f668dcf4661bab62cb635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900892, "uuid": "d44bcbeb-72a7-4ae2-b3ed-38f7968c938b", "comment": "Malware payload", "value": "3476e0412226e8b3c254ce6fb1bfddf07efaf0ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900892, "uuid": "e9ac7328-0097-47d1-85fe-c36c70fe7e1f", "comment": "Malware payload", "value": "aa640e558f48a56af129e935a8ff8cdf991ef082e1cf8f6b56992550087d98c463f1e12276d40bf28fe953b3ec7d1811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900892, "uuid": "6d5e7c8c-3c4a-4364-96f8-4382954a2d6b", "value": "T1FB756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900892, "uuid": "f6b83c1f-d02d-403f-a2e2-32565a118f00", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900892, "uuid": "fc03eccf-6413-4d04-9d7d-b205f0c94679", "value": "24576:dds9Esxlce6k91UOld2LMxmeDozCMZyFF8NEymOCUwPP1nP:ddaEglcAHNaYczYVyL2PP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900892, "uuid": "590291a7-a8d0-4ccf-b62d-433f64a7aa30", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900892, "uuid": "999e0a23-f013-41ca-a78d-5bb4130f1f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900892, "uuid": "f3bd645e-d647-423f-947c-3adced8b8cb5", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47dfffc-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888098, "uuid": "d36a4a9e-f2d2-4493-8721-b54a91b2d84a", "comment": "Malware payload (Mirai)", "value": "0b0a5270a8d27cab8adee7b3bb533a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888098, "uuid": "1224ee06-35f5-426f-a807-2ab420cb01b0", "comment": "Malware payload (Mirai)", "value": "bca02842e1a54df952a46a252f6d3dd2d910466b058ab8826e3d89339a424359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888098, "uuid": "5a72ec2f-fd16-45d4-8bea-278178e1efe3", "comment": "Malware payload (Mirai)", "value": "01be9b01c300e6ead84b252d7c0efde1060eb359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888098, "uuid": "e553c1c3-2d90-4ddb-821c-100a13dca6a3", "comment": "Malware payload (Mirai)", "value": "d25c3c3e63d208268e691fad63f198f42d7f5bc973e14b9a4304f4c155424f5e104fb815339b8acc29a98a92031fdc1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888098, "uuid": "10ef315a-8aa3-44c8-824f-f64c3454613e", "value": "T1C433F150F827EED3EB797FB14E1853C8B3F21D9D32519FA6072002675E6A2160A1EF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888098, "uuid": "01a3bc1b-04ca-4fd9-9068-ab0eb2c45f46", "value": "1536:aKArwAkU3iMuuNQAJvg0Ys5UNw6/3HL3heqkPv2yt4u+qgw09K:q0A/3iMnQwg0Ys+n3HL3yv2U4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888098, "uuid": "aee1e9a7-4d5e-41d4-abe9-6c6b89b66234", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888098, "uuid": "9c1b618f-bc2e-4d9a-a40a-896aa21b0e05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888098, "uuid": "0edf258d-e7c2-4e2d-b031-c1be438dfa51", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2889eca0-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775938947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938947, "uuid": "81fa145a-e34e-4130-b44d-f25fb3656983", "comment": "Malware payload", "value": "d63055bb16698dedbb1163788925cd5c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938947, "uuid": "0f7d5799-87d6-4f09-9b71-867f68734432", "comment": "Malware payload", "value": "bd0b75a24963f2b008a2540a095becf8d7620ca140d11b83e096f3099f022f98", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938947, "uuid": "0fb3b7c3-1438-48b3-946f-4ab5fde3434b", "comment": "Malware payload", "value": "498c0fbbd0e50c25492ed3bbedc237e69c04174a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938947, "uuid": "b3294611-e1ce-4fe1-ae7f-22ad10b31bf9", "comment": "Malware payload", "value": "5a7be0163e6a0720acdb81e8f583fa77c368cc3dfd7ad73fb726e318db4b339c43bf60d8772dc6808649042f3bd03081", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938947, "uuid": "95c4c761-1cdf-4f7a-bd41-72af83d6c3fd", "value": "T13DE0A7D44E55AE22D4700936810BE3140F25B9050540B3E201D05591E8711857E36655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938947, "uuid": "13defcdd-3b43-400f-8074-837fa9fcc380", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWXUDFTFFyC6w5fJWX0DLLGPer:4xtJCUOblw7BJYXHpQtXaFNUebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775938947, "uuid": "af280188-86f6-4957-866f-74fdbdc22c2f", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775938947, "uuid": "80d6c168-4f29-483a-9e10-65d005a35b03", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938947, "uuid": "b41c071d-9af4-4bc0-9bf9-0c8ade0ee6f4", "value": "form_59474.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ccb334-3551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775875915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875915, "uuid": "06abed7b-e7f1-46af-8192-03eef15320cd", "comment": "Malware payload", "value": "97364156f5835ed8d181c8f18f3b21e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875915, "uuid": "22018b9f-814b-439f-a099-dca287fb7ce3", "comment": "Malware payload", "value": "bd301143e88f8bf7cfeedfae31dbf614ffcc0faec4855b9124dff758ee732a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875915, "uuid": "37822bf1-8dbe-4f7d-b6b5-de2f7e266f69", "comment": "Malware payload", "value": "f23e3d2db6170bbc5aadbceb667a3b231ab102c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775875915, "uuid": "e6c61553-c96a-46f2-9246-2a5f7b7f2261", "comment": "Malware payload", "value": "9b91d7a805e08fd7cebed3d8cef5d18f9b9ccd119fa11a25d1b3262837dda37712a8dc28d763067df22f0bb646f3289b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875915, "uuid": "8e84aa0e-cd67-40f6-9da7-2ce063efacbc", "value": "T10AA5CE30F8A28096F8F2C17245E99AA525285D21773806DFAED0FF6D79324F16F352D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875915, "uuid": "8c25fb7f-2570-4c4c-a2f8-379194caca60", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875915, "uuid": "b8c48439-5f08-46c3-9862-3ced0220cef1", "value": "49152:p17OjvrwT1ZFG3zImre+x6CtcX4EwgGWyG:bOjvrcwnuX4EwNXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775875915, "uuid": "b6735da1-7ac7-465a-9a27-46fa066ded07", "value": 2173078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775875915, "uuid": "ee6d1a27-44a6-45da-8f81-17c9fe0349ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775875915, "uuid": "de0b946d-bf32-4011-a266-fbb0518e09eb", "value": "fishing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109b1afe-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910989, "uuid": "50e59171-49d3-4a97-877d-c27372030eeb", "comment": "Malware payload", "value": "ae783bf47a69c7dd8db121005cda2545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910989, "uuid": "e5f86e5d-6c09-40a3-aeba-dd1cff1c88f8", "comment": "Malware payload", "value": "bdbd85f5cbf7ae7d5d39d660d612e532400ca7132842e22048992c25af7deb28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910989, "uuid": "64ed9317-d6b5-4d81-9380-c14837d94c5b", "comment": "Malware payload", "value": "3c97b17b91c80d067c981a6796327a2797c32a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910989, "uuid": "6a035093-8e9a-4427-b7ac-1cf0fd664fa0", "comment": "Malware payload", "value": "981f2c1236b4445e8511b5946956bd31f4f0539c7d1bc49d7c2bc42369cf94d1e443b08bf15feff43bf99d425d25486c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910989, "uuid": "8af60885-788f-4bab-b2dd-7e47c1f9263f", "value": "T181341249E1C3EA79D0A381710B16AA9A4374FB31354DD710E3492E16EAE3F97B3D861C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910989, "uuid": "5d6cda62-9501-4b95-90e8-33caa490a367", "value": "6144:xroRhPqaAmDtEBuPg4GvnXfAP1L0E/7IsyhnDxZhOM74jlCucq8Va0U:xroRhPBA+EBuI4GvnXfa1L06HiH0Tdcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910989, "uuid": "bb25ed9b-84ec-4d42-844f-1e7409c1309a", "value": 247669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910989, "uuid": "94bc403f-c4fc-4650-941c-a1b3eda662e8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910989, "uuid": "f03f24dd-543f-448b-98aa-b82874b29ec9", "value": "i4z51e1kds", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb53d24-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911679, "uuid": "0e556f2d-ed1f-4405-9035-2baba3322b80", "comment": "Malware payload (Mirai)", "value": "9e1108f3588a6285152def650558fde1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911679, "uuid": "ad035770-bf90-4f34-8020-2179c9f80443", "comment": "Malware payload (Mirai)", "value": "bdf61103f7dd8a17722f13451690543611b83a8f671a4e952da14d37278956da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911679, "uuid": "3209891d-241a-4e69-8129-c65e421d01f9", "comment": "Malware payload (Mirai)", "value": "989d2ac098437812b071f0e36e227383c5f69f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911679, "uuid": "52f2e7fd-e8b5-4560-95db-6e46d5fd7cce", "comment": "Malware payload (Mirai)", "value": "ce51336204abd36129335fc1b27b7301a5d23728341a165eb9afa6d11b5aa63b5054ba7c9679ff7e930ec9ad0e218912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911679, "uuid": "20bdafdb-c669-40ef-8aeb-a4276664e538", "value": "T140C2F170762E2F79E7F94EBAFE2842070A713EF5E0A57252352426B4F480183D8F8795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911679, "uuid": "607dc1a4-75c0-4f9b-aba1-71f83f8a331d", "value": "384:PLOIcPns7PrwNLcdNyYAzri1AnMGRnzAZpy4CbTOtUAbl4rlfX/LhymdGUop5hp:tbwNwabrinq8ZM1bCtU6ylfDs3Uoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911679, "uuid": "7f229671-0201-4dbc-9f7a-e4bef4405053", "value": 27352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911679, "uuid": "a39a8bfc-487b-42f4-a7e9-348f9de7f8e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911679, "uuid": "e52591a2-1d05-420b-9514-744c533657ab", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6128053f-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916708, "uuid": "8bc8f874-7dc0-4a91-86c5-fc519526914c", "comment": "Malware payload", "value": "2f832a98cf72f711eb4a43db05bc5df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916708, "uuid": "b6e099e6-5218-47da-9882-b940d08f0ef0", "comment": "Malware payload", "value": "bfd366d4912dbd3e4a6311f816267aaca348a30080fc54cf6d0aa500d1466353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916708, "uuid": "6a9b99a2-b29b-415a-bfea-064bbd9efc6d", "comment": "Malware payload", "value": "6c158d1db2a0405ee8e5c2915a0eed61809e9113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916708, "uuid": "283bafc3-607a-46a4-a8b0-00473eb07835", "comment": "Malware payload", "value": "6fc868500aede9b6d0374d2d62e06d0655124b2adc28f2d925f164abc700f52b9a233ac484156bd4609d41a034d68341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916708, "uuid": "9e5d9c74-7e81-4e7a-b1a7-2b022f9efd9a", "value": "T153362A02A9A18667C16DE238ACB5A25036727C9807727BE30F5771B61DF97D81A3F31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916708, "uuid": "d7189ac6-4976-4d39-8861-f9dc53b96616", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916708, "uuid": "c79a5a39-8eeb-4428-ba12-d3846bcbc32e", "value": "49152:zEXHOn6kEf9YwsY/s5MyDv9PsRO6cGeIhGwCl+/npJCLYnnY8Ami0BmM6fM8UD:wXRgKvnrAV0OfM8UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916708, "uuid": "a1189582-4848-48c1-8014-d43c2de59ebd", "value": 5017411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916708, "uuid": "3f1772b3-d7ec-4177-9e85-1898be4111fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916708, "uuid": "f3adc162-698c-4822-9dbf-b9594107551a", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71662aa-3597-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775906169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906169, "uuid": "8d53f5e9-319b-4e70-a6e4-f92edc7f9c91", "comment": "Malware payload (ValleyRAT)", "value": "fdc9f9d9e826d16a815aba50ddc143d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906169, "uuid": "fa0be686-e723-475c-9201-d6d7884feb78", "comment": "Malware payload (ValleyRAT)", "value": "bfff6225f4fbbf9e36322240185935d0321763893c579f4e77b6efa520d5ab31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906169, "uuid": "9874c435-ae8c-4c02-8cb3-7988dad8e41f", "comment": "Malware payload (ValleyRAT)", "value": "216060c45f2e20c7ac42a816bff1b35ea586d042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906169, "uuid": "13bca3e7-8200-4965-865e-3100bc6625ab", "comment": "Malware payload (ValleyRAT)", "value": "0e5e1c43781d255cc539d3fb3f5804f9f2c53730b5cfa80dfd7f7d0f1282d5a04e2494ce7c5d7d2d13d5f85b00465bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906169, "uuid": "5ed3cb3f-ec95-4272-ae28-0d953e8bb039", "value": "T1A1C5124AE6D408F8E1B3E578CE878A06E7797C4E03A0568F13A076661F77290DE3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906169, "uuid": "6aeb82b3-f5ec-47ac-ba2e-208e183b56fd", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906169, "uuid": "6d4e0689-f2b7-45ce-b6e4-d7fb42a3e2db", "value": "49152:QZB1G8YMhOI8GkUqa6jTPpXF2kp1QD4WCvZlFtno5gSV:e3GCOIvzqa6HPpEHCR2gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906169, "uuid": "99e9bf98-18cd-496c-8d7c-88e73085e907", "value": 2565542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906169, "uuid": "071ef5ea-bdbc-42c1-a534-438c2487f7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906169, "uuid": "dd56c289-29ed-4793-acb7-56ad54ea524c", "value": "bfff6225f4fbbf9e36322240185935d0321763893c579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f98ea85-35f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945455, "uuid": "3e968012-61cf-4165-904a-74a339546c05", "comment": "Malware payload (Mirai)", "value": "e83089660c1e97af5cb376f4731ab0bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945455, "uuid": "dc704a6a-06cf-44d8-ac01-715001111141", "comment": "Malware payload (Mirai)", "value": "c0b4429507e34a7233b25aa63764bb0de723dd7ef1d5cb7e288f379083956ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945455, "uuid": "a05e59d5-1aee-4adc-a796-dd988cf36834", "comment": "Malware payload (Mirai)", "value": "c43b7e2b6cd8875a56dba1ac0d95005f78028f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945455, "uuid": "f20ebc01-f744-473c-afce-596262f36823", "comment": "Malware payload (Mirai)", "value": "a174d9d0c37d2f9a83651b46e51a4249ee7d4c140a4e88d0a5601d1767b1ecf4cfd3519d7d693874463ae73620af4822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945455, "uuid": "3569eea0-cd77-410b-ad57-233b3f397bad", "value": "T159845DA3B543DEAEF1A447F40AA35A3466E541F322B5C9A3D3BEBE055B301D04D19EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945455, "uuid": "c56c1800-dfb7-466b-b339-861adb9fef20", "value": "3072:AtvUcyhpwfeJ/r9eqbw4s2CwgnNJOM+ikWrdm:AtlybwG90qbsNJnxdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945455, "uuid": "5f69ed09-78f3-4129-87cb-a3b37aeb562f", "value": 394816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945455, "uuid": "2c9c10ae-8ece-4a20-acf4-815a8ed11bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945455, "uuid": "fe40d192-46ff-4cae-a806-a830be96b8e5", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56db5238-358c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901229, "uuid": "157aa323-d3ad-498a-8baa-125449260868", "comment": "Malware payload (Mirai)", "value": "7668e01bd8fceb44d4f7ce19d6f6acb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901229, "uuid": "956ee4e1-2133-44ed-af9c-30345d6f11aa", "comment": "Malware payload (Mirai)", "value": "c1f398778007bf23c8701827adf961bee2087d3c88802e6e6e724c0a0d607d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901229, "uuid": "67f3da05-5101-4379-8e0c-f6e861cf56e9", "comment": "Malware payload (Mirai)", "value": "60dc957083bbbe5f8b2e255145ed86f2f7924f2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901229, "uuid": "2436fd0b-df74-4a43-9576-acedf41cb6bb", "comment": "Malware payload (Mirai)", "value": "b28f6dc0216ff8d5edd1773d10b074f5c1e48c49ccfa440071b90150c71095bb44cc45502fddc6ac85da6654e58c7273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901229, "uuid": "c98df1de-f899-4b3f-8c33-229505d40d18", "value": "T107834A86F783D5F1C94304B0115FFF3A9A34DE711220EE6BE7E4BA67AC726025426A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901229, "uuid": "a8f63cc9-1a54-4fda-a4c2-f1d64bb41e3f", "value": "1536:rmyNHpqf/wcZxNyxpMAjsbNwHeuPPfipxUv31k79SMQ2aHar:CCJiIc7+MzNWxaqS7ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901229, "uuid": "fa84c631-1c53-4a9a-9728-83ad1f63774b", "value": 83772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901229, "uuid": "9ba3bd9d-de79-47e5-b35f-57a7fb12f34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901229, "uuid": "943b4bca-311d-4eba-a842-927859bb5c28", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac99d20-35f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946843, "uuid": "bb8e5de0-a398-4fa6-8bc2-119ae507b9d8", "comment": "Malware payload (Mirai)", "value": "c238bc34feb2e9a7d0086105df794e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946843, "uuid": "df47c2b9-1e51-4e28-8180-8432150d37c8", "comment": "Malware payload (Mirai)", "value": "c26337f0227b5c3a87252a3f18dad77cc90a4b368c495491becbf29735a2faa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946843, "uuid": "3e7c7459-4d16-4934-94d0-e1a2f2402fc3", "comment": "Malware payload (Mirai)", "value": "0515456563bdd40b3862f29294a645c97f9c7ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946843, "uuid": "83dd4719-6dcf-4c66-8677-0ba4a255b78f", "comment": "Malware payload (Mirai)", "value": "6ce9303f574c1df4a2a9cdf79894fc05c6f175d42103c850c6f03e086072544cc26ee366f9d4616dc2d1fd8387cfcf9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946843, "uuid": "08938fcf-eef0-428f-8f98-8c4ff38732ca", "value": "T151143A01B71C0947E1632EF4363F2BE193EFD99121F5FA44264FAA8A9172D321589DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946843, "uuid": "e758ff50-bb9b-4cad-bf38-2c3e3f0ec27e", "value": "3072:uj0bAz1+kpbRorJXxTGsFT0+Hz3MRfFxQ:g041dhIJXxTGWT04z6fvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946843, "uuid": "ffdb7499-dbe4-44d4-83db-ffe83399906f", "value": 191540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946843, "uuid": "36c118e7-f201-4f58-911a-998ab6487d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946843, "uuid": "09f39ff8-b0f4-4398-b860-422872832ff6", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e17535-3570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889416, "uuid": "2eabc8ea-1c49-4c1b-ac3a-038ae4abe8e3", "comment": "Malware payload (Mirai)", "value": "db5a102f6998b8bcb830493159aa9f24", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889416, "uuid": "c8afa21c-5635-4045-af46-88f0147c0689", "comment": "Malware payload (Mirai)", "value": "c4af7709afa47f4d98a548518674e23b3b364c9bb2af28f93180715bb2476503", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889416, "uuid": "e899b911-3671-4c1e-822a-106682858040", "comment": "Malware payload (Mirai)", "value": "8a0f2bae53ce5a06cca292661bf4feaf4e631af3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889416, "uuid": "a0c99794-8753-4e28-a159-afcace6aedf6", "comment": "Malware payload (Mirai)", "value": "45c7b1d9a3a1d18ed1a28c34e0932e7d25fa7b7ee28366ab6048cb5ee37300e2d54a8e4d7eaa1c03c0e8955699efa651", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889416, "uuid": "ad65ec85-fe29-4203-b2bd-b1c9e3b15061", "value": "T15621569F3B522621CED1CE0F7B68443C42FCE0E7E95B8A1EC594D82E809F94D3956B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889416, "uuid": "a2fa1cd6-b69c-45b7-a215-73dda40e04e4", "value": "24:SDqXD0iDIDI98DuwDudD1DXEDMDqKNDSWDS04dDkRDk4D3D+DGD2KRD8WD8NI2Dj:OS9/La7R04Bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889416, "uuid": "a586c348-6b4d-402c-a561-1e649eb7fcef", "value": 1279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889416, "uuid": "4bd98297-d953-4324-b693-0c6bfcddc873", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889416, "uuid": "9c5e3e32-52b0-4dbe-9c60-937d3a38627e", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce0998-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775917285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917285, "uuid": "e6e79c97-5168-42f0-b690-11532c391832", "comment": "Malware payload", "value": "0598550fbd05c23cfc5fcc65ad5341e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917285, "uuid": "3b6bea5b-3f9e-441e-afc2-938aad214fda", "comment": "Malware payload", "value": "c503b418230ed224898959e2960b4662b8c69be8bf4f252d0be3df2a51d702c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917285, "uuid": "14f28739-9240-4c7b-9233-464b22ec4bfe", "comment": "Malware payload", "value": "4b0778e6383c60e3b67ea06ef37bda4189ba1b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917285, "uuid": "982f7e5e-1ff3-4d31-b69f-f78fe48e5965", "comment": "Malware payload", "value": "de5c0a96e6e484a2a997a5927a450f0872bd95435c0b9d0805b226dc6acb8f3f581b1a56278dfe99e03c845b795ba0d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917285, "uuid": "b9b53c46-1fbc-47de-b9e7-1a36cfa1bc87", "value": "T127B3120F2B8A9CC3E0D2CDAD114911BEA78F2A411DCE7D70649670DEBB6349706D6B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917285, "uuid": "1f711401-2951-4ca3-92f0-ed64277bea14", "value": "3072:a0Frx2mcYuJh/EHP1Ws7vrDASW42G5VdF2:FNxxlEh/EwsLrDASFVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917285, "uuid": "683737b1-271d-4575-96e6-73c8a74de7a5", "value": 110340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917285, "uuid": "238cd43f-76d0-4729-b03c-fb712973e49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917285, "uuid": "fa2ac06a-7922-42fb-8873-8c4c5c0c738a", "value": "redis-composd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be75b773-35f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946500, "uuid": "76a75f62-bf3e-4396-ad55-17beefcc05ac", "comment": "Malware payload (Mirai)", "value": "245793de38af6c0095c39624d773f2ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946500, "uuid": "b330d0f7-21b0-436d-8682-bdfb28d3e1b8", "comment": "Malware payload (Mirai)", "value": "c5057968de7509411ed6015175268d2f5737f0691c5fda3d33ef480b27e46108", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946500, "uuid": "00cbc76f-b129-475b-b20a-76a0ef672b85", "comment": "Malware payload (Mirai)", "value": "e9a70d2ebb17b928322ec7e380580173b15980c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946500, "uuid": "405ee7c0-6271-4c85-aab5-1230ace8ce60", "comment": "Malware payload (Mirai)", "value": "1ad54f743fcaab0b59f5778d83e95aae490e4e822315a94bbea8827f7f01ec52f65d77a81879472ce659a43bf0f33701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946500, "uuid": "7df2371f-9bc5-449f-8a13-f8a50ef3b854", "value": "T1C2241B01BD518F53C5D32BBBB79F42993732672887EB7302DA18BE742F4669D0E26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946500, "uuid": "a5a46d78-043d-419c-98d0-48437f9ef0bd", "value": "6144:5FRCgwumf0HYkrAKwwY8rjdF9yNoKiKH3vtZmLE1SMyV+lH1:5FRCvQrAUJTMoKiKH3vtwLE1SMyV+lH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946500, "uuid": "90fe8616-6629-453f-96c7-1612db61574f", "value": 226599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946500, "uuid": "dd92bbb6-9fce-454b-af4f-60a214d933f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946500, "uuid": "48ad5dc5-e3eb-455c-9b86-45264c56b306", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe08c20c-3601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775951761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951761, "uuid": "b8881458-2c71-4983-bab7-7f8731f32c2a", "comment": "Malware payload", "value": "d159e47e5c32186248be0ccf4ff17a27", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951761, "uuid": "2104b2c5-1110-414d-a89d-998652cc95ee", "comment": "Malware payload", "value": "c5d79d83ecaf2e200d8d18867563fcf1e65ab3cd87457ea2011029886c7dd859", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951761, "uuid": "0a881974-90f1-4688-908e-64c1421b5fdd", "comment": "Malware payload", "value": "055bcd896544d479c81814fe4ca03b6f713e5c22", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775951761, "uuid": "6c3b086a-2d96-49c9-a01a-3e36255f436d", "comment": "Malware payload", "value": "7c194b58ff0b6b1b34b4076336fb02390be322a9b11afd7c38d452ef7775a739d407c53163527a3f409f8ec657231143", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951761, "uuid": "27e6a65b-4c9b-4e75-844c-6c1d0382fcfb", "value": "T13E24B723E6A288F9C49FC1749FCAE5B36671BC584174F21D5F804B127E0BF609E6C689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951761, "uuid": "d6ccfc87-6b82-4e52-b96a-39a9a90ed9a5", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951761, "uuid": "625dada7-22c5-4274-ac54-391e719d17fb", "value": "3072:ehDJTJzIUV0eNByLrSjfpZ1IQmVQiMmYe4W7YHBrfLASWbMpMDWmJP5L5mjU2r:IzIqNFpZDdHBrfL3WbxZJP5L5mjhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775951761, "uuid": "07954ff6-013c-4b44-b7ec-cc931bfc7166", "value": 222000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775951761, "uuid": "d93a9c10-ebc1-4eb6-8d02-4d26cab80369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775951761, "uuid": "eb0472c5-730c-4b60-81f3-457e1fe9f841", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f415e3-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "cd70fd6d-05c4-4bb8-ad43-084695d040f5", "comment": "Malware payload (Mirai)", "value": "6434bb6764a86c74c8c837108598d47c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "2c39f04c-250e-4eb4-b4f6-e12bf9109174", "comment": "Malware payload (Mirai)", "value": "c6fc981d6fc7fc2e4b2a28fe58db5f0f9484a06e98f3e94b314e9bc325018997", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "7cf59063-dd28-4504-af1a-b1e1173645a4", "comment": "Malware payload (Mirai)", "value": "f21bf2fab48ed77c5564784a87c03b6423b4ad83", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896510, "uuid": "7ba8c599-57c3-4204-bd3b-1a11db93fa16", "comment": "Malware payload (Mirai)", "value": "0a4dc7052c69c38e04626d620b9c9a9fab429cd929f6171953660ecdd0ee259980532ea2c7a8ea29a160bd996ca7b554", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "87a45210-e6c8-4549-87db-8d776bfe4077", "value": "T122D308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "65ebcde7-b265-43d4-be34-4e51183036d7", "value": "3072:wSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIyx:wrybytG/Oyi42VOgLNZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896510, "uuid": "46c09168-cd2e-4f52-8fd7-3187d1521878", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896510, "uuid": "5b0e67a4-c55f-4f08-9a91-dd08f15328b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896510, "uuid": "a93d16ec-29fd-49c0-9b6f-baf2358679c4", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29dccde-3597-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775906134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906134, "uuid": "934a68ce-8364-441a-95d1-4e8544ef64c9", "comment": "Malware payload", "value": "be89165ded13ac3b07d67b90ff339301", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906134, "uuid": "80f8a68b-f568-4ef5-a379-58c12e4f2c65", "comment": "Malware payload", "value": "c86e9a1f99f4e4aa97893042bf8a3c646efdb6496c4433b5eaa4f4bf2b98267d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906134, "uuid": "1a870cf6-b002-487f-b48b-d73dcdbd25b9", "comment": "Malware payload", "value": "46dbce636b422b36661d735e142ae939499ee5f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775906134, "uuid": "d7b1db01-da3b-4abb-9e4a-cde0d6bff320", "comment": "Malware payload", "value": "d45db4746e5bc41bdde8836ad45f7ae24a1397df29ec612ccd8414e64f6e112fc57d06ac8160d0368443ed2a9813ccda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906134, "uuid": "e27ae601-d6ea-4162-8d56-ff780742611c", "value": "T150137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C19ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906134, "uuid": "176d72b0-8ced-42c9-9a1d-ebb0f1d860bc", "value": "768:bo+99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bo+ecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775906134, "uuid": "c2595ea6-723b-4ac8-ab67-09d5d16e4957", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775906134, "uuid": "37f28b03-1657-4643-b80b-159aa11e5a33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775906134, "uuid": "d78e0ebf-8f28-4179-a658-215da7856471", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfea6d8-358d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775901613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901613, "uuid": "290eb123-08ed-4e69-953b-602a0f5b2348", "comment": "Malware payload", "value": "8b75ead7c8c8737570fd93ac7c530bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901613, "uuid": "c4ac9424-0b30-43e8-8001-c783c87ad53d", "comment": "Malware payload", "value": "c918dded298b0d76d4ac51f23b391f62a95f58b3fa2488202ecbbc9c7ce8e785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901613, "uuid": "02f65678-d810-4aaa-831c-4a2989a6476b", "comment": "Malware payload", "value": "2c2f211341c461c405da622adbb1511834472fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901613, "uuid": "95952cf2-cb52-4b6c-9dd3-56f815d7ac21", "comment": "Malware payload", "value": "cacbabaf7d6f70d7d7cc0298d371928281d4791f709ead52fd08cbd1d7d449e8065f18d18ce1c12f9dc59ffd62d8e076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901613, "uuid": "2928ddd7-4732-4ea1-8737-57ef7d50a7b0", "value": "T105D4E083F388578CCAABD679C912132FEB7074965714570F23A48A233F672756B2E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901613, "uuid": "2554754d-1e13-44ff-982f-39fa79739bbd", "value": "98e526f6c62c0af6ded6f435c803624c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901613, "uuid": "a27778ca-0c1f-44dd-9ae8-6b1a0d3249c7", "value": "12288:b5IM6RD9r8Zmk/orR52IfKLt4S1ZtT8r/tCuV798J:b5IMozk/MRGhZtT8rVCuV79G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901613, "uuid": "4f86ac56-74d4-483c-8f08-12f03c0b32ee", "value": 641496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901613, "uuid": "8643986f-8c3f-413b-9aa7-26227dc03882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901613, "uuid": "d79ff06a-0b58-43f2-b29a-f28b14bb3cc1", "value": "photo20260411689.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a728638-35f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775945446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945446, "uuid": "7da36a76-8368-4564-a5a9-87823ab41b28", "comment": "Malware payload (Mirai)", "value": "d6162d415c73f1234e7622d4715253f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945446, "uuid": "b94923b4-28d9-4264-9000-70a6f71ac5ba", "comment": "Malware payload (Mirai)", "value": "c96a38c78544b359ab55803e0a2982e2de463498c50eae601854edee3d06fa09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945446, "uuid": "5da53f46-9552-48ab-abc6-5c31a6a9893a", "comment": "Malware payload (Mirai)", "value": "c6f4ddab4a5707e389d58c03ad0a732bed8b21e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775945446, "uuid": "e40899c1-a717-418f-aa3c-ddaac7a055ce", "comment": "Malware payload (Mirai)", "value": "d4de1ef504c77405a88f37298b8cf7d5e83fc2de8785a46c4eb17b1965e7999d3f78c9e254835d57b60fcba10cf99f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945446, "uuid": "958fb745-6b9b-43f7-8cc1-0585e8cfa697", "value": "T124142902631C0A43D14B5DF02AFB57F183ABAD1119E7A544F21EFE846772FB1A50AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945446, "uuid": "69283315-5183-4cde-8555-36f998589252", "value": "6144:/Vvpxox+Px9zHw16TXw/ZmTK4+Ehj681A2hNNmt1:/thHwATXwBmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775945446, "uuid": "0167d796-d804-4824-9081-182ac4659fcf", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775945446, "uuid": "2c56f9ba-b337-43b6-9bd2-8a4fa4e8e42f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775945446, "uuid": "fd0914eb-392b-42b5-8f58-50eba47137ea", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d780bb57-3570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889419, "uuid": "1a2b60a2-4faa-40c1-8840-743eebbfc4ef", "comment": "Malware payload (Mirai)", "value": "44ff7cf4ce9a2811d4e05ecfa9fb0274", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889419, "uuid": "f965d37b-ad3e-4a11-ade1-120a55df2a6e", "comment": "Malware payload (Mirai)", "value": "ca1e8d9ff6fa205be0023f14180848114abd0ab799ae275ae48ce909de9e02a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889419, "uuid": "a9bdbd71-c695-4c68-9d47-e6f2c864ec16", "comment": "Malware payload (Mirai)", "value": "a38c408c7fd21baafe958bac22d57e3ed044556d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889419, "uuid": "8b378380-8d80-4038-bd14-49ddc618f438", "comment": "Malware payload (Mirai)", "value": "485cdafeeb70530bb99ea912bfc70f1fd6f8dccbba91d2784949f677a64ac55943d5ceca01809450035c5ac4b0a7cf0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889419, "uuid": "89846be0-8123-4c6b-bdca-d1aaa671037a", "value": "T1F92193AF3B522722CAC1CE0FBB74003842FCE4A7EE5BD61EC994981D846E94D3916B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889419, "uuid": "cc25b306-4451-4f6e-bf95-06cf5acaf5ce", "value": "24:SDqXDTDIDIp8DuwDu4CD1D63DMDq61DSWDSu4dDkRDkkDD3DtWDGD2KlJD8WD8N/:Xp/Le3Ru4CqUzef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889419, "uuid": "77b6f78c-ea58-41bc-a506-5f352f81374a", "value": 1362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889419, "uuid": "8077e72a-f89f-48d5-80f1-6aa6d81cfa00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889419, "uuid": "c8bf9e3a-3c39-4cc7-a2e2-b54e69cee380", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb2781-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896684, "uuid": "bf0d5d5a-1621-4d4e-a312-284658610a47", "comment": "Malware payload (Gafgyt)", "value": "c216c0e5d76ff86830616d2709385c6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896684, "uuid": "c1b6619b-747e-4224-b42a-cdcf9005b0ea", "comment": "Malware payload (Gafgyt)", "value": "ca644c124b6793a548c810299688de39af6c855bdcda92bfbaa43c204ae16750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896684, "uuid": "d632cb88-cfb0-4252-aa63-b223f9c33007", "comment": "Malware payload (Gafgyt)", "value": "0dd4b619f99b598aeeefb8134348a8606fa81e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896684, "uuid": "cfb6f588-9a31-41ea-a541-61d42a91b1d5", "comment": "Malware payload (Gafgyt)", "value": "4fe57b8deac3a3cdca05c86ed17c41afd8991f3a2f976c4a6482f466596d00dcaf85c1fdecdd1a0163e3b910d27f2ad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896684, "uuid": "8c644e34-52b1-4976-ba2e-22abfea923b5", "value": "T1E5B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896684, "uuid": "b6116aa0-724e-4f81-9389-9ffbd17c5776", "value": "3072:FQWUEK1FSHGfs1QbEE6QyPwTs/avcWVRm2pgYMx3IPtW:FasGfs1QHyP8sSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896684, "uuid": "311ec0ca-6f47-4711-ac6b-5fd93b1737ff", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896684, "uuid": "0a09e3b2-9f55-4343-abe5-c482c1c363ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896684, "uuid": "694daef8-be4d-4507-84a5-c10e1033aeac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6047bc8-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911670, "uuid": "ac5eba52-288a-48f1-87d5-61182d368c92", "comment": "Malware payload (Mirai)", "value": "d151ca5d5ed09cbeb058aa77c985501d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911670, "uuid": "ae18ca2e-737d-48e3-8b2b-eaa52910f0cd", "comment": "Malware payload (Mirai)", "value": "cbe5a1a8ee4e150973cd0dbc839f887df2210685d1d8ce7aa3f90f5d6eb17fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911670, "uuid": "c4f8e381-8f2b-4b00-b5f1-f6604113f7fe", "comment": "Malware payload (Mirai)", "value": "df40e93327c9d1158bbf6dced34b4e38d105f8ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911670, "uuid": "98a5cfaa-5e82-4823-880a-bce920418e8d", "comment": "Malware payload (Mirai)", "value": "08c7c1eb81a987c1b83912c97a434da4cbfdfdb36b041b9ca2fce59e52433bfe11ef93db21534aeb5dd421ac5614639b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911670, "uuid": "9ad120e1-f563-4518-a81a-18c025b812d2", "value": "T144533B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911670, "uuid": "dfe4c41f-5710-4f0f-bc51-5b5b3296fc6e", "value": "768:me4gpsM204GEkRbjveXxonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpoznE7Pg:mo3EkRbDKDiDHIFy1X48B2SEzNfAuJBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911670, "uuid": "5cac9058-e4f7-46a1-ab0d-2817b2e9c877", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911670, "uuid": "991c663d-df96-4d83-8b74-2fd9209b6ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911670, "uuid": "d94d2108-5d07-47a2-b139-7cca666c159c", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ebc95-3563-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775883563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883563, "uuid": "7460b56b-8e42-4a3d-abb2-514e3ba84adb", "comment": "Malware payload", "value": "034dd954619fb438a045866cf67d387f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883563, "uuid": "8916a0d5-4411-4b51-8814-5dc90626b56a", "comment": "Malware payload", "value": "cca079aed86d7c0d9a5421fc8775b5cfeea9ea001f4feec59532e695d957037f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883563, "uuid": "085352be-45a8-42c7-be3d-16389a26fd94", "comment": "Malware payload", "value": "75ebe16da4970dd3dd0fe63f1f98fe5a97bf55ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775883563, "uuid": "3097ac7f-4d01-450f-9bf1-94d8a9e19b10", "comment": "Malware payload", "value": "051585d816ab09b6c88f0b4d022a64ded30394139cf7b658f1775379d95afa755773e1fb549c22401107dfd965a7fc4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883563, "uuid": "903a5e30-b0be-456e-9c14-c68069c658e7", "value": "T175137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883563, "uuid": "76707660-87b8-4f44-a49e-74cf828273ec", "value": "768:bdXRWNGxVO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bnlx5cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775883563, "uuid": "215ee590-3cdf-4a3d-8a7c-7651dbc17b84", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775883563, "uuid": "eeab6d14-666c-45ce-be97-4d5a3db8564d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775883563, "uuid": "22f738e4-cbf6-4308-b133-b2c0bc66f906", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1b80ed-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896491, "uuid": "886312a8-5d9c-452e-b195-13318f39e844", "comment": "Malware payload (Mirai)", "value": "70ace99ef8f3b9350063af10303bfd92", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896491, "uuid": "64c30c2f-7c4b-4325-88bc-2b5fa2a5432b", "comment": "Malware payload (Mirai)", "value": "ccde5501dd8c94605aeb236841fd8d6588e9423caa384945d2a6a62919bec9bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896491, "uuid": "f659e240-20c3-451a-a958-efc95a740f86", "comment": "Malware payload (Mirai)", "value": "42b3f63788d4e452510c216db09ccd1d21018cf1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896491, "uuid": "41d8a4b5-b181-4e4e-849e-18013f4f10cd", "comment": "Malware payload (Mirai)", "value": "b53ae5d4d385a530f6e8446c73e969db4d197e453f40f506c27cdc3958adca97fe62552fdd1494c7f67e5a4825e5c735", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896491, "uuid": "dda6a70a-544b-4548-af05-e86840078c13", "value": "T14D31418F65F102A1CACACE0070E14DDA67EDD9D1F398463BDD81AE76C09ED483429A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896491, "uuid": "8f4ad717-a51d-4173-a537-17a7410d1d68", "value": "24:VDdGe18RyBM/hiD1bP72wM6fgo7sgKDJ/4nH9:Oe18Rlo7sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896491, "uuid": "4f13b3e8-e5e7-41c4-b21d-bab63c37e0a7", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896491, "uuid": "9407cbee-1925-40d9-b842-0b24ab936173", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896491, "uuid": "935a4b97-4f6d-495d-9825-2456f68e867e", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55bc806-3591-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775903615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903615, "uuid": "eb1f804a-1fc7-4583-b5d4-5ad189212ec4", "comment": "Malware payload", "value": "8c74dd5fd81ec40b0282ae2eba90a199", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903615, "uuid": "088b5c40-7056-4233-b3b3-28f556ed435b", "comment": "Malware payload", "value": "cdf56c881ccce1daea05059451d293167601fb501e6f7237036ad6fb89df88e1", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903615, "uuid": "dbfd8358-35c4-4217-a0f6-513a33ed63ee", "comment": "Malware payload", "value": "47e89343e4630602a64a9a2e400dda3fd29c2252", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775903615, "uuid": "1768734a-f9db-4601-8a21-e89c6331dcd0", "comment": "Malware payload", "value": "c31b749bd0e73b9aae3c7a0f2eb93a3b7cb906472e4866d361e56e3d8acbfb8ebc47bc21444662d2f62cdf90e5bebe5d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903615, "uuid": "91439e94-33bd-4ecd-847f-b0e11a5e018c", "value": "T10B846C32E3D401F9E1B2C234C5A95306EB727C4A53B8D6DF22D846653FA72A05F2E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903615, "uuid": "3c4764fe-ece4-42a6-b435-53a997f30f02", "value": "ca483eacf1f199b66244e8216cb7ac4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903615, "uuid": "19c8f029-cea5-4fb1-b609-595c649e62ea", "value": "6144:bmusikGJlOAwuWi2mi8sgcW+htyqT5BoZdq4mH1pfCK6OGDlnKB6i:bmusik4lOAwuWitIPt5T5BobmVjCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775903615, "uuid": "c809de04-09b6-45a7-ba08-2d03c4570c93", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775903615, "uuid": "844b3c9b-be08-48dd-bc2c-42560b8ca3ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775903615, "uuid": "be3d3801-f6db-4f35-b626-e1dec65599b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9007e4b-358b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775900991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900991, "uuid": "977f23a4-107e-4003-a973-c67f2908d652", "comment": "Malware payload (Mirai)", "value": "65816698cee25e5fc99a1c8cbac50e21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900991, "uuid": "1e1e3a77-8d40-4167-aaa8-9237892c5fa1", "comment": "Malware payload (Mirai)", "value": "ce3e88c23019a9584945e9434037fe4e589cbb4fbc025b1e01eb6db0b589613f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900991, "uuid": "8618100a-6f32-4c47-8ef4-2b8fb9c9df50", "comment": "Malware payload (Mirai)", "value": "7c63549c5fcd9813abdfa34674022f25ae146f7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900991, "uuid": "b37068f2-b89b-4283-8efb-27aaca16c663", "comment": "Malware payload (Mirai)", "value": "beaf6a5992059f3e8be6cd4d1b21c28120c0abed098fbb74698f75d2e8c4681c771feaaa3330394b7f2d357861d5454f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900991, "uuid": "414eaddc-09d3-483b-987e-b9116da7e4fa", "value": "T1F2142A45EA414B13C0C627BAF69F464633339BA4D3E773069928AFB43F8679E4F62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900991, "uuid": "c3149ccd-a7ac-46dc-9840-84f7735ca538", "value": "6144:JdYppQhNwCFatJW50l6lWwBiyVJBM/RWHhe5Ex:JdY2wCFatJW50l8vVg/8Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900991, "uuid": "fde8a2d0-9f35-4b5f-b829-a8812b085422", "value": 200983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900991, "uuid": "1a349f7b-51d4-4c76-b61d-2fa4460ac7ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900991, "uuid": "3673e5a1-f55a-44f4-9a26-55f46832a732", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e945f3a-35f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775947117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947117, "uuid": "0c34a419-ce61-43f6-bad1-6db8fa276c35", "comment": "Malware payload (Mirai)", "value": "c1f1f54d964782d39e9d344a8ada3ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947117, "uuid": "12e0014a-64a1-44c0-8a91-ca0e63e1210c", "comment": "Malware payload (Mirai)", "value": "cebc631971fb334a22a64f013505ff0bfd90b4ce1455db1085f40775d178aa80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947117, "uuid": "49a067fc-eb37-4004-a7e4-3f89536ce87f", "comment": "Malware payload (Mirai)", "value": "d9a5e7d9274398f3627f9bcca4a5077fc0f56184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947117, "uuid": "2f239108-07f5-4fda-ab0c-2f53fbf4a4f6", "comment": "Malware payload (Mirai)", "value": "e16c285ebb09522710560d3a1648e52d1763f67e35fa1e97d44793a7618e8bbca61d4049b104480f390a0f4a95173b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947117, "uuid": "b77ec0be-0bb8-44ca-86f6-beeb673351a4", "value": "T16D241C01B8518F53C5C32BBBF7DF42953736672497DB7302EA24AEB42F4669D1E2A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947117, "uuid": "b443f9e1-b22b-4371-9312-fcec0f7df3df", "value": "6144:TlTTn0UqxAniWSPFJhlIzy+KJKHtEqZ06L18Hts1QS1:TlT7ixA2NJDIFKJKHtEqC6L18Hts1QS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775947117, "uuid": "2b13ee95-d00c-4e03-bfb5-b7877af6ed7a", "value": 218600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775947117, "uuid": "b1dae060-c29d-4870-915a-0f14df174e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947117, "uuid": "b5d9566d-d651-45f7-8375-9d9e5ad55983", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbf4ecd-358d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775901881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901881, "uuid": "a0218901-0d2d-491f-9dea-fac43d5ee5f6", "comment": "Malware payload (Vidar)", "value": "3c562ad0600d318ee88f27196cc4c08c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901881, "uuid": "07c18bea-9b28-48c2-b5f7-ecdf604aa243", "comment": "Malware payload (Vidar)", "value": "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901881, "uuid": "07c36b87-4bc4-48e5-8e02-01771a4d8197", "comment": "Malware payload (Vidar)", "value": "d8d1358bc727485fe663654c9b9c12f016468cd4", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901881, "uuid": "494e1748-cc58-4ff9-b69e-59e5b5fb2498", "comment": "Malware payload (Vidar)", "value": "6248a5e3da22c84de7644cf6e204e934ceaf1514c35286b4378da21188fcc856d493d1f71116808aa7e8c8783d8dd168", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901881, "uuid": "2e18655e-e06c-4c83-ace3-44d5e408ed10", "value": "T106C58D0B6CA549FAC4AAA73688B352D1BB70BC090B3233D32E917A742F767E01D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901881, "uuid": "0df90a88-c880-4d53-a056-13306c43524f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901881, "uuid": "b9725eb6-4f34-4a8b-9c80-647fa7a4a1f1", "value": "24576:luwTdpAeQP4Gk+0hu3S+8yvyzQ3yEDmQcmD+ypoA/lqfUy8Fhheleh29mhP/BQv:l5pzQG+0hiSmywSaVUUy3sHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901881, "uuid": "e425efce-c226-4018-8277-65a3b84e3003", "value": 2606296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901881, "uuid": "4cd17727-5bda-4250-92fa-c84249f08df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901881, "uuid": "13b21c7a-d490-4ae4-be16-d3cce2e0f2cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79c5fc1-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896694, "uuid": "040fe80b-6028-4e89-aa37-164aeb86e5ea", "comment": "Malware payload (Gafgyt)", "value": "49f8c106792131f3d2692cf799630596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896694, "uuid": "013cc986-533b-4ea0-8674-da22892e612a", "comment": "Malware payload (Gafgyt)", "value": "cf96d4999b62e7778a3ae6a32d6dcca7f0fa832f2c6520e475edbd104a739117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896694, "uuid": "beb04b1a-f70d-450a-a5fb-918ebc71df7b", "comment": "Malware payload (Gafgyt)", "value": "7e51753b45b27abf9d8fbcb293bc094db3d8cf5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896694, "uuid": "1796f812-0128-4918-addc-869b0108555a", "comment": "Malware payload (Gafgyt)", "value": "e0c94413f0a40f03345876e7c1ccfeb1ee10f8545512e4888d18419165b8f423d116e33cccc5e7668fd7c42113cea3b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896694, "uuid": "eab96226-7f03-49ae-97a7-7bc9420bd6eb", "value": "T19AB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896694, "uuid": "c2dd1b6b-e947-40b6-8e08-cb4d6a2fb141", "value": "3072:WD3l+XQzPeV91310pWudkKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCkypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896694, "uuid": "6d1e0c87-0248-4b08-be45-1a2ad5dc073d", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896694, "uuid": "83a509f3-c8bc-49e4-bf91-8980508ed505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896694, "uuid": "ebdcbffc-f040-4dd1-a988-5aa5ac0d8d9d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618e48be-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931741, "uuid": "551ef18b-1c37-4f06-92ba-38ff12d780c9", "comment": "Malware payload (Kaiji)", "value": "55de5fc1d8e1fedbdacfda1f3936e03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931741, "uuid": "0cc079ef-7269-4af7-b8a1-ced28c4a9aa9", "comment": "Malware payload (Kaiji)", "value": "d15452ea2f112c4a1d52a0459622483618598cd8796f9cab8f23554fd0f53285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931741, "uuid": "9d69950d-49f2-4e7a-9850-3d4476caaf35", "comment": "Malware payload (Kaiji)", "value": "1cd026918e52cb27dfb0bfbba901cccb6d5f2695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931741, "uuid": "215da8c4-4066-417f-b5a7-de00f35cc93b", "comment": "Malware payload (Kaiji)", "value": "a98b25e269c3baa4a14c16907c69b6ab366ffd40521904053f59f9db801a5dc59ed4494d7d5189ac7603e0d87568e4d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931741, "uuid": "1974bcb9-c387-4758-a2c6-1f5f021a545a", "value": "T1CDB5F80ABDC16F7AD59C03354AEE165A23513E495B91072327A4F7B83A7733CAF1B488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931741, "uuid": "d1011364-9bbc-4e15-a3fe-ea410880e1b5", "value": "24576:mU9tyqIId8F9/dQbZ97G8J6C0OVXc8RuMFLGk+koAe0G4Zz1v:AqIIqrlQtz04uM9Gk+CeCZz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931741, "uuid": "c9a420a3-2abd-41aa-a228-2620acf56c6d", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931741, "uuid": "a8ad266b-008a-4b51-8b1e-a7eb13a50a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931741, "uuid": "18999422-ed59-48c0-a3a6-93887400b058", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec260fa-3589-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775899900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899900, "uuid": "a8d8636e-4b01-4061-abd6-3e11e0b1e51d", "comment": "Malware payload", "value": "05fec73121dc5ecf4ea5f3e811531771", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899900, "uuid": "9cc6de90-5534-457b-968b-32c4808dc747", "comment": "Malware payload", "value": "d380bd25e07229cf11d5bd93835bcb2dd8d981313d45845332e244dbf01f3367", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899900, "uuid": "455030e2-6edc-4e22-b491-ad8f0884c928", "comment": "Malware payload", "value": "7db627254c3aded401d2ded75a501a8980c4cf7b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775899900, "uuid": "b96dd555-d060-4225-a57f-86635a358e26", "comment": "Malware payload", "value": "bebbf85a37f24dcb422b3a43016d04b1ac8e9ab0565d2e14858d270dfbbdae5ac24460470db32f6aa43907dbcbdcff65", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899900, "uuid": "cfc09038-93ed-4059-a759-95a3dbf6cd4a", "value": "T11016336E24785E03EC44D1371A937ABA3EA57E094309D84FF526B8F2C15E8F25627F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899900, "uuid": "46301e38-846a-468d-b4df-f60c51dd3044", "value": "98304:vRxzauz0CUQXnv8R6h9W+TkhwyGOJzo4AdOzlbCnk610VC5y:vzauwCUkkR6h9W1OOJqdOCk6Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775899900, "uuid": "74c137ae-c704-46fd-afb0-cf554b295919", "value": 4287350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775899900, "uuid": "3edb4864-c9aa-4f44-969b-f84e8a7fdde9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775899900, "uuid": "b30ad2af-8693-4f98-b2c6-0c359ce96551", "value": "Zyrey.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e89e03-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896686, "uuid": "7f503160-2eca-4ff7-b088-8902867f9e0c", "comment": "Malware payload (Gafgyt)", "value": "f89d43c8c5f06855d82c3bf2cd8f4085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896686, "uuid": "5f2e736f-f294-4700-8534-c90d3ac12c49", "comment": "Malware payload (Gafgyt)", "value": "d408f3699dff7586e85a733982cebe29748f5ff3511398e026414f0e3f9643e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896686, "uuid": "66b6be7c-6374-4a46-ac46-3fc48ecc20f5", "comment": "Malware payload (Gafgyt)", "value": "17bf7caf5ecb7b571f0dda4e83d83df4b1ec6ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896686, "uuid": "23b7fb65-c055-407c-8a2a-879cf8697a58", "comment": "Malware payload (Gafgyt)", "value": "e721edfc9159e357e6466a60bddaa3a384a7496cebe8a11fa7f3a9af1f5c46de9232bf6b0f4422d2c751259306309362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896686, "uuid": "7ac09003-dc1d-43ae-b29e-6f8c5efff824", "value": "T1C6C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896686, "uuid": "8261be75-85e0-4f16-8a44-6898a72a7b23", "value": "3072:H63VpNeuWDGeQf8sRCtt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCtt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896686, "uuid": "6b7ff540-1f68-4a26-8c52-3d5daaa50de5", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896686, "uuid": "2adabe6e-ff9b-4192-8db1-8168b3509db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896686, "uuid": "b161f46f-3f9d-4e9f-8f98-f6e6363c8a5b", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f32e48b-359f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775909350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909350, "uuid": "2e0b9e4d-8b8a-4711-b47c-5387d5ba3685", "comment": "Malware payload (Smoke Loader)", "value": "9bf4fc560fd66d2ca8b672a6fe1aa13e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909350, "uuid": "a3a295aa-dfbd-4942-b68f-0b3dc90bc4e4", "comment": "Malware payload (Smoke Loader)", "value": "d4c0ad704d63fb6a994ac68a5f3cde09819118a8d4d801b22bdf5563d467a6fa", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909350, "uuid": "0a156628-331a-4a4e-8b25-b493a4fe6d8d", "comment": "Malware payload (Smoke Loader)", "value": "224ba70ab7f4e737d01f62ad363670c3bc667143", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909350, "uuid": "43cf8729-6bcf-4eb9-93e2-b7699c25d306", "comment": "Malware payload (Smoke Loader)", "value": "7816ed2fc68978578234bd4943293d6cd6342d38568e2e6100e8bcc5493b1182baf5493f57e39e4a3647706325e46143", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909350, "uuid": "aa5794fe-de7a-4603-a0c1-bb37e32b81fd", "value": "T134A57C1B7C9585FAC4AA97318CB65291BB34B8094B3233D32EA27A743F727E06D74744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909350, "uuid": "882773e1-ea0f-4a3e-b0b8-f69e694dbc77", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909350, "uuid": "29101213-48cf-49d1-8e83-1f76aeba2f31", "value": "24576:7BB7jc3ujKwCL20L+ETP3EMMBaTy+Oh2YfO1/cFhheleh29mhP4TTdM:7P/ouODq0LtrjMYYW1/XsAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775909350, "uuid": "65f2ba1f-0c26-4bf9-8b09-87149f527632", "value": 2196696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775909350, "uuid": "617c350a-ea10-40b4-976c-4b4a0acdf3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909350, "uuid": "7dbafa52-1813-4b55-a4b4-ca8601d1cb0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfa8dfe-3581-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775896567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896567, "uuid": "6eba10ae-23b0-4ac1-8310-8c0597ecb21b", "comment": "Malware payload", "value": "59e666f4cc91341ecefad69624f07f48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896567, "uuid": "e3285fad-395e-440b-903b-5e3d8cd3b7c8", "comment": "Malware payload", "value": "d4c7762493ea3ec949ad0cd974629599f818664177c5371dcb6ab46e0cdc0b1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896567, "uuid": "fe7831ad-31e2-425a-b5f3-7889ecb2fe64", "comment": "Malware payload", "value": "7029d414fab33a6c6ce5efec4515d1ba66b8c380", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896567, "uuid": "f80ed95b-b830-4e9f-b0b9-88f8e648744b", "comment": "Malware payload", "value": "9261dd8c8337f493885b95ceb70603970da633bea942f8e9c93a597e51ced9a17460cc10c36f7b5137322dd41fa45ff8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896567, "uuid": "cfdb57d1-8521-4f5d-a68b-8d817a00af7f", "value": "T12306011189C46FB9CFAC571C90FE160E53F04A8E542AB98EEB33BE47AFE7544411B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896567, "uuid": "317af76b-020e-49c2-a194-c9cc891cf417", "value": "49152:wsHNGj2i7xTIQb0zi8sWHkLyAqSCikWj06GLeiVYNxZZbHUrPB:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896567, "uuid": "f9b4799b-ec2c-4263-a061-082d59d2dd72", "value": 3987297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896567, "uuid": "6008237d-1d98-479a-8a37-9158952bf158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896567, "uuid": "630c827a-bdf6-4823-a7a3-b1d5c123d1f7", "value": "Purchase List and Technical Drawings Packing Changsha Vigorous-tech Co., Ltd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21c95c2-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911663, "uuid": "eaabaf0e-8582-4fb2-808e-edd5a92df298", "comment": "Malware payload (Mirai)", "value": "97bd6ffc1a94f017024a381cb6396b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911663, "uuid": "80fbd402-489c-41df-b4fd-3e7ce103f4b8", "comment": "Malware payload (Mirai)", "value": "d50d08a189d3406a56f01cb867bc071345a4e8ddf61fe23279f2e2478db99b83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911663, "uuid": "5953b0a3-0d23-4503-8116-2442c6379c50", "comment": "Malware payload (Mirai)", "value": "36adfee47c158018bd79b6c061dd87d397bc2025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911663, "uuid": "3d28722a-a462-458a-b74a-416937e47340", "comment": "Malware payload (Mirai)", "value": "a54bcbe176e46af8fe60e91b703028cb6fc87c3908838c6e60a4a343e678350e70e407bb843a100cf928768d9dc80f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911663, "uuid": "2dcc7457-6daf-4acc-98cc-3bbc4a241158", "value": "T197C2E11695FB4E11C853433B661C186B32840E99B70DDB2D297B47E723CE8A50636FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911663, "uuid": "f8a9cb67-38bb-4a9c-b33e-e7c54d364803", "value": "768:f5+Kcrb9VDJes9kU/XOvfNCM6U+Y74ItVL6:slrb9vesCUqb6U2Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911663, "uuid": "336572fb-c198-4811-a36b-c9c5fe7c6a0b", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911663, "uuid": "22e30f2c-c3df-4ba3-b0b8-ee976ba7c1fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911663, "uuid": "0eebfb36-0849-45f3-9a03-6a913981dd99", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e4632d-35c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775927084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927084, "uuid": "6f7676df-d885-4ff9-a106-3c0e40d9abdb", "comment": "Malware payload (Mirai)", "value": "8a1c22bc699f55bfd5b7c488445cd2f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927084, "uuid": "66473cf9-55ef-4870-b05e-c18545a6bba5", "comment": "Malware payload (Mirai)", "value": "d559dfe71a23dff0cde233d41152355fc4d8450417b8cf4000723c757123c3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927084, "uuid": "a52f0d6e-bc7d-47fc-a7ce-b886b9dc0030", "comment": "Malware payload (Mirai)", "value": "d9f7216ea4ec2b3411c55f1209c09dab6242793d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927084, "uuid": "bc3d8482-3439-4ede-9824-47b31b009fc0", "comment": "Malware payload (Mirai)", "value": "5f6be4fc3f7674acf261e4722eef7aa11fe089d503cfd4958f1d7172d43089a540785073bb63931b3e08e6d09bed95cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927084, "uuid": "6e323456-1200-4e6f-9018-6b5d05c3fe34", "value": "T1A0041956F8819B12D5C112BAFE1E128E37131BB8E2DE72139D245F71778B86F0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927084, "uuid": "2d215cfb-081a-4b9c-8182-0ff7b225de64", "value": "3072:/vpJ3+AY1iopmnaUdksYbXZSaH6kbX3R3o7fF25+BERUY1:/vpNFY1io8a2+bXwaakbxo7dJBERUY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775927084, "uuid": "e6020254-b336-444d-aa1b-a923724db6ee", "value": 189244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775927084, "uuid": "b725a52c-ce8e-4bec-b167-b5dfb6cbe656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927084, "uuid": "075cfd1e-79b0-4d15-a35a-601ed6c0e0ea", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f1b95d-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931718, "uuid": "d8a262bf-3d32-4c23-afb2-9324841043de", "comment": "Malware payload (Kaiji)", "value": "c00e68b946e780f7a69884ec33bde982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931718, "uuid": "042464a5-c02e-459c-85b7-fef71213394e", "comment": "Malware payload (Kaiji)", "value": "d58fc53713b865e702d0f5cf91126282eb6ad5f9b3f57e5805f0f237e11e884b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931718, "uuid": "fc695522-ee8b-4155-98c9-c72ed70c1780", "comment": "Malware payload (Kaiji)", "value": "0e85a346b8aaf41a3371f5cad3614d87d62bce43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931718, "uuid": "20a3aa48-545b-45ed-99ab-3f041246d7f1", "comment": "Malware payload (Kaiji)", "value": "581a0dd16c13c62eca8c06bbd9cecfba86619b7dae051459a362e043ecf9b6908bbd88d609d7ecf19dcf915947f06adc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931718, "uuid": "00d382e5-bc2e-4630-beb2-2fcd13e7edff", "value": "T1D3B5F8117F49EE5FD69422354EA6C33833967C14C2A03133AB51F7292FBA2B88D5ADD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931718, "uuid": "2f3b035f-d90d-429e-b60f-07365125fa27", "value": "12288:WY8Zinp3M6B0XBgI19CUdMp3LAQh1CHpAaxVX4ltPuMFLgbM8yn+kvgftZAMcq+:bm6WBkSXVX4lRuMFL4o+k4fcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931718, "uuid": "4e6b31cf-552e-4d4d-ab2f-9a1026711107", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931718, "uuid": "abbe37e0-24f2-401a-9b52-6a8818e6bbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931718, "uuid": "45ddb3b9-3275-446d-97fd-7a44cb4fb082", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffca0bd-35f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775947120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947120, "uuid": "8611b6a9-6ecc-4fdc-80ab-7ce028e8cb5e", "comment": "Malware payload (Mirai)", "value": "85e0f48efb4c1e440f5f6f387dafe4d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947120, "uuid": "3be70685-8096-4b0d-a424-ce53d3259e68", "comment": "Malware payload (Mirai)", "value": "d5ba31f3cc0a1ac9ae8e0f31c93aa8d730f47d9ed4241cba168c69547711d916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947120, "uuid": "2ae0c2e2-c4f6-4dff-8d81-18c661a220d0", "comment": "Malware payload (Mirai)", "value": "de772d676ec81d71c4c33d4e07c5de18151e914d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775947120, "uuid": "b90113ab-1498-4ee4-9199-40317cda819d", "comment": "Malware payload (Mirai)", "value": "4a7dafca08479b9a76b23f3b510eedfb1130e07865d4ba50f10d65b90c15fc93214f403b40aa6e3660bf4b02a0ae1c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947120, "uuid": "f3da3dea-d967-4b2c-accb-62d9dbbcf6c2", "value": "T13C243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947120, "uuid": "12b56470-8f14-47d6-8c57-3936f85c22a2", "value": "6144:wdsy5kWC7FPdGenaB8V8nau41U/m8Fk1HKQdM/RBzGy:wqym5dGenaKV8nau4iOmlQm/rzGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775947120, "uuid": "7993a9df-a059-4bfa-b024-c10725eaba10", "value": 214185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775947120, "uuid": "8fbbbce5-750d-4b15-bcd1-036689152eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775947120, "uuid": "59d498d7-fba5-4a20-876d-8ebef8ce84b4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5631f1-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910984, "uuid": "43a18760-20c6-4c44-919e-75a3bcbf53ae", "comment": "Malware payload", "value": "efe4f68f1aedaf66ea00f85049f2bede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910984, "uuid": "69d1ace7-2d8f-455a-8cdf-d9f3b0327c9b", "comment": "Malware payload", "value": "d6e12c00ce5286cb6c25fd6e00eb392d7d3832d03023a2b34b5019cafaf6e422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910984, "uuid": "ba99b8cb-0030-46b1-a1c3-c01faa9ee665", "comment": "Malware payload", "value": "00e7ccb37c9f3cfad5f97e47496cd519df2b9a52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910984, "uuid": "dc8b7dd2-eca6-4ab0-b136-e7615799cc3c", "comment": "Malware payload", "value": "1980e56b2a6141b235636f511bb219cceada25510ad673b66ce50c8732c8e8ff5ba7a57e517470fb6bde1728c19420d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910984, "uuid": "c3e0fd87-9664-47a0-b4ee-8d71023f6378", "value": "T1C3341245F5C290B2E6C386761147FFD7E2B1EEB10411DA3AE3483272ECE119DD8D9A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910984, "uuid": "303b8be9-1636-4bde-a9ba-41cca03286a7", "value": "6144:qj5Aap9xUEM2LRorKmm8FuYZZ3y03x+IURtden53R37h:qj5Aap9xUEM2LCrH3FuAJ+b4n5hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910984, "uuid": "4c2717e1-9336-4a68-94a5-6b39344ffd3b", "value": 247203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910984, "uuid": "f4d30cb8-14e9-41ee-a1ec-84bb07bb9f49", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910984, "uuid": "fd9df723-ed62-42dc-89fe-16d54b1a3909", "value": "k5gx9u07gi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd373507-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911735, "uuid": "b02f0f53-104b-4f12-8d9a-93452fdaef41", "comment": "Malware payload (Mirai)", "value": "e5c5ba164a6de1d494919529ee37d7e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911735, "uuid": "da37a337-3567-466c-aec3-4304f281a909", "comment": "Malware payload (Mirai)", "value": "d704b518f1f79fba8a585946ce1f2e0be198ab9db36c177d3f2016b78e709f01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911735, "uuid": "c80d3b63-00e9-44e6-a7ea-77b1212e2e49", "comment": "Malware payload (Mirai)", "value": "95a7f6044ddc11e8dfad457e4aeccd35c987ec12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911735, "uuid": "abd23a4e-3f24-495f-99bc-9088aa9f6a2b", "comment": "Malware payload (Mirai)", "value": "58cb7d74ab5ed536084fb564e9b3e7b7d4ad3897e14dbdfc13e30e612e9db68baab449f307602c7516ea4f42c1fe2a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911735, "uuid": "efa47c88-b83e-49fe-a35c-6df82ae1ad66", "value": "T1AA533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911735, "uuid": "1244d303-d5b7-4984-b729-307980209181", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAnLmZ8BBSzjrYiyR7gHX1SPgIaalR:VMLSBq14Se4GgLTBygfGXAgIVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911735, "uuid": "b9f32c55-7c72-4fdd-af28-51141a3adcdd", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911735, "uuid": "74c6ea8d-fe20-464b-98e4-44052344e529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911735, "uuid": "b8ad6a63-7a90-4ad1-a79f-db9107ed11e9", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2918e878-35c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775923915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775923915, "uuid": "c8778e22-7f5e-4c86-b301-9bbc0533b55a", "comment": "Malware payload (Mirai)", "value": "65e072740ec3dc3eb836fbbc63f7efb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775923915, "uuid": "048aa2af-9447-44c5-b4a3-07c247d3a24a", "comment": "Malware payload (Mirai)", "value": "d87e47e133804399b8f9509a0d5f0bbba23f92bfbecec54fbb772ec82008352f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775923915, "uuid": "87296ece-3369-43f5-a87f-e0c5f8214838", "comment": "Malware payload (Mirai)", "value": "8dc8c4f93753b79ff8343e7ad3c453e76e827c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775923915, "uuid": "e4867fb0-a2c1-4d1f-b4f6-1c7d469bcff8", "comment": "Malware payload (Mirai)", "value": "ea0d573e9a0454b20f63ca09aa99efa5e434a4dc059b0c25cb8b583f0aa33bc9f6ed63a2fdc47919a82696de578ff3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775923915, "uuid": "8881d850-c939-4772-b1de-34bd51941cb1", "value": "T1F8C38EC4F683D4F6D8464971206FFF329B32E87A2029EB42D3A95936ED52902C917B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775923915, "uuid": "33cecd56-d928-462e-b207-ecc08362d7bb", "value": "1536:Lhch7B7Oim8B3Ou6Du29ICKMWrQ8GmZZHLEHwf1UfySIduQ2AHJx:Lhchd7Bm8B3OVDu2qLMWDTZriwcbYH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775923915, "uuid": "1d030f12-6ab3-4f18-8c41-97f6dcf4ab71", "value": 129804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775923915, "uuid": "002feac9-7a2a-4211-bcb5-0cc9ae6822fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775923915, "uuid": "e304b51b-5d93-45a1-be7a-06f9cd829377", "value": "ciubuc_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfb3006-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888086, "uuid": "8e978671-6875-4df8-b4d5-6428cbe795ca", "comment": "Malware payload (Mirai)", "value": "93556fbe94af405b706ff903249061b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888086, "uuid": "b8f7b0c5-c17e-48df-a46e-cd72cd96a668", "comment": "Malware payload (Mirai)", "value": "d8d53c10cc9cf1e869fcdaec7a08ffec291147fe86ba9e9b2bcf3603c2a24a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888086, "uuid": "bac72489-5f3f-495a-9f7b-ac57cbdfb4a6", "comment": "Malware payload (Mirai)", "value": "645d707bb91f3b6cf726bf5b5bbbe8da9b370735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888086, "uuid": "197b7ce2-574d-4169-a02f-ea498bad2161", "comment": "Malware payload (Mirai)", "value": "652e06cfdff46ec8472b8a6ed1b9df08c73942671195a7061d3cb48072328db1de877dade8b6241c7b4a64466ec11c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888086, "uuid": "46add9c9-7cb4-4e16-87e4-077348d89e38", "value": "T1A113F177711380E5EB4B2230D8FA7E0D0450F4C5908ADEBA5EC5D9E36928FCEE5A8243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888086, "uuid": "66e814a7-a732-4cd5-8f26-4ae5029b8f9c", "value": "768:yODg7lacQ4qY2bU74xRoR30tbIoErIL8XWG1+UYZwujhvv4bDqfjnU2w9uuRnbci:0acTRcxHbR4IL0WdZwkvw/qfjCbRnou7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888086, "uuid": "d92ed1c0-125e-4cab-b6ac-2801b1f14ff3", "value": 42552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888086, "uuid": "19e83e76-9de8-48a5-b67b-f38e4adc6ba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888086, "uuid": "5af25ea3-3916-498e-8913-3fcb49964e74", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa14f50-356f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888968, "uuid": "d4f19a4a-e056-4a00-b037-e7ebf0412305", "comment": "Malware payload (Mirai)", "value": "2104dd185328a8f8a9cfdd4e9d6654ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888968, "uuid": "296be27b-a198-4d8e-ae4b-3ba853b93a56", "comment": "Malware payload (Mirai)", "value": "d9468932418de6d6eb1a84a199cd550b550731ee67f7fea03a3c1ba29a20f3ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888968, "uuid": "1a3699bf-07c6-48fd-ae7f-db1bacea9dd2", "comment": "Malware payload (Mirai)", "value": "8222faf33ddfec05580d4d3155f8830aa637e0b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888968, "uuid": "e4798069-96da-4b41-b07a-96a1ecb1e2b6", "comment": "Malware payload (Mirai)", "value": "4a09d610ba39a25b8cc7127d6fb34c291c66f11bf8b715a4acba75486ff452f9930bc7bb8b056c06b51a96dcc51f32eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888968, "uuid": "c47630f1-e98b-473a-9718-5d7e3f0bc6dd", "value": "T1E8633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888968, "uuid": "809be5db-a6c3-4918-a4db-f296dfabb14e", "value": "1536:9yJWBrmSTKrFLTeGwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxLTeK1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888968, "uuid": "1cf1bdfa-7c4f-4048-83da-c8b6461c3d1a", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888968, "uuid": "e5a9a7d5-3844-40e0-a650-98f08e830e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888968, "uuid": "2e2296cb-280c-4620-9bf9-a6b8bac5abfd", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56f3fa1-35f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775946109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946109, "uuid": "3bf563b4-9ad2-48f9-9a18-e10ee6ac1843", "comment": "Malware payload", "value": "9af5dd19c9e1e2e740e1572627b53a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946109, "uuid": "a9ea63e0-607f-4a3c-bd5e-c64a83b692ab", "comment": "Malware payload", "value": "da18ea9c81ebe002c59ac697ebe913b807c444e8779063f953954584b0a90ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946109, "uuid": "9f566a9b-ce2a-4145-8434-5327a74c1ac8", "comment": "Malware payload", "value": "956bba83c94b33e0a978aeac52f64a2193d9281b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946109, "uuid": "d4f1835f-b897-4c0a-97eb-8b2d9afc8643", "comment": "Malware payload", "value": "1a31be6b3a6dc289a59182e25dddeb0e54e44e596d03d92ace65216d864946e84ebf804104cb9d3541cde53c11cd2d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946109, "uuid": "7af44e3f-d99e-48b2-bb78-8264cedf17b2", "value": "T182F285927721AB76C06DD63009B7C75667F63D812B914209B21CE7282E3630AAD5FFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946109, "uuid": "94563064-7a50-488d-b7be-6301dfa30de1", "value": "384:2ApNGvv7bbSh6o/bClFbm3JgswOdI1XoV+2cWqqXsg6kBK8pd/VFp7znOEJ8pfmh:Pm7Khj+l1m3Jgs+Lq22L7eWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946109, "uuid": "b07140cd-9cf8-41c3-bd9e-17d1b3db9c40", "value": 35884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946109, "uuid": "57519b00-ed8b-43d5-a6bb-54bc56ff4f27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946109, "uuid": "9de69e9a-a7d4-4c8f-a853-ae8734fc39a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1760226-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911743, "uuid": "9f69e486-56f9-44b2-8109-917aa13ac559", "comment": "Malware payload (Mirai)", "value": "0d274fb4987db4c2ffd4c0e6d362f52e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911743, "uuid": "5ee757e3-a10a-4bab-b84c-6c86c6857745", "comment": "Malware payload (Mirai)", "value": "dae7c3516ff5d5454833c843152044adf4c6743093c8084c9df15473818e3ac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911743, "uuid": "2381265d-c8ed-4a33-8563-aca5b1d10b25", "comment": "Malware payload (Mirai)", "value": "1aea4fcc51f7941b05ad50266ee860802dbeb31e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911743, "uuid": "185526fd-e690-49db-a3eb-55aeac345504", "comment": "Malware payload (Mirai)", "value": "31329a548e42c4fffca22433129ad66443a87bf4b46343effe1128eeedcb19065526c3197bde2177b2c116ccf26ac829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911743, "uuid": "4c8d9f8b-7234-4133-b216-14d5d9f1edcb", "value": "T14583C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911743, "uuid": "535ad59b-25e2-49c7-9ee0-a2ba838cb2fe", "value": "1536:E6/iw/0w8HoQ5uy8NxflcJ0vXxh11xYqcn6BZOpkMoAzgR:x/8RHTg9cJ0fmqJZOpkM/ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911743, "uuid": "df0fac37-67ec-4ba8-81c4-cbef91bf789f", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911743, "uuid": "af052dd2-3b4a-442a-9abc-1133103ada0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911743, "uuid": "3d1d1e96-9d6d-4a9d-97e8-b6d32601b986", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204425fe-35ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775915311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915311, "uuid": "676d7b6c-56c8-4d93-afcd-fef1fb8c8ea8", "comment": "Malware payload", "value": "8dd7fd99e72890fe8bae15a1852c4de3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915311, "uuid": "aaa4bed4-3a55-4eee-9646-8e90837416af", "comment": "Malware payload", "value": "dcab39194b911c75a1b63985b1a5eb9f8c1872b2c64368ee4f686787867d395a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915311, "uuid": "68e117a4-322f-4d44-b92d-e25a7ef7d6d0", "comment": "Malware payload", "value": "8c9cef66db480667420ef2382d775af148f53c7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775915311, "uuid": "f1e27a03-b726-4902-98ae-f5bfa2615c27", "comment": "Malware payload", "value": "e25134381267b536a21419f9b50c84e4f2623c3e27faa8f26ae21ab6f6525ac363a0af2e9f2a502a0bbcde21bc1fb805", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915311, "uuid": "2cd9bac6-a631-4325-a708-cfdcc9ebe123", "value": "T12371F20A97E84657E47B03346EF3072767F4F9945B73976E098092197CB17204E71B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915311, "uuid": "0575db5b-42a6-4e85-b429-a16da11dad38", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915311, "uuid": "b352eb09-238f-42b3-9d2a-0af686eedcd7", "value": "24:etGSkcRGOEwUnV4pcvTSB2XdBIwCUK7tkZfUdrw7SWI+ycuZhNpyakSuTPNnq:6B2neu2Oiw3JSA1ulIa3Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775915311, "uuid": "c9685d50-8003-4762-b6fe-e12d5eb6192d", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775915311, "uuid": "05510037-4c9e-4e46-91e5-3e502341ea03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775915311, "uuid": "ae467893-9ea3-403b-9444-d8b4ce4aaba3", "value": "frizdfkf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5618e50f-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931722, "uuid": "d804bdfe-bf9c-44fb-9ab5-1a0ae032a6ba", "comment": "Malware payload (Kaiji)", "value": "b1a3e0881cc056e2b4bdbaaf6608e003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931722, "uuid": "5b16ff90-962d-41d9-a826-f515ad916c96", "comment": "Malware payload (Kaiji)", "value": "dd0193318124d2329bdc2f8f34cbd3d0181f52042a1033dde9cef7ba22cfcf6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931722, "uuid": "7d5585d7-0783-46b9-aa4f-8b5ae60bfd40", "comment": "Malware payload (Kaiji)", "value": "8848c3ce7b91c89e392ebb7b27a331fd503de744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931722, "uuid": "0e73a8e5-d7a2-4148-8524-fb3e6a811772", "comment": "Malware payload (Kaiji)", "value": "1daf1076861fb9584f5e09ae122eb146c50ebf1e030e9ad80f517606feb70a3c27fcda59f10b70fd7dcbc65174c493da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931722, "uuid": "9b7da131-79b2-4ac0-ac7f-803783237c30", "value": "T119955B85BC9DA912E9C97EB56F2502D07225FC4D9F81C7177A00BBAE6DF23588F21360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931722, "uuid": "1483d641-d8ae-4e6c-8253-004c088f245d", "value": "24576:/wRmgu8dG9qDQtfTBmW0NREmCNPC498U4TprOEa6QWgrz1v:/euCG9qE5BSIAUrz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931722, "uuid": "1f71bdf4-c620-4218-adb3-b0085071df72", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931722, "uuid": "cf21d6b3-476e-4377-ad21-5cd0d0154c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931722, "uuid": "e28058b6-e1b8-4009-9c71-345d5a2af019", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1e16e2-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888083, "uuid": "47110a40-e583-4979-b296-e3d9ad766821", "comment": "Malware payload (Mirai)", "value": "a5fe3920b446e150f572480e24f21d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888083, "uuid": "9f222728-6e90-46d8-9adf-d6eda3e54c1d", "comment": "Malware payload (Mirai)", "value": "dd6c2d5fbb4d3268ecb30692042b09d8ec52a60b9272d879f9c2fb905e8345fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888083, "uuid": "d11700e6-cf66-4062-9c2b-87fdee270059", "comment": "Malware payload (Mirai)", "value": "e8432ea13f0bfa973a22a28755952eabc34da7af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888083, "uuid": "904bc87e-aefc-4e9d-a235-c6dccebe4908", "comment": "Malware payload (Mirai)", "value": "ec8a1d0a635a9b38dfc91986c84d82126bb930db0a9d413fced092d98a545d32c2e916b44d50807d0c4589af7e15b986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888083, "uuid": "85ff808b-b8d8-4c7a-91e0-7242fc5a4036", "value": "T1B713F1E7D0FCA752CD1C1A7E98C7F92E1C50DF0C1F9AD9D90988783A944AB2966085C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888083, "uuid": "f4afc6c3-7973-48c8-a645-d5735a6cc524", "value": "768:Sp0/5yl//KEoBSmI+It8tH/H+l58/T2oiyMjYESMFBZ4EinbcuyD7UHQRjV:h5yl3UBSmI+O85H+l59yM0MFBinouy8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888083, "uuid": "c66c1b3d-2377-4a95-a96f-d2c090653cea", "value": 41468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888083, "uuid": "168b4606-9881-4488-b309-f49c1ebd5b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888083, "uuid": "cb3d4cd0-7919-4c85-9882-852cb00381c0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee95b88-3577-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775892277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892277, "uuid": "a6835e6d-f30e-4279-8c74-267b4de2b2bf", "comment": "Malware payload (CoinMiner)", "value": "6c5ecd0c95f9c0972837390cdd01f088", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892277, "uuid": "d6b4b27b-0027-4955-94c9-d28f824171b9", "comment": "Malware payload (CoinMiner)", "value": "ddcd21cbbefbe87db9bf2d1560b3d116015ad0ca4d06a8ee2a6692e2bcc25329", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892277, "uuid": "f2c0f39e-2a11-4218-bb3f-4c1068368126", "comment": "Malware payload (CoinMiner)", "value": "1b1a118785591068cc2c589c049e056262876d33", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775892277, "uuid": "c72d5331-b2cf-49de-a463-383dd211b936", "comment": "Malware payload (CoinMiner)", "value": "fc96bfc74482721267e0b7d723b921198345f9bb08edd537579ed2b55e6ad0c2196e971564c251193aeedcfbec7af45c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892277, "uuid": "a854a39a-9c7a-4867-bd39-2ae9b1760725", "value": "T180361252A4ADDA33C035C67067C1D438FAA57EB904ED0B0DBB8876C749B73CC566AA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892277, "uuid": "1ecc6b18-00fb-47e4-a713-c349b44b2b63", "value": "24eb3a268bb916f486f2ac2a8136e0b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892277, "uuid": "efbb3e35-d7b2-4778-b80a-98bfd9172fea", "value": "98304:v7MnKRFpNZpm854v1VM46Nv34vbrvAp5pMyHNQJ9T8dL9fdJ:vgKTXZpMw9YacyHNndJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775892277, "uuid": "aad1a328-c52a-43cc-9dd7-2a8c9222dfbe", "value": 5246976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775892277, "uuid": "8e628903-ea9a-4123-a374-75edd6ee5208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775892277, "uuid": "4ff2ad80-91fe-49c2-b4ae-ba9474a02c34", "value": "SecuriteInfo.com.Trojan.GenericKD.79768489.15440.19727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518ede7a-35d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1775931714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931714, "uuid": "76b411d3-d0e3-43e7-afde-f275c68eef9f", "comment": "Malware payload (Kaiji)", "value": "a61970d0610f5e8eacbfe04c3b2c5968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931714, "uuid": "557a1230-eca4-4b04-aa97-0fd4b5b2212f", "comment": "Malware payload (Kaiji)", "value": "de68bd0d3752caf47af6abfaeb4a4621b8fd8f86302fccefa9d3762e7ca984cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931714, "uuid": "8dd18013-200f-4853-ae6c-2237281789d7", "comment": "Malware payload (Kaiji)", "value": "5e4c05b6fe93968d55b415ba2f77efc45837c440", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931714, "uuid": "192c7234-5349-4a5c-b37e-086d625c7c38", "comment": "Malware payload (Kaiji)", "value": "e76c400ce6daad50b138ab980fa66e1869c620dba1dc5005ee50ed83401e56f174de57b5f21bdce5fe05264da3cef781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931714, "uuid": "962ad14d-beb4-403d-b05a-cdbeeee18e66", "value": "T146A5F857B8918552C4E42637BCBE81C833635EB99B8663666D04FE3C3ABF2D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931714, "uuid": "393cb61c-d04f-4973-a77b-b64fd600a053", "value": "24576:J1rMILphWsdRm6vM7lUVJtq8wfe9OqbVgYQ3k48jtIMoG34hJnWVh1BPnjKqZdtX:JVfjm5Mo2T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931714, "uuid": "25fb053d-6b16-4b1d-acd7-d988d74e9897", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931714, "uuid": "4187c3c5-d20a-49ca-bd3f-d108fa7e58de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931714, "uuid": "8a0a89e9-bde5-4153-998a-1357be63daa9", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53669bad-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775896499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "72da5fdc-1b76-4ca9-9bd8-2d6a70713b12", "comment": "Malware payload (Mirai)", "value": "3647179ccf7401edc67c891e14efb9bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "5de83213-162e-45c9-b990-8433d98c23b9", "comment": "Malware payload (Mirai)", "value": "de850bd8d6d0b865de0d67fe0ea8c2db4c87c84672969153d146ad517d0f0954", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "2138b826-3bc1-42f5-9d71-5e0dbe67b62e", "comment": "Malware payload (Mirai)", "value": "d505bb5b4c345231b4d017b8c84cf387fad634eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896499, "uuid": "cffafd56-0c55-42f2-bd4c-caa1e7d7db0a", "comment": "Malware payload (Mirai)", "value": "160477bd23fd9b5a96cfc800ed3ef251efc3d1fc58fd5f08b7026a03b0d67db68e0cc693f7261a6dd876ddeda871d175", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "743cebf4-ba1c-43b1-a80d-44cae07ece69", "value": "T107B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "755ff94c-923f-4f0d-b975-e4cd7a583401", "value": "1536:j7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxX:vzPqF41OUBljSIxecUtCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896499, "uuid": "e2a2e97e-8055-49f0-ac66-975a565235d1", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896499, "uuid": "411ee328-1941-4a07-afff-10b9f78d1293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896499, "uuid": "e47409f0-2385-4904-84e4-26c79d7e1663", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d48770-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896689, "uuid": "0134a1d7-c602-40d6-848e-520119536a03", "comment": "Malware payload (Gafgyt)", "value": "9f5e95266669e97de06a23b7a361013c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896689, "uuid": "bc2d797e-4349-48b4-a9ce-b067fcdf8a03", "comment": "Malware payload (Gafgyt)", "value": "deb8d67350f8a8798f8047d20a2ef78718075e32b82d38952d791c437bdf8580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896689, "uuid": "3b537687-2fda-4448-9025-7dc24103da86", "comment": "Malware payload (Gafgyt)", "value": "3ef23e3d3636cb83e97f158c5e1096ebdaeb0851", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896689, "uuid": "38fc07b0-64d8-432e-ab8a-0878530c2109", "comment": "Malware payload (Gafgyt)", "value": "d743ef9fde1a82554ead11b8aaf9cbd21921d369cb6dc73c616308d13b426f5d61c2b6cdd96d50abf2f01f806e8e934d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896689, "uuid": "45c35077-fa68-44e6-b7a9-b75b47148759", "value": "T145E38266BB619EB7D80FCE7309A64501218CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896689, "uuid": "33dffeb0-344b-4141-8bc8-9e18c689cf79", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVgpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflegImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896689, "uuid": "d9674843-be43-4aab-9f90-15f458963424", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896689, "uuid": "dbdf3759-7386-4459-9351-653ae730835c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896689, "uuid": "ef6c2b72-e2d9-415c-a257-06e555be24e4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99539b53-35e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775938707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938707, "uuid": "0ce71e4e-76e1-486e-9951-d419d9ab105d", "comment": "Malware payload", "value": "60de3cee99bf7c96f2c771f25d2bff16", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938707, "uuid": "2d629aa5-ff3a-4ad5-8dd4-7623fa50df10", "comment": "Malware payload", "value": "dec3579fb00b2738b4cd49436f8621555819c25b99e2e43fa662544b695c7922", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938707, "uuid": "41f363d4-ada5-4903-853d-df33a4324f77", "comment": "Malware payload", "value": "4d27699d86c0b296088f27d645c4e4c37d71e0fa", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775938707, "uuid": "4943d376-9146-4636-a71b-6b76fca110be", "comment": "Malware payload", "value": "0b341d3532009abe0e03df61ef419a97159d062eeb8e17b9344106c29086dc866e6564711a05b187fe2d6a5983b2221a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938707, "uuid": "68edd222-9aee-4622-81e8-777e83109c73", "value": "T1DBC59E0B6CD545FAC45A933188B612A2BB75BC490B3233DB2E907A783F727E09E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938707, "uuid": "43c3c679-c238-4306-b8a4-d0a42e1dc471", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938707, "uuid": "ccf0cd26-1a8d-4083-b68a-fbc07415d24d", "value": "49152:fgyCrHGO+jESV74pmlXaMcj1O06dU9achBLmVs4vm:fvNIUA1OlrxVHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775938707, "uuid": "723d2129-817f-4653-b72b-92530a70bbd6", "value": 2671320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775938707, "uuid": "c7ece9d4-8dca-4477-9e4c-ba2a17b24558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775938707, "uuid": "72f8695e-da39-43ba-ab1a-23c561a6c497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3ae274-359f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775909424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909424, "uuid": "fbec58f0-913f-461e-9520-e298ca85fbb9", "comment": "Malware payload (AsyncRAT)", "value": "d249bf2ff43738271f9dc492820825c7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909424, "uuid": "7e9e630e-3271-40dd-adc8-22510a3482a5", "comment": "Malware payload (AsyncRAT)", "value": "dee1f9121f3a6682101389f432b4dee709507f7ace0a21d9cdbe373a40998e73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909424, "uuid": "562d5bd4-0477-4003-8612-908b88f2fc80", "comment": "Malware payload (AsyncRAT)", "value": "eab8ac6ad6569e6185acd26192a02f0c9efb2940", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909424, "uuid": "65787184-6df3-4692-a65b-dce8f0b0f00e", "comment": "Malware payload (AsyncRAT)", "value": "0b6a9abc122406b20aa0e490a891ff6245e3b9399a84f62840225ef466bfccc945beab926d880a44c0420dec31bb29af", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909424, "uuid": "ebe97fc8-6f85-491a-86f3-fedaafc16f45", "value": "T10DB47D19E7E405FDE0B3E578CE924912E7777C491771E68F03ACA9A61F232908D39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909424, "uuid": "e1ab34e6-6b65-4d2b-ad67-f94aeb6ca4c5", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909424, "uuid": "a520b9fd-a005-49fb-91b1-8c7f0302d49c", "value": "6144:0GRIMUcZeQiQHkOcxeieDw0hNGA3hjmq2iwXR2D5Yxjp6Rq/sHhTozrAsXd4x5dn:LRZeGAfqNGA3Uq29XIDixjpyq0BErDsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775909424, "uuid": "479f56b9-feb6-42a9-9f0b-2d1f0a4a44b7", "value": 520972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775909424, "uuid": "793dc194-b98f-45be-a183-ba6df3b60745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909424, "uuid": "7c6fccb1-0651-435e-9345-4c3c2e903515", "value": "xdee1f9121f3a6682101389f432b4dee709507f7ace0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca80723-35f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775946497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946497, "uuid": "705bd36f-65d8-4c6f-96a9-71b3f657b1d8", "comment": "Malware payload (Mirai)", "value": "4ea32027e6460f99bcd64d464b6da834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946497, "uuid": "beb773a2-6090-4192-9710-2f97a4c5ea73", "comment": "Malware payload (Mirai)", "value": "e08406f2e345c2687c8b3b89c83e2e12aa44af75d66267c9c4e4bd023f3a369a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946497, "uuid": "1256b06e-7d42-4f80-a8fb-c241a2035d92", "comment": "Malware payload (Mirai)", "value": "6978f9aef85a9d817ea882168494d8d9feb1a5c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775946497, "uuid": "2dd8a67b-1e28-4a82-9a5a-78460c61098e", "comment": "Malware payload (Mirai)", "value": "d5722516a827b39e36f40db4f8d87c52eaea13cf4a8fb4f3a57cf56eb81eea4146cdd70c36030e5738f5efbf598ec3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946497, "uuid": "74311461-9bcc-4c26-b2a6-941c423010d8", "value": "T1FB44E91A3E228F7FF26D877007F38A319769769617E2D644E26CD6101F2438D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946497, "uuid": "2899b107-9899-4456-8cad-d5a8175eaf6f", "value": "6144:eqhNLGuEcmRHaxx7eFkhGCf8U1hWF5NqohWUkzn7MwA0:ewNL9NmoxJf8U1hWF5NqohWUkzn7MwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775946497, "uuid": "2d4e5dba-c6b8-4908-aaae-5b182f69ed47", "value": 257319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775946497, "uuid": "2d2a7ef1-852c-4139-84f5-b2da2de88041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775946497, "uuid": "4fd7a05b-1ec6-4bf5-9563-68fcaf1092b4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164cb409-3572-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889954, "uuid": "95a963cf-d9ad-447c-b35a-8ef76c3f3cd2", "comment": "Malware payload (Mirai)", "value": "cb31af5eef9692be8b60b7e5bd7227c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889954, "uuid": "ac6b19f0-819a-48c7-b721-9f6767f01399", "comment": "Malware payload (Mirai)", "value": "e0d6089856bd4715485cdff83952b434a6f2ef744393f1afc13a7c80a1e45860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889954, "uuid": "90a9c1b4-1640-4485-98c1-bb264b3d2921", "comment": "Malware payload (Mirai)", "value": "c9f466a0c8ac38b02500f01f3078537c508cce42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889954, "uuid": "fa373bd1-e070-4b94-99f0-cae7fe966799", "comment": "Malware payload (Mirai)", "value": "f4c6a073dcfe1fb67e9f8791eb7f88675bc310599af4de617fee1640dc0545ebb2b64851abf06c038927b97812a11a26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889954, "uuid": "677c48ad-211f-430d-a0d0-83a4fd774bd9", "value": "T162E32907B98080FDC8E9C1788BFEA136E972B56D1238725B27C4BE325E0DE205F6D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889954, "uuid": "f18bf1cd-4720-4feb-a09e-731dd73d9971", "value": "3072:LaHU0hyEZfjx+jgPVFJWcwRUlIlM2ycDDmDxT7JuxX:4bTwELw9O20WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889954, "uuid": "5be2ac1e-26d3-4d67-832a-d0c04f4ea96f", "value": 147384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889954, "uuid": "cffc1863-b944-4667-976d-976463c0e5b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889954, "uuid": "a6a15afc-bb3f-4696-a71d-0f141655bf9b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085c796c-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910976, "uuid": "0973cc7f-12a0-4fc8-a298-2dee57d950be", "comment": "Malware payload", "value": "2c3f532e6436400003d6a0257de7818a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910976, "uuid": "13445701-27aa-4871-93ae-e26f6a7f9bd7", "comment": "Malware payload", "value": "e0f03c6082e97e5da39d14ede2ae678040a5664ab99fb4ad7c09b2b5349787d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910976, "uuid": "7f63e56d-9fdd-44dc-85b8-9a5f1b8f4cd3", "comment": "Malware payload", "value": "26c216113826e6abdfbaad50d9862a7090ebd22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910976, "uuid": "6ddbf459-729c-4d71-a2db-a4a1d6917720", "comment": "Malware payload", "value": "839f7d3178a86dc9ef547da9b95af05f679702bd17be594260118c94e9d9092ee63aa1fdea8f7073e87e86e63d956bad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910976, "uuid": "8bf49d09-06ce-4c3f-8a30-d1f8293508f8", "value": "T1696412827B518FE2C76A823601F39891FBE516D216E2E55A772CDC11EA413CC943BFC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910976, "uuid": "006ff0f3-69ce-411f-9819-e0fdcbbcb335", "value": "6144:aIr4FgpCKpC8k6SuEYbMUo5BOvziJ96gfssuFyYH+p2kVm:+ap/pC8NJEYbMl5BgCs/FyYH+phA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910976, "uuid": "06e91891-1ee5-4b07-9185-cdbc9ad79b82", "value": 325228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910976, "uuid": "f8448286-3a05-4214-a0aa-5b3d1eba7d58", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910976, "uuid": "6d661a27-caf3-4daa-9445-208ea06f4524", "value": "u7455i1vg3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7037676-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775911725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911725, "uuid": "db5325cf-3b54-4ae9-9ef3-b82649192148", "comment": "Malware payload (Mirai)", "value": "4e33ba29a67a4818dcc388f5386219e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911725, "uuid": "77aaf22c-a4fe-4772-ab54-9998910eb8f3", "comment": "Malware payload (Mirai)", "value": "e21cbf2af1fa83925c667fe143560a40705672e75a93296e4cd815b98afd448f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911725, "uuid": "903bc0ea-cfe0-4ecb-a45e-4eaff3f9f247", "comment": "Malware payload (Mirai)", "value": "ed037b887b45bcf918be4e50680ce133e9cf2cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911725, "uuid": "7690c416-ea16-4ea2-af22-7fb85484c051", "comment": "Malware payload (Mirai)", "value": "f8ff52cc5d9853c33a450de8ae3fb3b2092176f8a504fe4c7ae6cca70a17f59b1079708e107174805297d819cfeea457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911725, "uuid": "51e83a65-b0bf-42be-8da9-36e7a42c0f70", "value": "T15793D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911725, "uuid": "a8b36542-2e0b-401f-b089-564cc1800df6", "value": "1536:NF2GXYZ8a8YnwEvLNPENIdhs9WZx0ZCufqQhK:NFjXYyvEx0phK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911725, "uuid": "da7df4c3-77cb-464c-9399-cb983b309559", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911725, "uuid": "b57d1c27-4c5f-4a9f-b5fd-dba5f69417ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911725, "uuid": "6142fde4-2201-4ae5-bedc-d0408edfc074", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043bfff6-35a8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775913116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913116, "uuid": "3c1db9f9-1cd3-471e-acd7-fc2898fdb15f", "comment": "Malware payload (RemcosRAT)", "value": "4d9f7a7f96ce51c9b485b9ee508c2742", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913116, "uuid": "bd48ab37-0f73-45f1-8897-4a46063436d6", "comment": "Malware payload (RemcosRAT)", "value": "e29a9375ec13c8a7df64cdf4743fb77d4a3e651550269bf0942143adf42fa110", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913116, "uuid": "fa9aa6c7-dc77-415b-a92c-9c9d35504776", "comment": "Malware payload (RemcosRAT)", "value": "9259e311b40d6eeff474f2a732fc38cc0240a927", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775913116, "uuid": "6bab77a7-9c36-4c8d-b19a-5d242794b30f", "comment": "Malware payload (RemcosRAT)", "value": "0b34801b6ce085e9816c59a264f756f6c5cad199cd33bb709c9518c2d925c52e2151b2f1a5a251f391599ef2a7209ddf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913116, "uuid": "b6c5b883-c2d3-4269-8ccd-16c25098eb93", "value": "T10AD46C55B39442F8D07BC135CA828527E7F2BC056571872F03D74E5B6F232A1AF2AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913116, "uuid": "546fd7d8-267a-4a88-b024-c2c661416926", "value": "f4e833c94f979b4a69174b78399e4f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913116, "uuid": "9e7b823d-c61a-4e32-90fa-62d8226327c0", "value": "12288:c60b+6L0asAdT4Nz63ccf5ua3daKNek2x9oGK5rG3Z:B0b+6gasAdT4Nz6zf5FaIek2x9FK5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775913116, "uuid": "2c73a7ce-763a-4f73-b63c-51e0f78a62ac", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775913116, "uuid": "8750cfdf-eb66-4a3b-9807-514fd5b8f124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775913116, "uuid": "11ec3b06-4591-4f16-ad2d-7f3a16ff89fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e063c2fe-35c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775926370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926370, "uuid": "3a5ae6f8-3f6f-4a26-9392-3f3006b35e6c", "comment": "Malware payload", "value": "929311124900113bdf35a3ee1fea65d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926370, "uuid": "3d50e3df-18d1-4fa1-8fac-e1e18a7020c6", "comment": "Malware payload", "value": "e2f302b31f7ebf9691f61cffa4e7971a5a88a98f088aa82f70fc68cc9cc6b4ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926370, "uuid": "cc48bc4c-2ec5-4ef0-b17c-d645ae432a6b", "comment": "Malware payload", "value": "e908ee22eec2a5152cb0787da4afa3fdf6e9a4e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775926370, "uuid": "63257432-1664-4257-b5a9-a715e7ed54ea", "comment": "Malware payload", "value": "c125873002cebc3e4f30f111e7464df5a60fd402c598bc9c95cf14f62a27894e115449faa0e1877860aa7a38a1223568", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926370, "uuid": "c112f118-f388-4696-875a-29f42b61d1db", "value": "T1F2136D6526953C25AE99883B5C7F2F0CB9A983E1304891DDBF8A3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926370, "uuid": "45f20b55-d1e7-4d74-959e-5851bb3a94ba", "value": "768:bGs9NyXsZztCk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:brHusZEcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775926370, "uuid": "89209376-b62b-4e46-9ac8-4bc110a0ca07", "value": 45531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775926370, "uuid": "51bb0b48-de7e-49b4-8774-a7fc6fe78163", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775926370, "uuid": "cf151495-6778-4b06-bc1e-418481241c71", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4ca188-35d2-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775931200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931200, "uuid": "05576756-efe9-47be-a182-e733dbb61abe", "comment": "Malware payload (QuasarRAT)", "value": "4661260d44bb7e9a0c03f8fc5db39343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PLUSDROP", "colour": "#02F541", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931200, "uuid": "2854a338-121c-4cad-ba66-e5ab89437f0b", "comment": "Malware payload (QuasarRAT)", "value": "e34fed678302c144ab655ebfb54a2493551266bfdf66fd35c7e85c3c6000b592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PLUSDROP", "colour": "#02F541", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931200, "uuid": "96c36396-b86b-4905-a991-e392a1b961c5", "comment": "Malware payload (QuasarRAT)", "value": "7a60d6106d38f1fad07ff6b07d415b640924e471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PLUSDROP", "colour": "#02F541", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775931200, "uuid": "d5653029-c8eb-4115-9481-133b38918881", "comment": "Malware payload (QuasarRAT)", "value": "ec622ca0146cce322608daf4375a0c8ea99ddcb144449c292d314ca49b83893bce80ecc4ca82d214f24b1fc979442b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.PLUSDROP", "colour": "#02F541", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931200, "uuid": "5cb81fa6-9992-4976-bbf4-b91a8cf14290", "value": "T1CD87333AF7868899C6D7C3B8A746DFA298747D040131B5AB02DB89333F5686407DD7CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931200, "uuid": "40162b85-4981-4a71-9fdc-5bc6802a05f2", "value": "4e09edf4d2c143776135d0d82a980620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931200, "uuid": "49a4e4c8-b081-4823-b3e6-d464a1539833", "value": "786432:cXZfq29+3x9a0QZNtU8Eerb93m87ZhsnfPd+4r9O+WuQPJ+Hjup8iuZwHIbZ:Il9oLDQZNtpZrb922ZhsfPdNrYzJRbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775931200, "uuid": "e097194c-cabe-4a41-84a3-615fe5c59328", "value": 37973584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775931200, "uuid": "03cdbc87-1f22-468b-8038-9e6c70ef4549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775931200, "uuid": "1a62bea2-6e13-4ac6-9120-b1115db8bf33", "value": "LetsVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9c3156-358b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775900895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900895, "uuid": "c0295a79-5b47-4306-942c-3bb3bca1aa47", "comment": "Malware payload", "value": "0db6044c52c640c0048b725b9135f2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900895, "uuid": "042f69c8-c85b-4b6e-a011-0a0c7508f297", "comment": "Malware payload", "value": "e3bc168ec734aec9196a0e42cf787888e8842a5ffd4b7271caa0b47a14048771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900895, "uuid": "eef0d8e2-5653-4e58-8ca1-83451a978f19", "comment": "Malware payload", "value": "e9691fbbf905f2488c581b8e3e9fd146e4ef7069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775900895, "uuid": "b5497764-a180-44bc-9795-69106e6a3ad5", "comment": "Malware payload", "value": "4c0ee0e971bca69ef522d3b754fc053b3c03bcb3be38c3bc64d346a3927e7fa6d37c28b62d524b2d82b449177b5f9400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900895, "uuid": "68dd946e-bc06-450b-9b9a-44016fd02cf1", "value": "T18725BF83D292915CF41AC1715B2EA273F537BC458B29AFE76390DA361633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900895, "uuid": "5c706230-55ef-49be-965a-c33490501ee2", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900895, "uuid": "c64f6be5-93be-4f82-96da-b3d468997e5c", "value": "24576:V+pq12TEOEe0JRh+w+NY5b8Y5bJY5bxXr:VMT3EeiRhkYaYrYzXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775900895, "uuid": "2453fb20-e60f-4cef-b06d-7426a907578f", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775900895, "uuid": "441e0360-8752-4ed3-a8bf-485c927304cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775900895, "uuid": "e40e19e9-576b-4fd1-8dff-40681a5f2111", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680f0efb-359f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775909418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909418, "uuid": "335c84d9-cf9e-4594-aeb7-585fde8e1d55", "comment": "Malware payload (AsyncRAT)", "value": "a1a2ae60e1a3bb18e35b71c28f66747c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909418, "uuid": "6b97ade6-e9dc-4ade-b4ba-a4bd275e685d", "comment": "Malware payload (AsyncRAT)", "value": "e3c741645c81ba04a1ce8095dce081f7452b67bf2927fe23e0d68d4f7021754b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909418, "uuid": "c715830a-3cc7-4f2a-9489-1f6694344327", "comment": "Malware payload (AsyncRAT)", "value": "c08068b180e10f685f7a1dab6c68de8b76e88146", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775909418, "uuid": "cee6c90b-d498-41bf-bb76-07aaf4833f23", "comment": "Malware payload (AsyncRAT)", "value": "e9a885b61bf3a83d43cdde1c78f8d8afc50385e27f0c0d4e056ff676f21ffdfdeadd301c411159d1e8486f025b899788", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909418, "uuid": "dbcda1bf-2812-428d-8f53-35f75c77d57d", "value": "T1AA233B007BE98126F2BE4F7899F22145467BF6673603D64E1CC842D75A13BC6CA429FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909418, "uuid": "be3056ff-36a2-4360-9a79-5f9a2063aaaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909418, "uuid": "1dba4588-2e3e-4292-a459-181467339083", "value": "768:Eu/dRTUo0HQbWUnmjSmo2qM/fVZWu5fhu4PI6oCHYwL0bmWiQwqYdQhxAahUfjB7:Eu/dRTUPE2hl+9/CsbmWHwqCtUUtdPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775909418, "uuid": "ab68b822-d053-4c61-aaa2-ce45192405a5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775909418, "uuid": "d8e749ad-0529-4b24-946f-d0d831c56927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775909418, "uuid": "b9ab2e7a-a435-4b6e-9336-ef955e47d593", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a34e59-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939048, "uuid": "b5044e90-d1d7-4954-aaf6-bc12b2baf880", "comment": "Malware payload", "value": "f5847ed553b087a7a684de6d4dee3df1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939048, "uuid": "d56b6fc6-6ded-4ee6-8c0a-1607c67abb7f", "comment": "Malware payload", "value": "e47b9382d9ac1ba3992308d75993b69255b1e4f4fe47c2e2b6cf6a7ec266da73", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939048, "uuid": "3c70d215-9481-4881-abdb-1da423535c17", "comment": "Malware payload", "value": "d06a579b6f79350104e5c0db253d24626f9991b3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939048, "uuid": "f9c7857c-101c-460d-a9d0-ca4c3d2f9fc6", "comment": "Malware payload", "value": "d86bf91a8b400a7be030ee6873b7521e45d709ce6320c2f70451eb8e4a5c009f1bbbc67d6cedfcd420674149327c694b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939048, "uuid": "a5ba0b25-5eb0-489b-b65b-a975020077c5", "value": "T141C27E61BE98F0B897CF330776B4F9969534B7B2A08D655C60EE84C153DCAE0E53C192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939048, "uuid": "b8b7520e-0332-4fd8-bc0c-cbef13d14f2d", "value": "384:j3CCmd4S3p5Y+ugCM0Y2FBAmOiaq0rJxmru83pN:WCY4ovY1gCM0YWMA0qxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939048, "uuid": "8207dd49-e898-4bbb-bee7-38c130fb73f1", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939048, "uuid": "e5bf1dcc-ec10-415c-9b6b-f0414dd06661", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939048, "uuid": "2b7480d4-f3ab-41a6-93fb-0c79fddbadec", "value": "JoseTomas.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dd2d96-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910992, "uuid": "a41673d2-03dc-4f1e-9d6f-52a9dad9b0e0", "comment": "Malware payload", "value": "5eb2a82ce415366bbf1f33b4678fe3ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910992, "uuid": "d401d91b-adc6-4041-be13-4596f54a4ea3", "comment": "Malware payload", "value": "e56200a486dd02beaa7aab0560df4fca2725546c30a9b77deb7d2a43c33091d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910992, "uuid": "6871ff88-d7e3-4286-95eb-541cb4fcbea3", "comment": "Malware payload", "value": "2568a2b6b522e942ac496321d7be08d103027512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910992, "uuid": "8d01ef1f-e574-4fed-9f5f-7044c44a2db9", "comment": "Malware payload", "value": "55b2ac5ae3b365f051d36a0c09d5bbcbb8ded5553243c1643edf796608d7ee85184fa5665622d0703b20a2471921b501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910992, "uuid": "e35b2af3-7314-4476-addd-b4d391cf10d0", "value": "T148341255F8C0EF06E1C2657BFAAE569837074B7CE2CC37039E194A2437DBA664E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910992, "uuid": "4b3b641e-d4e3-48d5-bb73-49065228de40", "value": "6144:6Sarbs4uLXW22fFyejbp2Iw4ShiyQGIehGn4ShAZ/KJwHYo/2:LaH7uSFyeR1w4LFXehGnvha/KJ4Y22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910992, "uuid": "360ed4a5-61b3-4def-8379-5a18d46ce89d", "value": 251025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910992, "uuid": "47835b96-38f8-40b5-b9e6-9eabd0bbbbe8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910992, "uuid": "da57056c-5934-462e-bbd4-a6651489ecc8", "value": "psbcrnbaqk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b7dd12-35af-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775916129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916129, "uuid": "33f7f8bf-6e9e-46da-a11d-07d0a2e1630d", "comment": "Malware payload (Vidar)", "value": "52dee9e794057cafd37f89ba06cb6b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916129, "uuid": "c64b6003-5e86-4331-bec2-078db6f4a5bf", "comment": "Malware payload (Vidar)", "value": "e595751153059aef9ad92d51969d6264564a2d162d42d5c9265f201c67c5587d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916129, "uuid": "9bc851c7-e4a6-45ad-8b6c-376aefef390c", "comment": "Malware payload (Vidar)", "value": "5d9eeb4c915ba5cdd85b10c35301b5021fcde74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916129, "uuid": "35f80949-6849-4a76-83ab-961dc748112b", "comment": "Malware payload (Vidar)", "value": "ccdedaae227979fa8157a125ff4369ae2dfe8d3b4b65dfef7b895347f656784adc82133f5a089d72eedb394530af4470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "Radthief", "colour": "#724F8F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916129, "uuid": "ad26fc54-4c15-4ac4-b60c-bcf7161e5e3a", "value": "T192063B03ADD1C9A5E08AE239EC766692B3F4780C073173E36EA26D715DB73C05936B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916129, "uuid": "1e393dfa-2f21-48a6-84de-797087a30184", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916129, "uuid": "02ccd927-b166-466f-bd45-6d6f4d3c266c", "value": "49152:U/BXtYCLYQuhX8XgI1lgth+1rOcPF86FL:UZ0by1uthKPy6FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916129, "uuid": "fecaba6b-a735-4abd-b045-cec2f9d43ffb", "value": 3895526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916129, "uuid": "69727837-e972-409f-b140-93155c99f8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916129, "uuid": "59d354dc-1f06-4807-8033-961c8e5d431d", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c854cc-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Ladvix)", "timestamp": 1775917248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917248, "uuid": "989e5f63-a67d-4910-882d-06a77b5526ab", "comment": "Malware payload (Ladvix)", "value": "a9174c15b4ac6d1eeafc1416aec87c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917248, "uuid": "3a5290c2-54c3-48b0-9ad4-809fd22173d6", "comment": "Malware payload (Ladvix)", "value": "e71cffd0ef65adef9d73cc1c5f83ed7d8af1d2c9fad48018c568bb5e08a888df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917248, "uuid": "e9eeb0d0-57aa-46ae-9143-c5d47acb784a", "comment": "Malware payload (Ladvix)", "value": "2a56e8320954753fdf6dfa80e06646831551e72e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917248, "uuid": "259d6fac-efc6-40b6-9002-ba6bd2518197", "comment": "Malware payload (Ladvix)", "value": "e457227f0a90c6c6c2667eca02446a7cc432ea539f20312ca54b7b84ee24e6ec18cdb1bb926bab5b14ed7d43d36affdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917248, "uuid": "7e5eea37-258d-459e-a816-048cb399dffa", "value": "T109C58C47BCE058AAC0AA96328976A1967B71FC490B3123D73E40B37C2F767D4AD39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917248, "uuid": "9cb669f0-a444-41bc-8f39-6b9a13e23384", "value": "49152:66mZdQVJ1W4mBTSX4oyF4pi9WsR2YBWpF9Mt:rp0JxVzFmWhQY0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917248, "uuid": "ba402aa5-cee8-4feb-b5a2-48b722b97b35", "value": 2599434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917248, "uuid": "88d250ac-3a2a-42a4-860d-c50ca9abe8ee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917248, "uuid": "1e7284d7-5592-4762-923d-83147b211b83", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29ac9e1-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888149, "uuid": "ddae8494-5d0e-4fb3-a4d1-7c51b6912bb3", "comment": "Malware payload (Mirai)", "value": "77d16ace59960e9e806c7c12311c64ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888149, "uuid": "d8d0d7bc-ca39-4e16-9ee7-6f8575d509b5", "comment": "Malware payload (Mirai)", "value": "e7df5fb58b8a81b4332ad71153701f506bc0370ca587569f4db600d07d63c3f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888149, "uuid": "51067054-0b1c-4121-9afd-34a16f7e1bed", "comment": "Malware payload (Mirai)", "value": "62369ca4938679bace2d052e3c5d7d18b35588f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888149, "uuid": "83873e2c-9b17-442c-bd2d-05eee4b7d418", "comment": "Malware payload (Mirai)", "value": "b851cf3f6b584565f836947b98c082866d523702972ad988fd0730b112c427cebcd68c77d70abdae6d78fb1f2b4b4121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888149, "uuid": "c4203a61-2082-4ef5-a30a-deee1ece4788", "value": "T11FD32805734C0847D2673EF43B3F27D197EFDA9221A4EA41254FAA8E9172E73058AD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888149, "uuid": "ec906b8d-037e-4db2-8cc2-1112828efb4b", "value": "1536:Mr8/fLKLWCgLEVxdjcYevVHL9eZTvAkCXdXhASrTC2+8q1gHfyCb7/:RLKi/IVxdevRL9Xk4bRLbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888149, "uuid": "8535bfaa-b245-4ec0-8398-123d75816a4f", "value": 137940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888149, "uuid": "0b920d66-e2d6-4e6e-81e7-e0eb034af2fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888149, "uuid": "9634d687-f48a-4e09-b078-77467df1fb4e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28030b2e-35fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775949254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949254, "uuid": "8eb31cfb-6de8-4518-89cf-bd7d9aebace8", "comment": "Malware payload (Mirai)", "value": "814efe269a02e8b33edae4a4d235fd82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949254, "uuid": "22dd960e-11b3-4075-8f04-85c4ada52f72", "comment": "Malware payload (Mirai)", "value": "e925b49769cf5301906e33c41f4478a10e63580d143168a7ebff5ea2a9c73e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949254, "uuid": "73853e5a-6ad8-46c7-b58c-abda9e2de9d5", "comment": "Malware payload (Mirai)", "value": "28673cf7fd3568b1bff2816e3e691d8bae89bb3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775949254, "uuid": "ea216a25-8af3-4139-aa14-6721fa1db95a", "comment": "Malware payload (Mirai)", "value": "2410b316bd276d885fec375b66cbf412ab08832c00bbee6ba4fa7774cb3c7e6b28229b710bc0d84b040aa99d8b9a75b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949254, "uuid": "49e7b70f-ced4-489c-8d97-6873acd502e5", "value": "T15863F11E77121D9ED9FFE6361BD603021DB062BBB29B000679D1F0ADDAD20D988C75B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949254, "uuid": "5020ad4b-ce32-4205-b13f-fcd32f3fcc87", "value": "1536:IRuDybUerYZXkRhvvjUrf83tXZR2cxvfaLrLlrBb+qJ96yxzVSd:IRuDybnYXyI7EXZsqfaDb+e7zVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775949254, "uuid": "59af8e21-426c-45cf-9c8b-4a1673ee5535", "value": 70284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775949254, "uuid": "ea66a4db-3d57-4f28-bb8b-dd5871a3d06a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775949254, "uuid": "c92ae816-e848-454c-af04-42e54b3edfd2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7762e53b-35bb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775921470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921470, "uuid": "d716c886-8233-4504-9ba8-6a04ff3d3936", "comment": "Malware payload (ValleyRAT)", "value": "5bd7b8e33494799bd52d5cda0f1b53d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921470, "uuid": "29561efa-182b-4d90-a269-2310071ba290", "comment": "Malware payload (ValleyRAT)", "value": "e9612cdd6fad265a81c95dc7b8b1b9e0caf1a850a19db9b91b87979673ebf76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921470, "uuid": "b1da10a9-88a3-4b8d-aeed-3bd765260dfb", "comment": "Malware payload (ValleyRAT)", "value": "faee1f1f412b28bfbf710054bac66da51dc9c828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775921470, "uuid": "9f019ecc-c2f6-4108-a25e-c434fc89c430", "comment": "Malware payload (ValleyRAT)", "value": "f239b604fcfb358e6cde46297458721f50839642483d0b18195b8540d679dfffe7be4c230bb8ac27a5f7c1bd09e6b36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921470, "uuid": "45706ce4-9e66-4747-a07d-cf5d561718de", "value": "T1CFE23A0271E3D436E063593419B5D1B25A3B7C526BB080CB3B9812BE9FB13D18EF8366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921470, "uuid": "4e7d1d0e-402a-468e-aeeb-1c88732e38c3", "value": "c0756e331e7f4e20764786c0c218ff0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921470, "uuid": "a7f84e47-3a2d-4421-9a8e-195e918d5da3", "value": "384:w4+B5llfmGiRdB+rpSQE7BY5EhodsRXgfZAdXyclZZ/EDHKb0nuYeeWgW4JOFNn:w4+hHSQvOh0AgxUCUZxEDqAnLeLg38N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775921470, "uuid": "64c88da1-2e49-4679-8980-bff96e9d34ba", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775921470, "uuid": "f4dcefb2-5d5b-4d01-86dc-e47f63f0f9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775921470, "uuid": "f9e85040-8b91-442b-a977-921f6b8e485b", "value": "2028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a5b9e1-3571-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889896, "uuid": "e997d476-4a17-42c4-8162-180207040f02", "comment": "Malware payload (Mirai)", "value": "6bc84816283687218d520013d346f192", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889896, "uuid": "73dfce1e-45dc-4f62-b476-9e4e9e7a96a5", "comment": "Malware payload (Mirai)", "value": "e9626841fac35d69bf9346c9e4b5af80f41d2a57657eb97d108f26a644382c6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889896, "uuid": "0cd94b94-21cb-4b4c-921e-fef1e6348e6d", "comment": "Malware payload (Mirai)", "value": "d2796da9f7415e23759d63640c644ab4f0c551c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889896, "uuid": "f56059c6-d5e1-4177-8e16-3fe0d4def69a", "comment": "Malware payload (Mirai)", "value": "22d5378975684899c421db860fd559cf5ca49c17f6bd052bade0a1a4ac676792acab66f3cee67e92e424e59515484836", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889896, "uuid": "65acc442-bd6f-4834-973b-a8ba766e775b", "value": "T1CC3301F3B155A4F3FC9536F7294121D0AF2BC83FF69716534C84BE6AAC079215A220A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889896, "uuid": "23fe3d9d-a408-4d78-a731-7276b07cdb5a", "value": "1536:TXAuBsc5jloDQzKwZRFMRA3ucAp1Z+FiKqp:0Qsc5jlbX3ucAfZaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889896, "uuid": "a9542eee-55b6-49d8-b6fc-443bdbc9d73c", "value": 53464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889896, "uuid": "5f7b0be5-69a8-4ffa-9b49-e4f1858eebec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889896, "uuid": "856db247-4186-416b-9c66-c3d96b7d5d11", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a983bdbd-35b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775916829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916829, "uuid": "6b73d7fa-298b-4440-8f17-023aed9c8b29", "comment": "Malware payload", "value": "897da3e8c18ec47fed583d7b70fe67ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916829, "uuid": "472b1a93-7cd0-46cb-bbed-4a7f46ba6573", "comment": "Malware payload", "value": "eaaa8ee155b1edd7d2dd4f684c21c04d6cf204e6d28b31e8c016c6df2ce674f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916829, "uuid": "4617f2d4-f5e2-49e4-a3b9-ed385547ac5e", "comment": "Malware payload", "value": "17faa9e3a0c1564cf470ec23c7b87d7c01b8ab43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775916829, "uuid": "b97fef17-11ee-4c8d-b712-12c42e734f53", "comment": "Malware payload", "value": "6cf798e1540e9db43dd47a995a4b5e0d2d01ec5aab74f4d268f7adb716f2126a680da928d86c31f0ec198b0f184e6356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916829, "uuid": "d21c7681-6ec4-472f-8c03-2daa14bb3285", "value": "T1B3468C03FCA155AAC0EAA23589739152BA72BC491B3163C72F50F73C2EB6BC49D79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916829, "uuid": "7b4855ac-9cf2-405c-8174-f3bf8997229b", "value": "49152:d86AqE+R+u/SXnMJKOzYPlyLT2boSVX9+KqMxiirqKWK9KITX5Egt93NaoJcc37W:dHV3NRcdVt+HQ9FEgLJWJbt7m+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775916829, "uuid": "f33df0f2-f0c1-4112-9ac1-932c554c5212", "value": 5819107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775916829, "uuid": "00a5a976-0b73-4d9e-8305-a3b467b334d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775916829, "uuid": "651fe9b2-53a2-455b-b204-de5a4eae05a8", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ca188c-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888096, "uuid": "ec496f6a-ea67-4db1-9d9f-d40c870b44ee", "comment": "Malware payload (Mirai)", "value": "8b2dd98a4e86da75b2bd38e91e99d2e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888096, "uuid": "a1d99480-fd05-4d67-b781-306e0523cc46", "comment": "Malware payload (Mirai)", "value": "ead33026ba998d6996cd20438c915e889c40f22cea0b8634458027070c65c4ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888096, "uuid": "59c06b6a-bb69-4b41-bfcc-be4691ae6162", "comment": "Malware payload (Mirai)", "value": "93e52e9898f9e4dc7ecd34cfc4be9e2d9d11aa45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888096, "uuid": "c29140eb-a056-427f-bd8a-e489068993ec", "comment": "Malware payload (Mirai)", "value": "e3e7d9872938d597c27baed818957169255e0922385539618e67f64c685ae4a5f7e849c28d541b227ede776785e141c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888096, "uuid": "b8297eed-9dd4-4eff-ab88-269c3620b718", "value": "T1C743F266B21A5B25C3303A77BE875B45238903EDE4BEC041B4FCF8653699ACA733E151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888096, "uuid": "46caa03b-9c10-4586-bbc3-2ca1ef305736", "value": "768:ZbZbf4TGoL7AidaJQVGy+OJp+RgPR6Xhtgqs5yU1pJoJ15Tf2rz5pvc0ka9q3UE+:ZbdO9vAiYJQVzeRoyt5Ickrz5p000Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888096, "uuid": "24a9a9b0-055e-4c2e-b845-49654d27600d", "value": 55512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888096, "uuid": "f072dd04-5cf2-4bd4-bd49-9eb7aad39cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888096, "uuid": "e6debb5a-a2b7-48da-b9a8-5013e8de9b3e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5565378b-358c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901226, "uuid": "af1f4e56-fb80-44f7-b21e-9b04ac14597e", "comment": "Malware payload (Mirai)", "value": "0218f8185635a6e8cc08edfdd27d8409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901226, "uuid": "0591bce4-76da-4c68-97d6-f0420e25ea68", "comment": "Malware payload (Mirai)", "value": "ec32eed737d20fc83842f2b99cce23e9d9c6c711457cb3f8f86987005dcee64c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901226, "uuid": "13295e04-f977-4572-8ee8-f3c3f2d04296", "comment": "Malware payload (Mirai)", "value": "bf383d2c6f3d9ad45c680554be021d28108d84c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901226, "uuid": "bb0e8fe2-1378-4362-b03c-71a629dd9731", "comment": "Malware payload (Mirai)", "value": "ca6c2ffb8bc72cb28bd4088f082a55cda74cea518fe15b99a1af920c46a0a49c2e59dd5a41c37368f033d6437e892727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901226, "uuid": "51d83cf9-c57c-4cab-9e83-d96e8b909ffd", "value": "T107830748F643D0F5ED070C30615BFA7F8B309A61C520EEAAEF84BA55ED73952640AF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901226, "uuid": "c19e4ba1-0e46-48c4-b7d4-53396039e382", "value": "1536:V3pa0/fZORYxgzQOKhAOhW8aObLF9JNQKzspjUu31k7NkmB1ZQ2ch9vr:V3ppfgQhHPaAzv7KS7d0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901226, "uuid": "4139471a-3de8-4e4e-959c-8e0154a4e232", "value": 88124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901226, "uuid": "af8b7d53-accb-4264-95a0-aaa9444fcab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901226, "uuid": "0572b29f-21fc-47be-bf44-f2e85ef5a7e1", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31776945-358d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901596, "uuid": "48b5e256-4248-4498-b848-a20ebd1c540d", "comment": "Malware payload (Mirai)", "value": "908f393716bcab3dddf86a69d15ce3d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901596, "uuid": "efc6afad-9724-48d2-a179-a7ab1c8a6a10", "comment": "Malware payload (Mirai)", "value": "ed880df982b594ff3d31781a79db4917aa5a96b222e2147e8e6af3e5ec25b6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901596, "uuid": "83388ac9-dee5-4a8b-8210-e9f9961beaca", "comment": "Malware payload (Mirai)", "value": "e194800463d938a0482067a81718f683e11d61bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901596, "uuid": "93ad8499-3c90-4b6a-9f53-6a5cd93f708c", "comment": "Malware payload (Mirai)", "value": "364d2f699cbcff03eaad1b9f4ae08eeedbe36b7326621558ace939a854ec1232228e35085e60c3bb7351a9216137681b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901596, "uuid": "ecf7d268-6dab-4288-ba18-93b5744bbcc5", "value": "T19424A61E6E328F7DFBA8873447B74D20976D33D626E1D685D1ACD2111E2028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901596, "uuid": "cfd68717-3821-4aa0-bd52-e04b3b3d26a2", "value": "3072:CnSCZTgWBXvmXt+4hJeltdAk4YH4bUXd6CeLco/Kkez15KD:O3g0vi+4hJelvAOGUNZEcBkeZ5KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901596, "uuid": "c612eb04-9e51-4b63-8785-e467ba394fd4", "value": 215204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901596, "uuid": "d746d140-8a5e-4747-8ff4-5f53b7771454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901596, "uuid": "fcda0e22-4783-4b1b-8857-abff2914fca1", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54278428-358c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775901224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901224, "uuid": "464f540a-c5d9-4343-adb6-b48320753955", "comment": "Malware payload (Mirai)", "value": "770f58c20907c209c5ea954574c699a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901224, "uuid": "46cbd11b-8cb3-444c-b231-04c2ed62621b", "comment": "Malware payload (Mirai)", "value": "edb284bfdb8e529696da2a9473fb77438a1020f69fbf571f36b6a00bb9d347e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901224, "uuid": "7d2ae781-ef20-4160-b881-e643f47481aa", "comment": "Malware payload (Mirai)", "value": "53590261fc0ca86487cc2ddb8f13bac3b2bed0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775901224, "uuid": "621a8540-ba34-4c82-ae44-119d9ec90c42", "comment": "Malware payload (Mirai)", "value": "f9717d9c1100d8c657012386e618e4f498d47abd65f962780db7f044e9fa6d6859a038b51a33df8918519e6b6d1523b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901224, "uuid": "0ff4de9a-805b-4b87-af8d-1f30121697e9", "value": "T180E31945FC918B13C6C612BBFB5E428D3B2A53A8D3EE72039D255F21378685F0E7A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901224, "uuid": "59b9fa92-2dcc-483c-ac69-5446b701972e", "value": "3072:CzLmduag2kTdoyREa4B3pt7hfzo+kvZ01i:CzLmduayv2a4Bv7hbopBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775901224, "uuid": "f00ccf28-6e40-406b-9d89-94ff8dc82a00", "value": 150080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775901224, "uuid": "7aeb6f77-8d16-45e5-b81e-9190c2d17ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775901224, "uuid": "36f3c33c-88c8-49a7-a4e1-69504dd3295a", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45edc6f-35b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775917277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917277, "uuid": "f64a74e1-9a93-471b-9adf-32d4f2515a82", "comment": "Malware payload (Mirai)", "value": "4c1e25be827100d7276474a91d50fc61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917277, "uuid": "ce08aa15-7d90-4cb3-91f2-c6a06d33d949", "comment": "Malware payload (Mirai)", "value": "ef51ede2909f66eb7a7118e0a888d099acd86bf90233d9d0b47ac6b4c52414d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917277, "uuid": "d7c5d03a-3ad0-4d54-b5bc-50726736f632", "comment": "Malware payload (Mirai)", "value": "11c3f0092951634b8961d1f7d403b48e919fa7cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775917277, "uuid": "62807d8d-e3ee-472f-a634-5fe2cc93edf6", "comment": "Malware payload (Mirai)", "value": "9881730fdc2fc49ef300c782748c1184905e3e217dc1fa543df11111470325d199e3e1f7cf3077231a9e7f89f32cf7db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917277, "uuid": "8c2c5aaf-737e-4e44-8c29-d3cff9ae1f41", "value": "T155B3122CBB560FC9EA9496FE0FC86371A4D44083D0F635857A72B5EB4A6BDE63ED0011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917277, "uuid": "4f9fdb8b-22bd-438f-b6be-1250cf5c03a9", "value": "3072:g86wKK9C0KdaFCckYUByqIPJNCXLL9RCuR:96MAdjyrrCXLfCuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775917277, "uuid": "65bea705-4173-4d6f-9095-6eedc1128317", "value": 108444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775917277, "uuid": "5460ec42-af92-4ea4-a863-f89834e0fa2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775917277, "uuid": "7de0741d-7ebc-489a-a3df-25376a6a6310", "value": "redis-credentiald", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652fa24d-35fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775948927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948927, "uuid": "ddf04499-97b1-453f-a15c-76165261c1ba", "comment": "Malware payload", "value": "12c7dc413a213a22f031fb30652e1e16", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948927, "uuid": "8a946fad-e7f2-446c-ac8d-e17baf68933d", "comment": "Malware payload", "value": "f0a09b60b46ea22b69eec2a47caf22345b2c01e9e42969c1a0d5f1cf227e7af7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948927, "uuid": "12bc5e81-ac83-4f87-8424-3d37154e2e2b", "comment": "Malware payload", "value": "21dec78b1a02c4b6114ca06601e76c5be7c4f175", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775948927, "uuid": "41462197-75e9-45ac-9141-19732867f2be", "comment": "Malware payload", "value": "c24e72bffb33256e1ea296204a36ddc5d750ef80ce144f01f68b8e87e9ab85e3424554a21c60bb23130e5ae570670e4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948927, "uuid": "8699599a-9a23-4574-bb36-bd731f814c70", "value": "T14B01411B60F700912784707BCF4D760C30C9387B75518D7434403AB6BDCBC0804525A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948927, "uuid": "829b6b55-2faa-44b9-a113-a38230ae0769", "value": "24:jcBnKTlyORkOuzIzm8MUfSSlpqI9fne3mr:jiilyORkOWIzm8MUl0ypr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775948927, "uuid": "aac6d75c-5495-4e04-8a02-d3c318a1d1bb", "value": 801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775948927, "uuid": "61d026e8-b21d-4e72-9bc7-53fc874df4ed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775948927, "uuid": "f0c1b38d-946f-4ff4-ab4c-7ada6bb009bb", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88394a4-3571-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775889877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889877, "uuid": "54b87f1d-9e7f-4b58-8471-a2b8df1851c8", "comment": "Malware payload (Mirai)", "value": "81262e299fd22bcdc163dc23987a41e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889877, "uuid": "b1e02379-93f1-4d2d-a8ed-508eaffe2b92", "comment": "Malware payload (Mirai)", "value": "f0c4d4a459b55e43283355731f60e3854a4b284eca4b89a2d7b7feb76064afef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889877, "uuid": "fbd7f3de-cdef-450c-9bac-641d16cf8648", "comment": "Malware payload (Mirai)", "value": "d34fcb401e26322ec5c615f732158e9c23793a93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775889877, "uuid": "5c52ee0d-54c7-4c01-afbb-1f814d4f8af4", "comment": "Malware payload (Mirai)", "value": "cc978d893f8a48948330103d882c4778378b521534d527cfe48c60468e0ca571642e608aefda8da56ee0c9d8c954f195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889877, "uuid": "2871c7c8-bf8f-4f91-a485-48b18f87d342", "value": "T15304865D2F225F7EFAAC873447B78A24A75923D623D1D684D1BCD2101F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889877, "uuid": "b01452f1-1027-45cb-936c-b28c318b444a", "value": "3072:aD6QBQ9zo4RYtXnPuEGSLLYC/oXBCzAd3Jem9qiejo5FX6:lRYtXnPuEGSH/MBlJ1peE5FX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775889877, "uuid": "ea0aec20-81a5-43b8-9f37-8653f1d70c07", "value": 182148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775889877, "uuid": "c7ddb542-59e0-458b-a004-f31c870cf13c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775889877, "uuid": "9afbc512-886d-4f93-b461-0d8007d9d1bd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f4214d-35ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775950599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950599, "uuid": "cde63ba3-a65d-455b-952c-a05d269ed54e", "comment": "Malware payload (Mirai)", "value": "f46528554ffe53512f1f2831bb62becd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950599, "uuid": "9dbab710-7190-4cd9-b2b2-7e2bf8b2bd0f", "comment": "Malware payload (Mirai)", "value": "f151bf72628f7d8301bbaa3f3350de0cbe3257e12bfb6c641d1440f2d9a2e4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950599, "uuid": "1626fad7-c86a-4ba4-86b2-a1d033e3e150", "comment": "Malware payload (Mirai)", "value": "412d61b2c893b36c9cd1ec77c3d42d88bf44eadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775950599, "uuid": "418b99f3-2cf7-48ef-9f62-65b77aaecef8", "comment": "Malware payload (Mirai)", "value": "373f9a9c187bb693bbe05be53c7883ddbf361836ef6d33eedab40c2dc21c29a5b13d2599686c4a66d7afbaceec08e51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950599, "uuid": "f2706142-f4f3-41b4-b559-2c52ef751d7a", "value": "T162E32B81FA47CAF7D4470AB502A3A73A8632EC290A2BC655FB2DFDF59F175C47109218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950599, "uuid": "42271fad-f319-4e4d-afcd-95121c983666", "value": "3072:2Iaw4A8/H8uFH1Cigkr1MpU5H7+YTv9nUtv:bNnczNYU5H7+YTv9nUtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775950599, "uuid": "9cbdebb9-22d3-480f-ae01-ec8ed7c72e49", "value": 155807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775950599, "uuid": "94078fdd-c1b8-4201-9554-96a15075ab65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775950599, "uuid": "e80af1b8-6afe-43e1-857a-76439952a577", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3029b10-3581-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775896766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896766, "uuid": "98935e74-1b12-4a63-8a7d-fe4ba8f64c93", "comment": "Malware payload (Gafgyt)", "value": "2be0da0a98ea0328fefe46f2f8e3e914", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896766, "uuid": "99b70e5d-4a42-4298-a130-766de21d90ec", "comment": "Malware payload (Gafgyt)", "value": "f20209b1d9dbe4825f4e3e1e78729e43edaa19078197f3e6b6ede92ac95b28ce", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896766, "uuid": "ebe14d47-55db-4660-86ee-f41ce9868a46", "comment": "Malware payload (Gafgyt)", "value": "d049896e52d80ba4f23d5aa710de68e54b220947", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896766, "uuid": "8be9dea7-d286-43a4-9b6f-d23126bd25de", "comment": "Malware payload (Gafgyt)", "value": "c4008d54c36ba73938cf3d14f1ff0a5b594458b377720fcaa96373f8323efe5d3d0ed430bb11313d7593964abcb0f7d0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896766, "uuid": "1ac21758-6b58-40d6-b305-f6d3e306c669", "value": "T14AC3093B6B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896766, "uuid": "343696c5-f3b2-4156-9069-06d9bf81caaf", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtA0Rdc0sfm7ypwYujl3IdnuW:ZP0DNPAV5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896766, "uuid": "f0ac777c-19bd-409d-aa41-bb3cdb814bc9", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896766, "uuid": "1504d7be-7217-4724-aff7-36ed95dcd56a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896766, "uuid": "79f00641-6993-467b-8cd4-5d3e4f2d2411", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22620fa-35e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775939178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939178, "uuid": "7c47af09-c0ab-4607-a2bb-237092d4fbcc", "comment": "Malware payload", "value": "7e5f3ba0d062273ac346e2cbdda22d22", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939178, "uuid": "84941be6-28f2-458e-9441-03bc8ff90d0d", "comment": "Malware payload", "value": "f36638850a211914ece953182be4335dfc21f56051dd0afa2c6c1ed35b44f113", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939178, "uuid": "00d689e5-93db-41e3-9da9-cc3973367a12", "comment": "Malware payload", "value": "c22d43ba6042fc1efc86038017d79a326b665cce", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775939178, "uuid": "75e0a1fe-607a-4a40-a737-ae3026f69833", "comment": "Malware payload", "value": "8f6403b5284df9b59d53c9fba394d38c8dcae1ee1f445644738cd87debae4ca1e2bc07f561393b3225f7c51765f8fe68", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939178, "uuid": "ce0b897d-ecdd-4636-b5f8-73053ba559bb", "value": "T1BDC28E627E94F0B857CF321776F4F89659387BB2908E660C60EE508167DCBE0EA3C155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939178, "uuid": "0af50b07-a635-4941-808d-e9b51094ebb7", "value": "384:D3CNMcC3LAsaQvFviGZLFI93cWuyE/nlq00clDStCX0nl9jzGPT+g6QX/:2md7DFwdcWun/nl70MElhGPMe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775939178, "uuid": "e638de5e-0b5f-4beb-bc06-2485dbcab99b", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775939178, "uuid": "eb592f5b-72d8-44e1-8a0f-de6d4fe8a8a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775939178, "uuid": "3591be2d-0512-46a8-bc9d-1646c5bcda27", "value": "form_99131.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b989ff78-3540-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775868753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868753, "uuid": "971b8d49-9a3e-45e5-8d48-da88cfe0af88", "comment": "Malware payload", "value": "28a361d1a2c7e3da6a89cbde6a1eab3a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868753, "uuid": "fc618fc6-d5d5-46f4-b316-fc300b98e496", "comment": "Malware payload", "value": "f4d4a25e346910ca7389bf0d38f450cc8e39dd710034f97c661d33a195a1f383", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868753, "uuid": "636a8216-809a-4281-a312-99dbb1e58717", "comment": "Malware payload", "value": "be4623e23a614ddcb123360b91975116334b4f80", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775868753, "uuid": "c4dd8826-44f5-4293-a0ed-377579ae0803", "comment": "Malware payload", "value": "bcf44ef1a41f7c9b7548f87e66e615cdbe40bd30fd3461906413990300b1fe9ff31f0ca61734541d687ea8afa15da5bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868753, "uuid": "02c578bf-2f80-444d-822e-a9504d7108a9", "value": "T1E224C633E6A288B9C4AFD1749BC6E5B26670BC584174F20D5F804B127F0BF609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868753, "uuid": "b8645129-6917-47f1-a519-8b5fbe6fed46", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868753, "uuid": "590ddbc2-b7c0-41e3-800e-6499ba4330a7", "value": "3072:lVgj3QDJX288UcTQmVQiMmYR4A96RD7o1mNDc4SJP5L5mF0Oc:LQ3WJoRD7o1mNDcVJP5L5mFBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775868753, "uuid": "fb436177-2043-4aef-80b5-43336ccb0df1", "value": 226408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775868753, "uuid": "ad4f0eba-d295-4d05-861b-bc6f664ff537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775868753, "uuid": "d5e356dd-54da-461c-90f2-00c773364deb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9686c7be-35a6-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775912503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775912503, "uuid": "9115896a-be07-481a-901d-e75310a93f7b", "comment": "Malware payload (DCRat)", "value": "1c9516326faab8d98110d5c29769c015", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775912503, "uuid": "f7ef3ae9-73cd-4580-874a-e85c04819c38", "comment": "Malware payload (DCRat)", "value": "f5d7a1d938d5c1e28a93b42ce1c8e615aad3b6f3c18197f0b0a8576954572a04", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775912503, "uuid": "e9a5a376-fb89-4703-8295-a90c6c62302d", "comment": "Malware payload (DCRat)", "value": "43f0940b266489ed936f7d43d25c055eea3c60f4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775912503, "uuid": "1b546256-a0b0-4f2b-a91c-96f6515c2a79", "comment": "Malware payload (DCRat)", "value": "aed860991260fcc31747fd79b7f214622b3c08be82785f4519644664a51e823dc51745dffbaa724ddcd2238ee962075a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775912503, "uuid": "14811f01-5b3d-4f87-8b78-bd091690ff46", "value": "T1F3657C017F54CA11F1191637D2AF850447B4EC112AAAE32BBEBD376E95223937D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775912503, "uuid": "7dc60c01-bb71-460e-9464-b75c0268bb51", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775912503, "uuid": "b9ef62d2-4c40-4be0-9c87-0e6f7c2fa2f8", "value": "24576:U2G/nvxW3Ww0tafou68ApuCOumeAeBwHXR9T48PZavJrZSLjzvOnXVJ:UbA304P6kk6haujeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775912503, "uuid": "d5483800-e42f-4373-84d1-aa547f3be7eb", "value": 1540239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775912503, "uuid": "4fb8dd75-88c2-4d4f-aa1c-18532f1374cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775912503, "uuid": "5afa0e4d-553a-4d9a-8add-c288145bcf58", "value": "1c9516326faab8d98110d5c29769c015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c97abbb-35a4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911466, "uuid": "029f3312-7d46-4d62-8fa0-3af71421df8a", "comment": "Malware payload (ConnectWise)", "value": "9a3c46c1535eb24640a6334ed329a6ad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911466, "uuid": "f7be7d45-21d9-48ed-a8ab-ab222809d294", "comment": "Malware payload (ConnectWise)", "value": "f616be462dcf65c446ef2df5b465fa26bc7167d66202a0d5dbba66f73faf55c6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911466, "uuid": "4031503f-2936-4448-b7a9-bd0dbca0ab5c", "comment": "Malware payload (ConnectWise)", "value": "4bc81e7043012c7522a67d47cc111b1b284043ba", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911466, "uuid": "5587f5eb-6218-49b4-94c2-4fd6a521e2b9", "comment": "Malware payload (ConnectWise)", "value": "36fb412ea5e88d78869cfe9069b4242dd9f3d296067a2d76e208dbbcfbfdd0dcde426a5d9f9514234620c642b7c59021", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911466, "uuid": "61d4f098-8d7b-49b1-a97a-365d38abe0b1", "value": "T10A646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911466, "uuid": "d46a1259-6af7-4213-b115-152945e8ce7f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911466, "uuid": "90d21225-3451-4ed2-997d-d629ebe277f6", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911466, "uuid": "060a6777-d0b7-48d2-b53c-dabef8e7d024", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911466, "uuid": "37ce89c5-2131-494f-8195-da8b8b93cb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911466, "uuid": "01b0e941-f3c1-41d5-b3c1-7ba3fabf4290", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da547d7c-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775911328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911328, "uuid": "a15df456-d26b-4345-8179-215670ed9188", "comment": "Malware payload (ConnectWise)", "value": "f68ca5abcc02b73c5438ab2f9e3728c1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911328, "uuid": "30ac8563-5de7-43b9-90db-ee40134480ae", "comment": "Malware payload (ConnectWise)", "value": "fb887d6c3b344164ddfcc28ed8a1bf6be36046384ef16b6802e89ac0fb7ae95e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911328, "uuid": "39f134c6-5efd-4871-ba41-8323f676d669", "comment": "Malware payload (ConnectWise)", "value": "4468ccfbb54dce462baaf6ae71d9555ca5651823", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775911328, "uuid": "e4e5bd25-cdf4-4ea6-bbcd-30b228742926", "comment": "Malware payload (ConnectWise)", "value": "805fc9a8f21bbfa40b774a8249bd3d60b03cc63618b52983eecef8993c0a0887a6ccf8e8258fd5847f6c7dc8f99a5fd8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911328, "uuid": "a9c1d415-ce87-496f-9cd2-3adc5ef95833", "value": "T1F9647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911328, "uuid": "fb12ee09-c0ea-4d58-8e64-3243ded1a81c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911328, "uuid": "4661272c-9e99-4149-9a6f-c6ba2d64d2e1", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775911328, "uuid": "8c4280f8-48f9-4ca2-b4b8-34cf1dda2812", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775911328, "uuid": "fa8c6406-6674-418a-8c5d-b0d928d35b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775911328, "uuid": "f0c6f4fd-4d13-4224-bea3-fd79eabdf779", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c984bb9b-356d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775888107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888107, "uuid": "984fbabb-3448-4e0e-b1f5-ab8d2a46bd55", "comment": "Malware payload (Mirai)", "value": "fac4e4257384a86ec4697a54f056b8ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888107, "uuid": "d6f2c62e-0c1b-4adb-aa64-0ee5eb763c49", "comment": "Malware payload (Mirai)", "value": "fbe87d54486705f832602f4f4bd9067e5912600ff8e80c76fa6dcfb89aca36a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888107, "uuid": "1ccdb2e3-e231-49f2-b913-6c8a27028e04", "comment": "Malware payload (Mirai)", "value": "66a7279b8f2e197e96f93778a8c30c933bbc8ff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775888107, "uuid": "435af37b-e6d0-41fe-ab87-7b9ffc762e46", "comment": "Malware payload (Mirai)", "value": "c3f6dfd87e448275d40c01a8e3c3ca32f9d2cf9e342128dbf82b7c433032ec6cbe1e4c7b4d6c31178fc4cd799cac769d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888107, "uuid": "d94342f7-1517-4a56-a06b-a1dfef0eda30", "value": "T180C35B62CC766F58D658D0B4F0B49F792BA39A1091475FBE556BC3B48007D8CFA093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888107, "uuid": "e557d8b1-ea5a-4378-83b9-1d466f19a269", "value": "1536:xadtx6jzKv16dMWK2iyC9FW1WivAW2GBUzVCuKmN20eAus:xo6XC6OWK2BYW1lAW2ALBmrus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775888107, "uuid": "c071afdf-e81e-465a-9dab-2f341f3e5ae2", "value": 121476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775888107, "uuid": "44d40ded-dabe-4c59-b93e-fe2eb8d5e0c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775888107, "uuid": "a279de7e-be14-4ec4-b4de-c9269e3a3301", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8428849-3594-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775904909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904909, "uuid": "5da23226-e3c5-415f-a043-6dad8b5ede4c", "comment": "Malware payload (Mirai)", "value": "64bb68670e4d454bf2c30ebce72c6b9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904909, "uuid": "202fd3e4-e79c-46ea-8f5a-33f9886e99fb", "comment": "Malware payload (Mirai)", "value": "fc283edb43573fded60b3309417e987d836795926685a6cd0d80a5dd70bd09c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904909, "uuid": "25cb6ff5-f171-4955-a96e-c7f9700e92b9", "comment": "Malware payload (Mirai)", "value": "985f7e9230bbf8e01c7e03ff56e1d48844c3ac70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775904909, "uuid": "773f8de4-80a5-4cc3-816a-50d9e837c62f", "comment": "Malware payload (Mirai)", "value": "47ead026aebd741ceeba461aa3a2c83b913d70a8cb72914923c6f8c13bd1ae3f3b1b777d0849ba9cb446eff896c2dc74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904909, "uuid": "38640c78-98db-4a8d-b971-bd362a72b1d7", "value": "T1FCF32901B30C0A47E1972EF43A3F2BE193AFDAD121E4F645255FAA8A9172D331549ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904909, "uuid": "8282ee2a-8309-4aab-964a-59fd6115b1e1", "value": "1536:8b6h9E5HL4y704XXN+rxyDGk/wLZ5LoNxDz9SKvA94tSXTh2UqoqXQUiDQ2ItLM:8Oh9E5HTQq+rxC/wUNxf949LnkVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775904909, "uuid": "39f8be8e-e717-46e7-8c3d-137bd1a4dabd", "value": 160824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775904909, "uuid": "5a896867-b620-44a1-b8b0-dbe3bd877396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775904909, "uuid": "54285847-8392-4459-b49f-ee606dc15a00", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f2a2a2-3586-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775898869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898869, "uuid": "45ab07e4-8b24-43d8-983a-a26c09e0be66", "comment": "Malware payload", "value": "56c7916816349aebe450a16257b8448c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898869, "uuid": "d64d245f-6a85-45ed-bf8b-414c809ee604", "comment": "Malware payload", "value": "fcbde44de84bd52312b5497108ff960b1c3b83a1a760535571dc7e3676e8b708", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898869, "uuid": "edb67874-bfb1-443f-afa9-cd1f8f0c1d07", "comment": "Malware payload", "value": "512efac5c999cccdc4336eb7529a7c66ad21dca4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775898869, "uuid": "cf2c5434-bf12-4382-be71-5b85494f9406", "comment": "Malware payload", "value": "5f5a395f5d5b69414816b994a61a6db0074a1a5f8b78ad0a549137c303365bb84cba02e9c9e8aab987116160e9bba129", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898869, "uuid": "265e2418-462c-410a-9f16-b9171f666ea2", "value": "T15F81F68E235281F96C48ED17F471DF9078D09DD20DDB8F88CECD6B52A58CD647439AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898869, "uuid": "43bbb503-4c7e-440a-83a6-20c237197ef4", "value": "24:faHhTshhdYgEhqmThP/R/Wh/EECEPhErQ8QpjhQpfL4h+IvIshICIqI3hIDIVNIy:EQ0T6/Vjgchwsy/H3yEVuVSyVNv0++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775898869, "uuid": "2872b054-cc71-425f-b385-da2395c66343", "value": 4029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775898869, "uuid": "37b84914-40f6-43ef-bc3b-300ed6554bae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775898869, "uuid": "d43e7e20-8e73-4e44-a2f9-26115c225e3a", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1116db-35c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775927088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927088, "uuid": "36dbc417-5919-4a73-bd13-8fb6689f5f14", "comment": "Malware payload (Mirai)", "value": "c1690e2f3fe7d4feb2f42715e65b2b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927088, "uuid": "2b5f7fa2-e1c1-4beb-9481-d4ec8d8006ff", "comment": "Malware payload (Mirai)", "value": "fdc82845904c70369ec1aae9e33ddb1d72869b7a7cbcf2e33d4d5b7b53228379", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927088, "uuid": "abc372a8-37ca-4efc-9aad-8d5657e7c563", "comment": "Malware payload (Mirai)", "value": "fd32eea8d6801e74a8fb2e0b248bc20074d7defe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775927088, "uuid": "e22cb8e4-c622-4694-b6b5-c74ebb64f524", "comment": "Malware payload (Mirai)", "value": "aca09f51d1bd22fff26c0aefe2a3a278a1e18f976eff1ca050e3a2cde2cf818aa73575a572c05867a0160ca07001a9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927088, "uuid": "468538b4-33b7-425c-b6de-8c920b138360", "value": "T164041949F9518B17C6C262BBFB5E428D3B2617E8D3EA3203DD255F20378686B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927088, "uuid": "15224c1a-0615-4807-bec0-c38f56b34593", "value": "3072:n2rTssiNZN17VFR2exGa3rj1PK4hON/ocns66Z3sf:nw4sifNjF5jX5K4hONocnVS3sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775927088, "uuid": "8147bbd9-d774-4a16-b542-60bece94fe9c", "value": 175872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775927088, "uuid": "535f4219-17de-4fab-a4f0-7e8f6fc27589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775927088, "uuid": "c167a9e1-2585-41b1-8cd2-0dd20bab4cb4", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e63a869-3581-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775896437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896437, "uuid": "ce37e09b-2073-4408-983f-f31e70515ad2", "comment": "Malware payload", "value": "78fffcaeca56182bb28395e845712f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896437, "uuid": "6d7a2f3c-38ff-4e67-918e-1b25c11372c0", "comment": "Malware payload", "value": "fdea7b52be9b754bc957422a0b1bebfadcc0acf6d9f613470edf42bf37c5d0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896437, "uuid": "2fa0261b-0e50-49d7-b338-73cb9293ee7b", "comment": "Malware payload", "value": "b478609005cf1e3f860f97519475d95d1aae6a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775896437, "uuid": "51cf872a-b9b5-4de8-a4c4-776dfa964a23", "comment": "Malware payload", "value": "f1ed989f0252c2801e6822b77abdedd07e42d588d60febde6b625d954ad168ff3e3ff7632dc6c8d5e36993e4af68c999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896437, "uuid": "53889f56-2c15-4b7b-8de6-550eb19ef909", "value": "T1E2D49E6B765B4E21D1842332D0CB891193B0669679B7FB0F758823A526073FBDE0B6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896437, "uuid": "99bf7e5a-8efb-4685-8ab4-b6beab22642e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896437, "uuid": "c4e7a945-dee7-448d-8197-2ceac93eb844", "value": "12288:ZzzzNpuThIJRLKLGH+7Akj57P/uU/4P/cor9pC7Lg89I:ZZp+6zYAkjR/uULv708", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775896437, "uuid": "fa1f3f13-8fbf-40ca-ab4f-c88ad9c08aac", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775896437, "uuid": "fb17c3cf-12f1-423e-a079-25e71ee02c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775896437, "uuid": "d686151b-6454-474d-b95b-69e111575fce", "value": "78fffcaeca56182bb28395e845712f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0f9553-35a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775910987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910987, "uuid": "b0981e63-fd31-4722-b71d-96af9091caa5", "comment": "Malware payload", "value": "ed0ec2155f101c9ac2f12fd2733ff5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910987, "uuid": "5671db75-977b-46e0-90f8-720081ab68c4", "comment": "Malware payload", "value": "fe4d28d73055f7aa6be7c4095dc7e6c567a2559a456a941864af37ca1ab0167b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910987, "uuid": "86a0669d-03b8-4d53-96c0-0bae4234e178", "comment": "Malware payload", "value": "e8a10a8eca390b076a40f0fa042d269f5ffbe798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775910987, "uuid": "087588e9-7f48-42ee-88c7-38e78e85a631", "comment": "Malware payload", "value": "95054317c0d3b641cb3ff90c25230a53d298d77a31b93726e57faeec48f5ccf112fe90758c9ee3713fd4873b008efc73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910987, "uuid": "087aa21c-0321-44e8-89e7-9a1f884b0451", "value": "T1B3341251E5C2D2B2C2830671188A53E7EE369E391018D597FB4DBA11F9927DADF0FB08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910987, "uuid": "fd543ab8-9824-4de5-99e9-73a9479328d9", "value": "3072:/0i2YNQzeabh6U9/SAsuRH6UzTixQNpOQeZ49y9mf5/zcW+WAXSQO19agxUqTiha:xroRhP5H6UHixQNQg+aaWAXSH9a+iha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775910987, "uuid": "8cce851e-77b5-4b52-b351-f958bf76886e", "value": 248749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775910987, "uuid": "6c0d1663-65c9-4efd-b826-0e534820bdbd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775910987, "uuid": "c4510b5e-a1db-4564-b3ff-58d0ec7b9e05", "value": "3ln3lues0p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }