{ "Event": { "published": true, "date": "2026-01-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-25", "timestamp": 1769385782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "67427edc-a1e6-420c-a5ed-95467d707cf5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17fbe7b-f9d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769334832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334832, "uuid": "538ee6b6-ea7f-4e11-8597-1139a93c8264", "comment": "Malware payload (Mirai)", "value": "1e6d0f517bce683c154685a8d199e9b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334832, "uuid": "c6f41ab7-0a5f-4310-933a-ae189ee79e2a", "comment": "Malware payload (Mirai)", "value": "002a1ea3f88ec78aaf548ae69899882238f3c5294c31dfde7f2a3518f59dde8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334832, "uuid": "bd98710a-51b2-403d-902f-c6f41022881f", "comment": "Malware payload (Mirai)", "value": "ac7de6344c2712f8582fbfd299d9e8a921a4d5d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334832, "uuid": "8fdd71f9-8beb-4dd4-a4c4-f014c38502da", "comment": "Malware payload (Mirai)", "value": "b1669c25f0892ff47f63125766db4663b70db5bb4c6527b59dc481dc4d9218425f21d48eb9c21add0e106818ded2be8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334832, "uuid": "aab3d37c-2646-4070-a499-132e64566e90", "value": "T1E633F27267AE29E152B05377BC33AC1AA6DC17E89C6730972CF0651977C48014EF6687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334832, "uuid": "3b2e5371-d226-424d-b580-d91956f3bd55", "value": "1536:d9O/ZMAXIxNUk07hLcPqF1aBexo4opKZbx:d9O/ZNKyPhLGqFUFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769334832, "uuid": "46c19afa-444b-4ad7-a2b5-719b17a50c7b", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769334832, "uuid": "aa99348c-f7ca-4c82-b2d6-a2c18a091ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334832, "uuid": "dab394ab-d659-41c3-b3d4-3f3b01b51224", "value": "cosmic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d818a3-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304364, "uuid": "2c032afe-4bb1-4f62-b95d-f5f29dbd885c", "comment": "Malware payload (Mirai)", "value": "ccfb25ce6244b35285bb877282a5d2ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304364, "uuid": "a271febb-c877-4834-b2c0-e2d7ec438913", "comment": "Malware payload (Mirai)", "value": "0221e5cf99e2b0ec07ba30f1ccb321b6c44ee03812711d65df53ddbf4cf4d93f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304364, "uuid": "e1139883-567b-461e-8711-d0dac4d85dfc", "comment": "Malware payload (Mirai)", "value": "8cccb8172112b90f2be1c9fc5cd735034b1189e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304364, "uuid": "40127cfa-750a-420f-877f-e9c4ff31f494", "comment": "Malware payload (Mirai)", "value": "309ada2857aba6d401c81bbaf3dd09d2cbb8095273f3d1c6934c8f0d43344e6264ba61a2adef6ab5e065d2fbb3497b7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304364, "uuid": "f0df1517-7f6c-41b2-9a6a-08f57c7409f1", "value": "T15FD2E15979D3A3FB8C8DD9BEB60E0035709934A967B29333B309D553077A080F651D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304364, "uuid": "948ab1f3-de75-4a8b-9e24-7e5f40190c3d", "value": "384:MPd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKzb1NEFNyI:0lxKd29WcxEns+V6IHE4RlY990IBNEeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304364, "uuid": "f0c4b11f-2629-4c13-ab7a-f8d42ecd14d7", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304364, "uuid": "41507ff1-6b8e-418a-89be-2d67138ddf70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304364, "uuid": "7f51af19-aa2a-444f-a73e-21fc078a0108", "value": "cosmic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41be7c8f-f989-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302835, "uuid": "9e14ead2-4e6d-4434-849e-3bed724fe5c1", "comment": "Malware payload", "value": "034f8681fde684b8740785135cacd11d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302835, "uuid": "72b2c577-2606-4e32-87c2-090ed3dd977a", "comment": "Malware payload", "value": "0231d09cd36d1e61f7fd8e262d1f67d431a0a2e028b754106b181005d6d29274", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302835, "uuid": "3f1e72f1-8950-4b36-8973-2ed1e5a9ab77", "comment": "Malware payload", "value": "68ae69f8d5d07322848e79d80adda7d3d459c2b8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302835, "uuid": "bb1334ce-5f83-43da-9ee6-78a31fddcc9b", "comment": "Malware payload", "value": "0f366d9f6df9bc19f81e63caeccca3fb77776b7da8fb0a90ec1aa923e335d1b2d6db2f8f96ef883566738d0637b16530", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302835, "uuid": "1ba98fa7-6e2f-4e68-a7b2-902128e2d3fc", "value": "T1991833317A9BC538D5AF15778A31BF5D88B87D26073001C7E3E8B9DA75348C29178AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302835, "uuid": "cadcdc67-0c62-4f9c-8b29-f2f1e5d211bd", "value": "1572864:RA9RfCU62/u8p3Eo0uibtMPdoRL1bDbKJde6kO07264Y8I7Cn7Iw:i9RfCTf8p3EoJiJMVcL1fUt4V8D7Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302835, "uuid": "b57f7f16-6374-4c05-acc0-1fb2381de89d", "value": 85574144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302835, "uuid": "e2f1c419-c42a-4276-b559-18791216833c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302835, "uuid": "80c8ca9d-0b96-4821-83c3-554ef5d3b593", "value": "fvgz19-.37.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77078e13-fa43-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769382811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382811, "uuid": "6cee1ef4-243e-440b-a57f-aa8010b1f52a", "comment": "Malware payload", "value": "e41dfc7c19f8d4e8b903dbb7e535f08d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382811, "uuid": "55f90aef-5724-49b6-82d0-66114eaad772", "comment": "Malware payload", "value": "02feac17783bc767e26b0c907acfa0cf3539f7a8a8aa538b174d3c2deee04bdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382811, "uuid": "0818686e-f59e-41c4-8e03-482792ab3929", "comment": "Malware payload", "value": "1ffdd5af0a6fb6f30192b13cdc0994586307b605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382811, "uuid": "80b0d93c-2e1e-44db-aa86-0fb88414cf52", "comment": "Malware payload", "value": "621257e0e9b6dda09c97036048281082f1602540d043227be68dd782db36b55f3c28c1180d3e915a6448ec3eba9f2847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382811, "uuid": "f97abb31-12a6-4681-8528-e23c676894d7", "value": "T16AA3189ABCC58302C6E0A1B6BB1F558D371643B8E3E6B107CD19AF29634F85B0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382811, "uuid": "44f56c42-7f8c-49ad-89d5-2286e7de30d0", "value": "3072:GrzWvVphiV5aTvrL2SwbFtr25+8lLKWBX:CivVTizabrL2SgDqLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769382811, "uuid": "fe3332cc-72db-4953-b969-3005fd15b946", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769382811, "uuid": "f89646f1-377d-4464-9a3d-f54018e01008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382811, "uuid": "f918ac56-46ac-48c2-8bed-23af229f8731", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ddb21a-f9a1-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769313308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769313308, "uuid": "abc9516e-0519-4233-a6c6-eb42823a5280", "comment": "Malware payload (DonutLoader)", "value": "ec536588d6342fb27d03d03cbab721ff", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769313308, "uuid": "46ee7c05-15ef-4474-8660-0bb9cf5d9883", "comment": "Malware payload (DonutLoader)", "value": "0303cc5825a79397bd98803429a6f973d56551de0cf2038a7aa07717c6303030", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769313308, "uuid": "4652d8d8-f4bd-47d0-9afb-70e7175e1b07", "comment": "Malware payload (DonutLoader)", "value": "f4257bbba6fd6128bc7333b9f3a990ba5ac8c2ac", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769313308, "uuid": "7da866c1-d7f0-4175-a88d-c0718f4f4593", "comment": "Malware payload (DonutLoader)", "value": "7cba4b1801410a03dcb180b2843ada7903ba01dd06a1de73e235f8217cf3417509e9581260238e809e4ca04678295c48", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769313308, "uuid": "b446279f-c57f-4987-851b-512c1ec7df9d", "value": "T19E671230324AC52BDA7A01B0692CDA9F546D7E760B7254C7B3CC6D6E1AB58C31732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769313308, "uuid": "388a4aec-f59e-49f2-958e-79bd11cb52f6", "value": "836688c7d21e39394af41ce9a8c2d728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769313308, "uuid": "c422b1db-aa25-4ad1-a39a-a248df44d0d1", "value": "786432:qxSLlr25YY2XidT7dfUWT1Mdkcwrwun/I5:WSp6aSX8WTYGrwunA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769313308, "uuid": "f02d7210-1314-4cfb-9fbf-88ecd4e8efb0", "value": 31680693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769313308, "uuid": "bbc64548-2e2d-4630-b7a9-e3119d891fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769313308, "uuid": "aecb1f11-27d3-44a7-bc49-53ca74ea0026", "value": "Chrome5c7-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4610d7e1-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361684, "uuid": "5683c182-e49c-447b-8312-7070d1dcd60a", "comment": "Malware payload (Mirai)", "value": "174ed3d3548105e0478c4723935e3e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361684, "uuid": "a3915f14-8fa8-4d2b-88c1-80c0689c46da", "comment": "Malware payload (Mirai)", "value": "031e87f8536d66ef78cb8fa954618eefae82806c67935bb4d451cfbda30e0643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361684, "uuid": "e4725ef6-f2f8-45ba-980f-95de2394ca86", "comment": "Malware payload (Mirai)", "value": "0b41ded28c576d0fece0932256ca38d15b49f194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361684, "uuid": "fd71c7e0-76df-4543-ac41-56bc125fbb1c", "comment": "Malware payload (Mirai)", "value": "5c6d7377f66de84fa0083c83ee79d5b51b2e955f25c1ec1956e990916711eb0ab4148454f306830a92454d9d02e074ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361684, "uuid": "a4434354-1c5a-4470-8269-6ff3e7eaf761", "value": "T10F147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361684, "uuid": "57e38a22-c9ba-485b-8b7d-a3c813e560cb", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRSUKG:IcY5JpMByVs9jS1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361684, "uuid": "b19d9eff-fadc-439c-a3b2-2f6fac6c5473", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361684, "uuid": "897127ae-c725-49d7-8da2-f728eb04e798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361684, "uuid": "f4381661-f9c6-447d-bf0f-d22919043eb3", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a271238-f9ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769346148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346148, "uuid": "cc1bb663-3458-4e7d-b3a4-d25bc3c267b8", "comment": "Malware payload", "value": "ac43c0250715f631bd99df4612247a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346148, "uuid": "df71690b-f1eb-4fb7-a748-e126ffccb939", "comment": "Malware payload", "value": "03903beb23f4ff44734009b4513ef2784ddb97384ccab2dd12634064670d07a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346148, "uuid": "4b1efa6b-abca-4cb5-bc68-e8c3278eec22", "comment": "Malware payload", "value": "78b913386ff193b1aae114879e81d5c11cdf63a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346148, "uuid": "74ed977e-4c4f-431e-9f6e-bd557d5f567e", "comment": "Malware payload", "value": "fdbf5e52ad93074bd1cfffc8f5f766ccdcfcdb238ea176056b6a29651b05541ae5962ee1d6f55bf7c800bbed3f2bcd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346148, "uuid": "a71c9b17-e805-46d1-b0e9-55ec65397c79", "value": "T1CE63029D95BA5114CC72FD36C2A00F62049355D0A79E4EC4578C028DAB93E8DFE6F17E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346148, "uuid": "c0ea088c-e989-4401-810e-d37b3788088b", "value": "1536:pl2MD6ZjqScs8p0KWPkT2fOmfyGdmktnKbQl:pl26PWkTiOUlgMnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769346148, "uuid": "a6ac2992-3d6c-4e78-8e2d-613185429579", "value": 66828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769346148, "uuid": "cb263353-4e94-4154-8d45-c75d242c0cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346148, "uuid": "241702f9-fd0d-4f49-a21e-876b9effde7e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4babea76-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362122, "uuid": "ac8001c5-6ca2-4523-af52-90aa6df365b7", "comment": "Malware payload (Mirai)", "value": "1b310fb2f5a16d8e9f2232b48c0244b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362122, "uuid": "97deb680-5462-4f81-93cf-b6e7e0793b8d", "comment": "Malware payload (Mirai)", "value": "04ff0998767fcca827c19f3a32060c758a78afd5427a005a702202a4d0bcd16c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362122, "uuid": "cebfbbc2-3dde-46da-bc59-39619a1c5464", "comment": "Malware payload (Mirai)", "value": "71663c06a193c060added82d1a48f4226767b42e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362122, "uuid": "5fc5df44-7469-44df-90ba-d22628918d17", "comment": "Malware payload (Mirai)", "value": "fc7281245f44d515df0fdbc4898b70882b3aee22a97aa87d859c237b70e7987637ec7529558a004d2e2ed4427e51aeca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362122, "uuid": "c35af3ed-9b2e-4768-9a7d-e2a2397c5caf", "value": "T1C0631256FFCC1F9DECD92AF80BA626CB16529021A4B341E809E58989805F9A151DE8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362122, "uuid": "061190bb-9d08-42a3-93cc-3d27cbb0a60b", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgAidrPq:47Mbp2L+Xqdfoz2skdrPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362122, "uuid": "1c2eed09-6913-4752-b4af-fe72484bae96", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362122, "uuid": "3896af77-353d-4fff-b6eb-9dc56f484b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362122, "uuid": "3da2b4af-cd4b-4491-a5c9-207ed59af337", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36852343-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769329875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329875, "uuid": "56a54299-ecba-4a56-9bc8-7774ba0e118e", "comment": "Malware payload", "value": "857b0834ef86a001c3a0e84457eaa4e6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329875, "uuid": "9330cff4-9c5f-46c3-9f38-39133fb275bb", "comment": "Malware payload", "value": "0558098da7be94930bd04586a05e3a5eb600fb9e3a95a346c4d3aa396f0b75d7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329875, "uuid": "074562b4-9985-42e3-bd91-d141fe3388ed", "comment": "Malware payload", "value": "3cbb19f4d85008984861eaae55ef585a02992320", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329875, "uuid": "df075d35-3454-4474-8f59-a09d62c01e82", "comment": "Malware payload", "value": "675c2ded01eb3d1b4f796cd9349013838b9b4f51da8fae23471c54091801bb099bdcd497552a2bb9cd58a2bcf7179d7e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329875, "uuid": "b09926e0-1349-41ed-a9d2-f00c3e7ab241", "value": "T190083331B1236495E62FA7BFA0A85FC980307DE1731BD56B73783FA68AB164710B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329875, "uuid": "d84e1aea-b09e-440e-b429-72d759a142f8", "value": "1572864:ieWIqsjyt7KuVMwJBabaJ0DO7u6TRcy3DFeBWrzaPTbQ4b0EFL2pL:xq8yt77M0JgO715emW3Q4b0EFSpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769329875, "uuid": "e29f911e-c89d-4717-be9d-fe98715b348e", "value": 78354432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769329875, "uuid": "b1d46f09-c4e0-44ed-ab10-12486cf0e606", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329875, "uuid": "4c2c638b-bc8c-4b67-b73e-5e5f2f28cbcc", "value": "Sp44563_v5.3.1_1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d697f771-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384260, "uuid": "2086518f-6b6e-4637-8f00-dc8efd5a91df", "comment": "Malware payload (Mirai)", "value": "8532f2110b3337ea1f5de2bf31213f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384260, "uuid": "a75c58ea-e987-4a62-8c3c-be83b5dc8bf5", "comment": "Malware payload (Mirai)", "value": "062cb621cd63f8cbb2066b93f3c5a670cca2d124583cad35f907cda3e5c47bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384260, "uuid": "7533a7f6-26fd-419f-b6d0-a805dc396329", "comment": "Malware payload (Mirai)", "value": "32d18dee76d3590d8311997e97a4370b11aa8eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384260, "uuid": "d86c63a7-d5b0-4d3b-970b-8479a6554834", "comment": "Malware payload (Mirai)", "value": "03db56f6d9fd49aecb7cc1acb130f6d959693604c9a471229d8cfda9153cad87bff1d2bb2d265978b748ca50c7b8308e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384260, "uuid": "1426e8e3-005e-4d73-8b74-051cfa32fd8c", "value": "T12A73B50E7E618FBDF26CC23157B78E31976963E222E1C685E29CD5041E7034E582FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384260, "uuid": "41ccd0b8-fd8b-4eea-b8d0-a8a25c3d8271", "value": "1536:JWSBWShuS4IPBX8M0o2WIAosy2fKzRl8liuxIPz9smCfSxHfdqvrrIZ8rkWtX17d:TJsMq/AJftliJvBf0vcWtXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384260, "uuid": "16e193d0-636e-4732-8491-0bd594330ec4", "value": 76636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384260, "uuid": "f150b425-d18a-404a-8ef9-7b1bf2aaa44e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384260, "uuid": "f70a277f-01aa-4780-8f29-b7ef5eb5b7ad", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40c6c90-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769330917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330917, "uuid": "8662e541-b982-4e73-bb6c-5eb569384716", "comment": "Malware payload (ValleyRAT)", "value": "87aefee0906ca6d4f7e3d88a531808d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330917, "uuid": "062f0679-1c05-4779-9991-cdb4bdbc9205", "comment": "Malware payload (ValleyRAT)", "value": "06cc9b618496913fe02cc75ef9084bd2e10a18ce1ecf61d6d49f4c5b52e76251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330917, "uuid": "4cc7fe45-25a0-4895-a69c-569c848e1185", "comment": "Malware payload (ValleyRAT)", "value": "7e136c6a561c40cf01ce37269be5dc7750ffa54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330917, "uuid": "6e9c6b50-8c8c-45b3-985a-d513a5d49546", "comment": "Malware payload (ValleyRAT)", "value": "bf77e90e99a0fbe0f0eea5f73c752607e4766729a90904b78f1e481dc7230c7b7799fa983b3a2ec9e05662ec72181a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330917, "uuid": "514fee39-3eb1-4e44-811c-7c7ff071755a", "value": "T16E2833DAC0C27D13DF49CB7B860F154555990D6BFF61E00D4F9B39A43EBA9102AA82B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330917, "uuid": "f97a74f8-6d4d-454d-a5ab-953edbb8ff4a", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330917, "uuid": "65f299af-ff4c-4768-8b4e-567fa728c697", "value": "1572864:pioJQUB3PPRn+dGMhFgJzkOAS89MXOs4PEAIOKi0Jz4Ux2yRD4TJj6IEGHzeqspM:R0dGkFgSOAcCxIOKdt2yRcTxFtzeBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330917, "uuid": "307b446a-ebef-4471-81b9-fcf230e27690", "value": 101327257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330917, "uuid": "fa6e483b-b215-4a13-b51d-87d17e5d51eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330917, "uuid": "19cf376d-443c-4721-bd31-c63a2a0f12b8", "value": "Xanbfuiuabeguverk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbab44c-f9c3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769327872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769327872, "uuid": "64f3198b-ea4e-45fa-adf1-d872fcde94aa", "comment": "Malware payload (AsyncRAT)", "value": "3c4b70f9f93fdd445b1ac557c6658460", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769327872, "uuid": "d30c889c-33ad-4fcc-9fed-bf980d1aa60a", "comment": "Malware payload (AsyncRAT)", "value": "07f553c7e997169afc8a192d0484441cea752f8154ec0e54dc756946aeed6049", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769327872, "uuid": "cc94d61e-9d2f-4ca7-9ea7-3082f9f342f1", "comment": "Malware payload (AsyncRAT)", "value": "266d0033ab9da5e67a4f646c70e2851312c6ab5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769327872, "uuid": "a0403cec-c55d-4212-994e-11d2422bbf6a", "comment": "Malware payload (AsyncRAT)", "value": "bd32d78768b3919b1de9907a79064dca7506b7ced1f481e1f381b5e50c8cba391cea8292ed8b4217e6dedbf42abae779", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769327872, "uuid": "2d1f256d-9269-4a57-8632-9cab7ca01955", "value": "T1C7936B013788C925E1AD4AB4ACB345010AB5DD772105DB4F7CC63ACF6FAFBC646126EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769327872, "uuid": "bde4e348-c259-49d2-9af0-51615d0ea2f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769327872, "uuid": "068eb963-2bc2-4ab9-bd6f-e84965117a53", "value": "1536:ZerGI1C9tH0ynPbbSqNEGwrWySWRTQrVclN:ZRIkIIPbbS5OoTQhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769327872, "uuid": "92e6a101-c85c-4ba4-8351-c9f0eddccddf", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769327872, "uuid": "1e34fd7a-8f7c-42ff-aab6-9f0f1bbf608b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769327872, "uuid": "3f34b232-a069-420e-b5f0-a908b5eff13b", "value": "www.agitex.africa.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303e2530-f9b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769322563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322563, "uuid": "b5f50e9c-458a-4b5d-83c0-ddf06ba6d4a6", "comment": "Malware payload (Mirai)", "value": "84db6633c7f550364f803a0542e21a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322563, "uuid": "9c748847-ce30-437c-a308-b215d18cfd9d", "comment": "Malware payload (Mirai)", "value": "0862cdfccdd3ea907eee9020181560d14f45dfc25867762aa249d69251632c19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322563, "uuid": "ec6b99fa-f667-4157-99a5-298cc6e21910", "comment": "Malware payload (Mirai)", "value": "972a8980efd341dff81c972980ed2a5cc4311d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322563, "uuid": "dfca9918-c521-4993-b4ab-8a423afcd8f6", "comment": "Malware payload (Mirai)", "value": "7d755cc5a5743790438d432ff8e6c4951a75bf0b21439649f2342d05c5ee3779ec315319d93e27fedba7061f7cc2b573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322563, "uuid": "fa151f34-e310-4c00-b5a4-318e31dc949d", "value": "T1885338C4E2D3E8FADC10087D316AAF629E73F13AB135D99BD3D959639901A02E10625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322563, "uuid": "9f630b33-9586-4731-865c-719d5bd10134", "value": "1536:0UEMAWwPQk161TTWKRmyaSkDu4eFOVqr:0UEMAWwr161TTWKRmyaSmu4aOqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769322563, "uuid": "ffdb5d56-5c7b-443d-b9a4-d9fa61368718", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769322563, "uuid": "34df92a5-3ea2-4e32-8f04-faecc6a3eeea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322563, "uuid": "6f8ed436-62df-4280-b7d7-4debfb9e2633", "value": "cosmic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ded38bc-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362126, "uuid": "76e1e5e4-3a89-44c7-878c-ffc7e3dad963", "comment": "Malware payload (Mirai)", "value": "09fe922536c86b638e1d6d1dc395d078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362126, "uuid": "80feea04-428f-4377-9989-0bd761532027", "comment": "Malware payload (Mirai)", "value": "086bfb98b04f079261b124e9a02c9d80d8e6eb035dd9a1dc71e3a2e9f55fc246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362126, "uuid": "dd9e33b1-c076-4f2a-b21c-0220ebee8858", "comment": "Malware payload (Mirai)", "value": "f4b29d71687e3b3064193824e45e54098ec585ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362126, "uuid": "08138139-bca8-4c0f-9808-2ddf12eb2e7f", "comment": "Malware payload (Mirai)", "value": "3b7b3dd38ad28d70c7d06f7ba33cb4da2a326afbec3f19edbdcb3089b7cbbe2d49cd3c46e80e19c4a807ac322ec195f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362126, "uuid": "f5917331-64af-4bd8-9099-84dcefa356c6", "value": "T13E5302F650D87DCDC1965334060B06473EC667B8A099B62AB6C4F6A88BF2340CFD5BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362126, "uuid": "54057540-ce17-40b7-92a6-5ff85b3d8bab", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA3enoLLkg4azHh:CM5az1Fy0oPgdZX6hTo8RQYsLGazHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362126, "uuid": "db11b940-ad0a-477d-b14a-0ff7e3aeb930", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362126, "uuid": "3e8da6f6-a532-4720-ad47-088538ca1321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362126, "uuid": "3619b757-843c-429d-a43b-cd98589e80c2", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075befab-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362437, "uuid": "1da220a7-f1f7-4823-93ac-8d4da5fc5061", "comment": "Malware payload (Mirai)", "value": "52bccc5c95e7e240e268d14bdd40ca96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362437, "uuid": "240e590b-e5ec-41c5-9d7d-3c8ceded27a7", "comment": "Malware payload (Mirai)", "value": "09473bdbe8b3f03db9f576c4c61b91104eac1ec8d00a79e86eb57333d117289f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362437, "uuid": "821d8293-360a-48ab-8227-a59ae494d233", "comment": "Malware payload (Mirai)", "value": "df59c9bc14a45226907f767e0d0041435e453abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362437, "uuid": "33b602e4-397c-4663-9890-7c7d1bc9538f", "comment": "Malware payload (Mirai)", "value": "70268d61db540c105c62dc9bcf4ec6e0d953654fd975b81476ca1fb0a2258d4b7b5b788b1776387ea0cad48401485e3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362437, "uuid": "cd0e023f-2c5f-4a36-84d8-7ec325ebc863", "value": "T18B934A4273690447F2A74DB12C2F6BF153AED5A221A0F285694FDB0F8135A322586FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362437, "uuid": "62cdc84b-55df-4cf0-90b2-d55df6f370f0", "value": "1536:5hH4gxqHHOwX3RfzaXkrLYIHiv2wTBnTWZGV197IcXDbG5PyDV79qzIgnXw:5AOwxmdBnTWklIc25PuCXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362437, "uuid": "a25ebc26-cc53-49e8-ad49-51642ac866c0", "value": 95724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362437, "uuid": "116e629b-e6af-4075-8b42-c5c0f54012a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362437, "uuid": "fd5254ea-593d-4d6a-a340-bd3df1432821", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d94cbe8-fa20-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769367682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367682, "uuid": "c4142d61-0b8e-4a39-9301-412e08d36195", "comment": "Malware payload (Mirai)", "value": "32a7bdf7a9607525749d52b8a8b7c4ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367682, "uuid": "e374b142-4ffc-430c-8f61-2b799ea5ac8e", "comment": "Malware payload (Mirai)", "value": "0a21a591db78e6c887188a23c0fb4910bbd95d180c695e57697219e39350705d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367682, "uuid": "48103651-d64d-4766-b0a8-95741ab0d90d", "comment": "Malware payload (Mirai)", "value": "a887e93a2de98177e414d205f12de0c6da84cd53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367682, "uuid": "fb5e5666-b155-4f7b-acc8-d0550304f987", "comment": "Malware payload (Mirai)", "value": "96c5f94db765273a92e2f89a51465ea78ee1244a398a26f922d28ee7758d376a78e48b4d72eb3418f1a5ccf826a409ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367682, "uuid": "05c168db-a1c8-457a-bd9e-1670a8b2fb83", "value": "T10D148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367682, "uuid": "7d69309a-cb84-4dd1-b675-1ed00234a8d6", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRxUKG:IcY5JpMByVs9jSEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769367682, "uuid": "5d666173-b233-426b-897b-9f462a105126", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769367682, "uuid": "9fb9e58c-8259-4425-a0e5-98018efc435a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367682, "uuid": "16912d22-f66e-42bb-8fa9-3f0fa52b7942", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50ba6ca-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769333550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333550, "uuid": "445d405b-74ff-408c-bd4f-fda6fb93f04a", "comment": "Malware payload", "value": "0d9cb473f1c9071c518ea3e101ec35d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333550, "uuid": "9ea8dc9a-5a54-428d-a046-fc4e9faf8877", "comment": "Malware payload", "value": "0a2b107eabb7a1cf3c9774c4d505745f1b5494d0864e33b2335eec869393c10a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333550, "uuid": "5ae35b6c-72b9-4daa-a25a-6ebbb4625b6b", "comment": "Malware payload", "value": "87e0f7deb9c1bdafceff345efaecd568d97a8675", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333550, "uuid": "fd6d2ff1-f845-474a-bfef-bc3e13ddbadb", "comment": "Malware payload", "value": "d0ed1489424fadedab9a65b3386f5d2b32fab9d76e72a5593802fb70fbdd119a4e084d1e135896b5210de80895eb7f4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333550, "uuid": "54f4105a-c453-4eef-8a09-8909e1264dc0", "value": "T1B641BFC8301023D1356BEEE4BA7AC5D6E283D592B5D84104F8CD94B48FBC93065DDE75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333550, "uuid": "5a63e2cf-3063-42b7-aa46-fd89f6666653", "value": "48:FxKiu8iM/7p/GOTjHCp1SnAKXWTXsagDCx8gU7H6f:FIyz/lTjXAKXUcL+x8ggHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333550, "uuid": "e2c60364-5ee6-4661-80aa-2934391c7b85", "value": 2212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333550, "uuid": "8ae96833-825f-469f-91ae-e9aeaba68484", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333550, "uuid": "ee343685-e659-427d-8992-0a32fe2a5880", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22489777-fa1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769366348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366348, "uuid": "9e3360a6-6343-48e7-a8ab-da3b92ee0ceb", "comment": "Malware payload (Mirai)", "value": "49079d790a4e4c14aac480e2fb7997e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366348, "uuid": "2a5124dc-4ea3-41f8-834e-ace5690e5c60", "comment": "Malware payload (Mirai)", "value": "0a37490127875a2a21a90eb6ce43a6642ecb2d737d81815c031a4c8f190d6abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366348, "uuid": "be7027f9-60f6-4682-8ef3-38a33f4913ac", "comment": "Malware payload (Mirai)", "value": "c90edcb0149f22b8161350e02bb1e6c7283c29eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366348, "uuid": "a3d47d40-5ee0-4dc0-b218-bded39945126", "comment": "Malware payload (Mirai)", "value": "3ce96b86fedf9cab2282c262ef8623c688b488d03c24872a0308ddcb324b34a95ff92acaa3ea03dd8284ce7110c77db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366348, "uuid": "3622f445-c508-40ea-9d11-7365e2570e22", "value": "T1D4736BC29143D8F5E9190174223BF337A672DDB801B8FDE7F7689672C42A6A0608774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366348, "uuid": "5c6e10f3-19b4-44cd-b39a-20dcaadc26d9", "value": "1536:bRvChyexcj5Du80uumwhi6Z52kCkDc24aH9rEAcjj9oiesHG0Fw8rb8t+:bB+ZyNDuJa2Z3C2c2jh+9zvmKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769366348, "uuid": "37811f5b-0b59-4b09-8566-868c963f1bc1", "value": 80532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769366348, "uuid": "ca3fe4d5-ef74-403f-a061-4ec4fba5ab48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366348, "uuid": "20b8b84d-9ec6-460d-88c6-7557d140fbe4", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3c8b5f-f9fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769352674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769352674, "uuid": "fbd16f25-886d-4fd1-80f8-5386effe569b", "comment": "Malware payload", "value": "b29f2c79457996242770da3a18396bef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769352674, "uuid": "7ef6529b-1fcd-4f3a-b11d-6068d79b2d78", "comment": "Malware payload", "value": "0b12a1e35c4d8464ba592c140726330cded2375cc975cd536e439edefdf9727b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769352674, "uuid": "8a2b061b-5e6c-432b-97b3-8ae7a23f35a5", "comment": "Malware payload", "value": "d8eaf1bfe14b3767ab6949274b5459deb9e6e604", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769352674, "uuid": "65080908-56e3-41f5-b959-dd73e7acd36b", "comment": "Malware payload", "value": "fd316262b15f9309eb242f754ccd453b70456f773bcb89a09b69f5199d352610322f0930d6661578d985a75ee7bc1b8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769352674, "uuid": "e36f8e04-a99f-45b4-bcdc-dc38a067f8dd", "value": "T12D861208382097C6D1F380F94CAF7B43E7643D70A2F01B52E6597C66A63DAAC359B617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769352674, "uuid": "d74fbdb8-e501-4fc9-bc4c-e3af35a21f56", "value": "196608:E8krYO710csaLk3Kyro5WWmF/UySel83Cc3vpiAx4aTQL:ELrX71E84Ky05Wl1UwlQ7MEmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769352674, "uuid": "e403a455-ce98-48e5-8539-472284f58984", "value": 8184304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769352674, "uuid": "a0ef0845-06b4-47d6-a9ea-1d2f10d06639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769352674, "uuid": "3ec81564-5b93-4201-a2da-e98537fa8344", "value": "Agrello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a49c03c-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362120, "uuid": "4d67d66f-8871-448a-84bd-19ca164b1fb2", "comment": "Malware payload (Mirai)", "value": "7394829001113808e142d0e4220770ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362120, "uuid": "e56c982e-77d3-49b5-9949-4ab9b1a9b962", "comment": "Malware payload (Mirai)", "value": "0d75bc2243acfb039130060fa80e5c9e1691d83af4447668fbece6a6e433598c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362120, "uuid": "c2d28439-1e2e-499b-b703-26bed624db77", "comment": "Malware payload (Mirai)", "value": "64756f82e351a8ec579a19bd5329dbdd91664567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362120, "uuid": "b5dd01a8-dfb4-416f-91ca-39b94abc3c50", "comment": "Malware payload (Mirai)", "value": "156ac073c848899058e12370b3ce4d2ba9d0a26207c4b8224d27bcf9b1eb1acab497c7a8c92eafc63e5dfe33ed62b750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362120, "uuid": "d375501e-3957-4141-9482-519b9f75bb0d", "value": "T18B5302416A7CE839CFD2C5390B6C41F946C859F868D6500E53C97CF48A06D64AFEC697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362120, "uuid": "a81b8063-735e-4aac-9b83-1aa2a2e038a2", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/R6AQu:IaHJgMo8FwOA4zUFGUO3UhntQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362120, "uuid": "3ad1035f-ff45-400f-ad0e-4010f5de67f4", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362120, "uuid": "19d58b68-9956-4ca8-baa8-c4a10529b7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362120, "uuid": "99234696-2c5c-485c-9dab-0f3f05015082", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4c721d-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362129, "uuid": "387d8e02-ba8c-40a9-95fc-fbf2fb47e2dd", "comment": "Malware payload (Mirai)", "value": "84c6c09e56237a3b9e08f96b5649187d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362129, "uuid": "91bc934d-4bf1-44f1-a64d-63420bc11e47", "comment": "Malware payload (Mirai)", "value": "0ec7707dc0732d7e31480d88b0655e1a8fbf51bbbed74daf5dc2c6522f5f9a0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362129, "uuid": "87c46b12-3f4f-41c1-9646-854d543a43cb", "comment": "Malware payload (Mirai)", "value": "69ddc6206d23a478a5df2c85a47baae59547232f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362129, "uuid": "6c399ee8-6997-41bc-bdc1-1d907152fa0e", "comment": "Malware payload (Mirai)", "value": "16c421c26f315cccfbd24128ed6e397e5f91ea19284070c3a724b9465c82f3c2f0db4a8224dc89fd8c5e692383eefea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362129, "uuid": "86872237-d1df-435b-97b8-a7fe6609d63b", "value": "T1B3B3E085B210AE55C02672FCB1870A9093B27E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362129, "uuid": "3dfa268d-b45a-42fb-b1ad-74155133169c", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wub:as5zqhr5Nzy7wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362129, "uuid": "7d9a8255-5a08-493a-91d7-de63c0a01ae0", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362129, "uuid": "e9e881de-00f1-4ffa-9f54-9e054b7ad091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362129, "uuid": "b78e4a9b-31af-4fe2-ba62-41eaf5c337d8", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce69a406-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354611, "uuid": "64c4dc32-601c-4dc7-b2df-ec64ae741e8b", "comment": "Malware payload", "value": "e2caf8f013286aae871a04c47d4cfeb8", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354611, "uuid": "6e18b6b7-ae47-4160-8a19-1e1b56bebbea", "comment": "Malware payload", "value": "0f583cfe3f4a58cbed22be3c45274a8dcee06e290af4f717a21403d9777aac59", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354611, "uuid": "b3ad4606-83a7-4c54-8e4c-05324f43fe88", "comment": "Malware payload", "value": "1cbe7657c4b347508b5c70b2c15c9e5a07f6fef6", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354611, "uuid": "9d6994a3-fd55-4a08-b0fa-1a62b5cc01f8", "comment": "Malware payload", "value": "27f1c95ac28c0256cfbc5a47ed33f37e2af2aed082045a8cd30776fa4e9b2698e520c1e628a1ae563ae4c993f93c7335", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354611, "uuid": "410459dc-535b-449c-a56d-b8bc2c89468d", "value": "T1C2157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354611, "uuid": "6a24e8e7-9d38-4a5c-a216-9a27225f54e7", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354611, "uuid": "66730301-ade7-4fe6-b104-59dc0015fd59", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6/G:d/QMnl5YL7WzZyQRdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354611, "uuid": "9ef82e97-54ae-4374-84f6-0a3598b6452f", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354611, "uuid": "b6b39757-58a2-4d1f-9ffe-bfbb0d4e59b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354611, "uuid": "eff825e7-a568-40e7-9d18-b815b63ee14a", "value": "Y692677995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a256fd5b-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354537, "uuid": "b1787c84-cd18-4fc1-9f42-8d7cef0cb1b5", "comment": "Malware payload", "value": "8de059855169821590e599300fd1c2e0", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354537, "uuid": "5212be09-55ec-4736-9a3c-750191c86251", "comment": "Malware payload", "value": "0f627a2551efd46b218c2e9097c8be13e51db2be83065be7bba65d6a420b2060", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354537, "uuid": "c27ed944-b530-440c-85e6-2d80f4124862", "comment": "Malware payload", "value": "1704584078cccf2a847eb127738da4b02923b9fd", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354537, "uuid": "ae1250f8-a28f-4d54-b08b-cce1548d9076", "comment": "Malware payload", "value": "f4d5c6458dae34b5719d98bcaa3bfb72b6f3617c5cf77edd46df0f600c69dfc1a8308b14d20369b01e352bb96fadd8b8", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354537, "uuid": "7ab3b6b2-9f59-4a19-a255-491f1ed24f8b", "value": "T1B6C09BBD1A59C53114C01DD2B462B4614DF1D3D0FFD5B57005B8B0974E55D9C74D5891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354537, "uuid": "89c31f0f-0a1c-43a5-8546-fb52d491a370", "value": "3:Mu6vsUSKWaUWlg0qYGRXkZiEDjNVHqKpAtzMFvn:96UUYaUbYWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354537, "uuid": "0e42c45f-ffcb-4ada-8f35-20d23a8a4782", "value": 139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354537, "uuid": "c4a3f7b0-f2e0-44ea-b182-9822b71f9501", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354537, "uuid": "c036f21c-7198-447f-ba47-8ff95d06a39c", "value": "Y430646063.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736827a0-fa28-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769371209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769371209, "uuid": "00b91807-979e-415f-a655-a5999b4fa3c0", "comment": "Malware payload (RemcosRAT)", "value": "940a16187ad3b68cfa78f26b4ea060ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769371209, "uuid": "33d374e8-8258-4799-9a72-8ef892c78a9d", "comment": "Malware payload (RemcosRAT)", "value": "0fa3b5d542e555a456a1377ad125bce99f86500d5499b708bf24eab0d8767102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769371209, "uuid": "4a928f08-8630-43ae-beb0-38302dc179a6", "comment": "Malware payload (RemcosRAT)", "value": "3f88522674402060d87c5c5ba1c93ec9dfa9d497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769371209, "uuid": "f07ce623-612f-4a7f-81e6-e01977b54c58", "comment": "Malware payload (RemcosRAT)", "value": "d1b2b5c03ee7b3b435927a6542196beaf277ad31327a56aef693f49a760766d90af0b5ec226ad643a24bcaa6a87f740b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769371209, "uuid": "f584040b-c320-4b1d-9126-4a20157486e1", "value": "T1E5C4D01EB128449EF9105B3404F7A31FACA9EEA47E73895F0332FC565B729111EC7A68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769371209, "uuid": "25e3d57b-c789-4efe-b3d1-7a1781692262", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769371209, "uuid": "e995c536-0098-4d14-a4a9-ca88a70bb84d", "value": "12288:O4nN/o/ozvdYrZTfmXNqN9TNveVIucH4ibg7G16EHrx4Fs:BNA/KvdY1jmXNqN91SMfbgrW+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769371209, "uuid": "e6175c41-07e1-4415-a677-81160bd6185e", "value": 569440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769371209, "uuid": "4aa89c10-2b78-4f38-99c1-ef14e7500321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769371209, "uuid": "0a1a0710-4521-4e38-869d-bc2c0b2d5d2f", "value": "r2025PERFORMANCEREPORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315c74c3-fa10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769360790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360790, "uuid": "e7db9455-561c-404f-a836-909dcd3a337b", "comment": "Malware payload (Mirai)", "value": "763ae5f5b3fa98edcf19489402d4e3e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360790, "uuid": "61886ab2-7759-4cef-8611-30c3bd98c229", "comment": "Malware payload (Mirai)", "value": "10c14d19b4a9658d8643ddb46b5db04dc80d0c7599303c4364e5fa374b24031f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360790, "uuid": "60227511-88a4-40ee-80ae-449e4354cae8", "comment": "Malware payload (Mirai)", "value": "6694c9506e424dcc144137dd08bbbf62a733cdca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360790, "uuid": "c5dcf007-7ca2-4ff2-b7e4-cf6151796732", "comment": "Malware payload (Mirai)", "value": "4cf556c2071b0f7d92777b365813e09200c0a5aa6fc641a07c395b34fc08b93c7ff6d84affb76c9dabd77bf0548d8235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360790, "uuid": "aeaf353c-b826-4ad4-86bc-0aeb7939805f", "value": "T1675302111A6CE83ACED2D5390B6881E646D84DB4A493901F53CD7DF8CB06D68EBEC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360790, "uuid": "1da271db-e8a7-4758-a773-053114312b4b", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/u0qlhAQR:MaHJgMo8FwOA4zUFGUO3UhAeQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360790, "uuid": "11dd440a-5eb6-4324-b314-c43c062c5805", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360790, "uuid": "6e3e5509-cef3-4e7c-a9fd-968a5d66b202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360790, "uuid": "aeb65609-2a0e-40c4-ac8f-85f993220c4b", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d349308-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302479, "uuid": "e54a91c5-c2e5-4f52-ac7e-ef84304cdf5d", "comment": "Malware payload (Mirai)", "value": "05689c0ca648316950cb5a836049402d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302479, "uuid": "e6687e68-0554-4819-8c90-44d66ef37245", "comment": "Malware payload (Mirai)", "value": "112cebf79517483b0d3ed420420a582578936d9d751d7dca6624e26e641e60c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302479, "uuid": "bab85294-6c6e-4496-8b91-c752be58a0dc", "comment": "Malware payload (Mirai)", "value": "ffb69bfbd6159682b67e4c560e28cfa059135bc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302479, "uuid": "2657a70a-9438-4f57-ac96-f2ef96219dc4", "comment": "Malware payload (Mirai)", "value": "7b2b09a2699d8b877fa97e7e9c480e331fe9d85578ca79eeb9e08ff8fe1970166c711924c569fe436fa032da96ad42d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302479, "uuid": "205ec8ca-00b4-4913-a792-4b959306103b", "value": "T16CE2E105CB2368E2D0F05D379E14CFC26A2966BDE685386412B8AC58EBC7D4121F5F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302479, "uuid": "d9823995-406e-4b80-b2b8-7671ad088e76", "value": "384:ntvMExs4QVK7AV8TfL46dV1WtTWbobzf9qXmI5FMcVb8vcr13o0nJZJzJsm29r28:K4QE7AVyLbUkYUl+kh37Jsmj9q3UELC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302479, "uuid": "81fdbdcb-c75a-491c-9c6d-9f5bb81fde9e", "value": 32044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302479, "uuid": "c0b094c7-5795-4794-880e-94b2f7624c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302479, "uuid": "9630d585-4aff-4fd8-ad52-8b7da0e4f6f9", "value": "SecuriteInfo.com.Linux.Mirai.9788.30677.31695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c41d21d-fa40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769381478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381478, "uuid": "f98efa0c-6680-4c2d-8c66-6e460495c932", "comment": "Malware payload (Mirai)", "value": "9853ff336fb85e062b528655325f10b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381478, "uuid": "6b4157e7-4348-4a5c-a846-69eaeae1fc54", "comment": "Malware payload (Mirai)", "value": "115ba7461c23928d82557c16bf70b0b1b06d0dcec8a28622463d349ee696d4b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381478, "uuid": "090925ba-d95e-4cbb-ad30-84ade3a1d647", "comment": "Malware payload (Mirai)", "value": "414bf6a0df87f748078091e96839dd54bbabac51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381478, "uuid": "79025f64-b03f-4076-8ece-875c32db6d5b", "comment": "Malware payload (Mirai)", "value": "5a8202417f10833ca657aa47115025d7978b13b3a61093d1f6075774860d4eddff5feb537de41b4337b083b923337a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381478, "uuid": "74356212-239a-4d57-b64f-39e476522e13", "value": "T1D893871E6E228FEDF7AC863047B74E31A69933D627D0D685E26CD5041F6034D642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381478, "uuid": "793d78b9-4eef-43cc-9bcd-512c0f138c13", "value": "1536:FaDp0OH278GT/pzjJMmCeeGUFeoph1NZ5sbI:WlW7BzjCPGUDHZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769381478, "uuid": "d0ef5d8b-3bb7-41ab-9b50-cf83e76fb026", "value": 89944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769381478, "uuid": "7d46c5df-05db-4c76-9f68-89ba0219d251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381478, "uuid": "555c607a-bcf7-4a65-a6bb-8718766aff94", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8714d93-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383431, "uuid": "fafa1518-b81f-4442-9662-0b16c51bcef6", "comment": "Malware payload (Mirai)", "value": "8e8d839ec284b897e8a2d87164b81c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383431, "uuid": "53c76838-bd64-47b9-9645-5dd25ef1dcda", "comment": "Malware payload (Mirai)", "value": "12875da1563b1537292717752eff88cc5b994a142f1c789f58a797dc162fb6f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383431, "uuid": "c6f35b3e-887d-484c-bdcc-cdbd27f05bb7", "comment": "Malware payload (Mirai)", "value": "099dae8fef4eb3b5448e4b343de82a6d47f70184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383431, "uuid": "20e4be0d-7dae-4292-ac7b-c0770f40980a", "comment": "Malware payload (Mirai)", "value": "25b5173df9fbc0da64c03190d083cefc721549ff56453f74a8677c76a15c4f62830b4fdbef4c18c3a2ef6036273ff8f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383431, "uuid": "b7e47a16-5597-4e5a-a110-97c9196c097a", "value": "T15F930AD6BC818B11D5D126BAFE1E608E33134B78E3FA7213CE185F2E574A86B0A37515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383431, "uuid": "cd1c3859-29a2-4cc5-abe3-dcecdfa430c8", "value": "1536:gRngDBGtI9+ryFxsRkFUSEsLYf5WuRse+Xed2i+qotnBj/wDs2MGitQgB02Ykb7e:zGtutxseFUSEsEfjRKXemtn14mQgB02Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383431, "uuid": "1dc7c2ce-5893-4fbf-b820-60a50f0b9976", "value": 95608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383431, "uuid": "b530b468-adb4-46fb-b6c1-19ec743ef1e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383431, "uuid": "0f5070ac-b369-4647-96df-a789f86ef685", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcb0b7e-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344728, "uuid": "e891420d-583c-4f77-b651-1134e29eb557", "comment": "Malware payload (Mirai)", "value": "aa0fbe036011787dc316b478f47a8c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344728, "uuid": "cb5c3e13-900f-4adb-833f-38455adf10c9", "comment": "Malware payload (Mirai)", "value": "1396d4e1232caaf2f1a4ef6cfb0f6d1e1be161ffde737df4b1dcb2de7977e68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344728, "uuid": "09a44fa5-7e55-4fdb-a578-0156b8718bab", "comment": "Malware payload (Mirai)", "value": "1402ecae0a8579f42c33ab42b2082e378722ba82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344728, "uuid": "b7e82040-cce9-4905-995d-6d08b298fd1d", "comment": "Malware payload (Mirai)", "value": "24814c489c8184d59062ce8e7cd8cf5916810342eea17e417cedc61ab5c8a7ab74d6bffe2e1f5f2533b15b0772ac822d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344728, "uuid": "16453a75-1bf3-4517-9319-159a1bf10f9f", "value": "T1E6D33851B9825A27C6E123BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344728, "uuid": "380c0bdd-5da9-4189-941e-976f5cfca009", "value": "3072:Z7avDi52+/a+WyBaPjgAYkYQ+WSrpZNz5QQG2:Z7a+y+WSkjgAYkR6rp7lQQG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344728, "uuid": "481fdbdb-ac1e-41f9-86b8-5d22db678f32", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344728, "uuid": "37f3addc-206d-4832-ab30-00adb17266c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344728, "uuid": "1b91b1dd-ed2c-451c-a6f8-4999b6a138b8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0464e8be-f989-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769302732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302732, "uuid": "97808b18-cd13-45a1-851a-1e5de2cacc3a", "comment": "Malware payload (QuasarRAT)", "value": "44fac70f9fe2546deda57b90bcbaec9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302732, "uuid": "a68b22e9-012e-430c-88e6-39837e63a1e1", "comment": "Malware payload (QuasarRAT)", "value": "13a2e5a75a8af97bb542173f488c7c7f3f74a277181bfee96a6241733165c214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302732, "uuid": "02ebe491-5f13-4fe3-a125-cb4eed05c828", "comment": "Malware payload (QuasarRAT)", "value": "af8fddbfe46dd6da28c8032a78ec6572f8c0ed5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302732, "uuid": "dcb35a57-42d3-4705-b440-d3f4ca0647f7", "comment": "Malware payload (QuasarRAT)", "value": "2a281356ecb251eb7833d06e7f7ce52c5e843bf888839edbd675c3d89017fafd64299414648b3c476eac74ea1b199cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302732, "uuid": "35c0302c-1518-400d-924f-bc20833c1a7b", "value": "T1D2E55C043BF85E23E1BBE27395B0041667F0FC1AB3A3EB1B5191677D1C93B505942AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302732, "uuid": "1fad13c9-c8f5-44a8-ba3c-fb15f9b799a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302732, "uuid": "6b4d9b01-1b12-4e8c-b56d-c06a3a5817ae", "value": "49152:tvXrX2iUaN625PelqxqPsfr+ka6hwjbR03LoGd8sTHHB72eh2NT:tv7X2iUaN625Pelqxqkfr+ka6hwGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302732, "uuid": "73480e8a-bf56-4322-b02d-f0f95a49a563", "value": 3267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302732, "uuid": "eb3c96cf-d166-49ab-b54e-3082f1a2f304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302732, "uuid": "8799ba4a-be5d-4c22-88d8-31fc5a163a3a", "value": "svchost32.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45b4149-f9e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769340796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340796, "uuid": "3f35e0a1-4ef0-46c0-b034-f77227c716b9", "comment": "Malware payload (Socks5Systemz)", "value": "868a963de024f3e627626e3bcab3bac6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340796, "uuid": "3678223d-775a-4d69-8176-434d853a1435", "comment": "Malware payload (Socks5Systemz)", "value": "13a744fd48250acb52c791b0c2b16155e089b9e9e85758fbc0fe0cf63c5ba550", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340796, "uuid": "135d7ec9-9c28-4bfb-a4c5-5c0f5032f6b7", "comment": "Malware payload (Socks5Systemz)", "value": "fe68571dbeec5469f4ea1cd8289fff9044012d81", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340796, "uuid": "bde45fe1-8070-43f4-8c68-91f128649619", "comment": "Malware payload (Socks5Systemz)", "value": "cd8a6d6d86da81aaf481df1361dcb3e483816c6eecac36844d5ce5040ffbe598685a1d80d1ed982a8a52ac1021a5c996", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340796, "uuid": "be4b5e65-bea6-4840-8437-047ba89df8ab", "value": "T100F533D9E9811F78E631C93E653D7A09DD646FA40D3E315532CC2A0C5E6BEEC86063E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340796, "uuid": "6d185a21-df44-44dd-ab5d-13e33694aa93", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340796, "uuid": "edb2acf9-a7a9-49b4-bef2-2414fecface0", "value": "98304:MRDZqGdfKRHFgV1d7RovjgWka+zRD/AwWOZEI:YtVdfSEdajgWka+zRE1OZEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769340796, "uuid": "a91bcf54-168e-4cfa-9956-72d1cc18d2bd", "value": 3423579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769340796, "uuid": "93a9e623-1520-42c5-8e31-73323a56d2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340796, "uuid": "87e9ebde-ec9b-42c1-9e84-671f582738d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc6659c-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304357, "uuid": "579dcb31-f462-4130-a2b7-7c9c4db9f4a1", "comment": "Malware payload (Mirai)", "value": "dd98639aa484049f7dcfea21b25a75b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304357, "uuid": "6a1b0c87-7694-488e-a624-05aadb9912f9", "comment": "Malware payload (Mirai)", "value": "14146d836cfc09f3dc65648a4fd3a99b5e0913a5f14b625aa0a15bfe0cc9385b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304357, "uuid": "7ea5d116-362a-4c5a-8298-f6aa833884df", "comment": "Malware payload (Mirai)", "value": "1e9910b626f02d96022dae4d7169c0b742a604ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304357, "uuid": "6538a9e4-73f9-4a54-94e9-a8ccc53b859b", "comment": "Malware payload (Mirai)", "value": "210794ab3b6b57b4e01616bbd0364317a979ab8b6a77453cdc2e8f34b06bbf09fd8b6ae0ec5b02c0203a2028bdf4e63f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304357, "uuid": "524cbf85-2d21-406e-98c7-0285d1398195", "value": "T140D2E11CD95D7905C9AD3DFA11CE5AB9398CB0C0635DFACE17264418F727A8BAC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304357, "uuid": "2812b6ba-0b55-4fc7-a606-215323178e10", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNNJbUWU3:kbDs06t4BEub4sU/MbUNY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304357, "uuid": "029852f1-7f0f-437e-b90f-fdad2c444fe6", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304357, "uuid": "1f3ca1a2-fedc-45c2-83a8-6644f393cbbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304357, "uuid": "34dd0de6-e994-4754-8d97-796f338875c1", "value": "cosmic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e8e4a0-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769330196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330196, "uuid": "cc742209-113d-4f27-9ae3-f55f21561fe5", "comment": "Malware payload (DonutLoader)", "value": "75d6d2b38a8d164866917eefbd9d1e80", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330196, "uuid": "c8878c54-5121-493f-9c67-9e6fb12b0831", "comment": "Malware payload (DonutLoader)", "value": "14dea3b088360eb377ab3e1cdcaa6d910d3fe810c8f4bd08ee33e027fcd42ce9", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330196, "uuid": "cbc8191f-1bce-4915-8c5c-7bb3373d465e", "comment": "Malware payload (DonutLoader)", "value": "491cc335eba69ffb4b42b210723115dc7f4edd91", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330196, "uuid": "93e3f2a3-ade7-4aae-999e-1187e80f1db4", "comment": "Malware payload (DonutLoader)", "value": "fba9314e9e317b746b157687e66b0cbbd357d61c5f7755f4b5e3e1b9ba3e88c43d99f7aaac465f3456c652f14f4dafe5", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330196, "uuid": "55648bcc-f0f5-4c22-a423-17e560232eee", "value": "T12A87337B02D78C2CFAC23C30CED912FD6C7D724F5D9D262F2A8D5894591A59E6281A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330196, "uuid": "e8eb4b36-c7de-4102-a683-a9e9379c5ff0", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330196, "uuid": "1ffa1ef4-9902-48f4-ac77-c910eef79817", "value": "786432:a1i9BQRtt3W8tkaLrSsvBF1QNUw4SWNknSMUmS6w3ObQvqJee:a1i/OTv/bpF1FIWNkSPGw3ObQvqJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330196, "uuid": "6aa7cad8-6f61-4075-a555-8fb9483de9c5", "value": 38067845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330196, "uuid": "2fac2218-62a5-40f8-a9f6-eeb6726ed24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330196, "uuid": "1e01bcf1-4f4e-4f2a-a09b-1781a7c8e958", "value": "Ltpro045-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc8d07f-fa2a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769372249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372249, "uuid": "f1c3181b-dbfe-45f5-9837-e2fa134b3dbb", "comment": "Malware payload", "value": "71ff3647e14a7cecb07d05bf96be4f61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372249, "uuid": "f3d864c6-f8dd-431e-ac65-3cb54e09b516", "comment": "Malware payload", "value": "15f94c7f118631a3c392f775200d5f5d4d4e16cba26d128abf851a27451e5a96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372249, "uuid": "089f1f41-36e9-42ee-889f-4a45b01c8833", "comment": "Malware payload", "value": "7336c2b2f8f1b86982369b4b5f3fe0e83bde609b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372249, "uuid": "39222af7-2b24-4add-a3c3-d99eaa8ab0d4", "comment": "Malware payload", "value": "e2a6bdbb88e0a77aefdce0df9b08d4977c5b8b8a98a42275931657a0a4b1a48f37ac2a4613129192ed0b4a6369bf22f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372249, "uuid": "8d6d9d95-8654-41d4-be00-6963cc283efb", "value": "T10F62D106CB2EE5DDE34FEA3F3F056B95F174B6C54A477708090383A60EAAA2E8515247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372249, "uuid": "fc364142-7fdd-407c-8643-c6c065caca90", "value": "384:SE2CYHm6sxwgEx5dMlZXeztEtj9Z7ZJ2/o3S104D6:aVHm6ewgSMl8YHoD0a6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769372249, "uuid": "7b932e77-0d2d-4c7a-9cee-9c47c27b965e", "value": 15698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769372249, "uuid": "f6e628b7-e635-42dc-b961-a29f460c3e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372249, "uuid": "a44f9074-ef6d-43bd-bc46-3b60cb5a2726", "value": "SecuriteInfo.com.ELF.Svirtu-AA.94726255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21fae19-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769384736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384736, "uuid": "9f7d7a82-371e-48d7-b1da-8447b971ebb0", "comment": "Malware payload", "value": "89b1421962e9c526590ab979130a9e52", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384736, "uuid": "34d706d8-bc0d-4e1f-bf80-bd11cd1629b5", "comment": "Malware payload", "value": "17518517cd66839b8ff1ee9b205c61c1cc1c800ae6bf566b941ea4fb8cafc856", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384736, "uuid": "4e3f840d-b19f-4127-843f-02fc7f5ed0f5", "comment": "Malware payload", "value": "474ea6117dd130072d31ac99234fb17cf73d02e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384736, "uuid": "e66fc1b8-1e81-4316-aaec-323077075117", "comment": "Malware payload", "value": "aaa55ae07615f746ca6a46049a20d1f2afc865ccc3aed945c01848886fd40c34ff9a45b50efb990dd59049e886756771", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384736, "uuid": "02ae6aa5-5071-4890-a619-c19a99ce9123", "value": "T1C0262218AC7891E6FDD74170BB66A511B8323E37CE282A9B01E4C7991506DDE1B3F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384736, "uuid": "bbcbc0ca-20fb-4aeb-aa0c-c3deeadb2adc", "value": "155dfc2d31fa3e5e20315bf41423c877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384736, "uuid": "0b9c0495-3269-4685-8195-bf5c0882bc79", "value": "98304:WO5KlTlDsBhX6K+GVJjS+EfZqHe8fUqH:WOIlTuBh6K+S8+oD8MqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384736, "uuid": "1bf4cfb4-b0b3-46a9-b360-294d6570e0eb", "value": 4607488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384736, "uuid": "4c6561d5-ce42-4d2f-b3ea-db716601b0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384736, "uuid": "fc4aa457-22dc-4658-9711-9612c7b6382c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd16621-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384539, "uuid": "c8835278-c982-4d4c-b483-ed4ae6f1a342", "comment": "Malware payload (Mirai)", "value": "e168f80e40da978b6ab76dc445147fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384539, "uuid": "f74ecb89-8200-4aba-a082-03db23fbf635", "comment": "Malware payload (Mirai)", "value": "188f55f363844a5d8704099229df4db5b91f03505c9cd7eda81e693dded4c5a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384539, "uuid": "d3fe4196-8dad-4bff-a416-a0f906397a30", "comment": "Malware payload (Mirai)", "value": "e2545a7e6bc3ef7ee97520f7b6aee9bb99dd37e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384539, "uuid": "196fe6d4-3d7a-448f-bab6-50d306a7de12", "comment": "Malware payload (Mirai)", "value": "a213ccfac9efcde1ed7a0d8e3c5d93ccdaf6810779abc8ed5b129664aac76411b11dbb88886347002c09c124ab747277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384539, "uuid": "f79de803-76a3-4ae1-ab24-c8881a3376bc", "value": "T106934B15ED381E27C5D0713A51E34631F5B6439926BC9A1F7EA31D9CEF14320313BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384539, "uuid": "eb3505da-32cc-4f78-bdda-ccb973b32d76", "value": "1536:KC/1Bi69712OwwyS8Epp47LXBLG0+2UXN0onh:R9j19wwU/jZenh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384539, "uuid": "4f29f2b4-b2bf-4487-87b7-f53e604818eb", "value": 91536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384539, "uuid": "5c5e45b7-70a7-4bbb-a7f8-17720e93f42e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384539, "uuid": "eabd883d-d13a-4193-b6b1-d37f2b7878c0", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc83c308-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344729, "uuid": "4860fe13-01a4-4401-998d-bdb7a6a903a2", "comment": "Malware payload (Mirai)", "value": "8482835724f15449091d5476ad876aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344729, "uuid": "aef36482-44c6-486f-b6a0-b61b92b4c436", "comment": "Malware payload (Mirai)", "value": "18b715dbe9d54e5aacaa0ff45c569ec651e9cd8f618195a104317b0dc2f54f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344729, "uuid": "c16618f9-4eb0-41da-a11d-af5a8a1f37c6", "comment": "Malware payload (Mirai)", "value": "a740abe98ed2cd77bdc47e033b395fe6b7a68fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344729, "uuid": "c3351fac-51ae-4ca2-8639-2913eb387846", "comment": "Malware payload (Mirai)", "value": "f48b72c68e63620762ff031dc7b4e5e8811e4ea5193f6326d24868fa0e9bf9ce2cd7bd72b635991837830df8d58cd845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344729, "uuid": "6577092b-0910-4f00-aecb-2e703cdd5489", "value": "T1A493E551BC82562BC5E423BAF6BE668D336577E5D2CF722BC8214B11BB8551F0C63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344729, "uuid": "e4461473-3ff2-4343-86da-895d3260af0d", "value": "1536:hFd+kOqW4H1GXzPo7tu4WCluLa69O05brauxSlj0movrYL0:l+ks4HR7/Z0aj0mAi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344729, "uuid": "6dff055b-1501-4fe9-858f-b4305a61c1cc", "value": 93796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344729, "uuid": "de6a9384-ba0d-46fd-abc5-4dd93abaca33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344729, "uuid": "edfa00d5-56e1-48cc-822e-fd21f4f5b27c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4401a14c-fa06-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769356526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356526, "uuid": "15a19270-2c06-462f-bd19-68ca3638baf9", "comment": "Malware payload", "value": "a62bf8e9fde5f9258baf516afe6d972f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356526, "uuid": "049b9353-ce1d-4776-a331-9f8b9c95479b", "comment": "Malware payload", "value": "1a3b989a9d5bed94afe270ccd5b693d17c38a0cd5a410dffd7281f8db518b38d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356526, "uuid": "06025fd7-a06c-48e2-bfd5-ca71d4b270e7", "comment": "Malware payload", "value": "0b3efb8cdc4e28efe86dd1b2d8830a2e4de9cccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356526, "uuid": "1cc45acf-e5db-4e81-8422-13d2368518c8", "comment": "Malware payload", "value": "261ea26a579c6dafdefc63d3aeb685c0173d94f73e2375feb699a44a02db713532fe9a890783df99519a92cfb299ce2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356526, "uuid": "1e7b8202-e405-4169-b5e1-5bc5d63fd1b2", "value": "T1DF6533B383C04164C3452FAF819C5B96E50BB59E28A12C5FEC11D960B57762FBA321FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356526, "uuid": "0849c3ae-d167-4d85-a94b-d0c31eee1bf9", "value": "24576:NX1GTAUogoGmMDF2762AjSNSjsUTW92JWdXZZKiO3dVFf9xUYm7Lvz1CSOG:NlGTC6va7k62JcJkn3dVZQj7Lb1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769356526, "uuid": "ca2006ef-d62c-42c3-be06-a4c8c4c8f459", "value": 1548751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769356526, "uuid": "b789562a-5712-44fe-b014-4f4aca99ca65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356526, "uuid": "2162c9e6-4fa3-4ac2-b04e-773e42bf5938", "value": "bizy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b32c0b-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354682, "uuid": "3d6a11e3-b3aa-4ca9-b1d7-5d347bae3d32", "comment": "Malware payload", "value": "2c4de5fffa8ad6f4db73e5e3ee578869", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354682, "uuid": "094d12eb-1194-40a7-a11b-a3cb2ed7da96", "comment": "Malware payload", "value": "1af946cb15852daffb30da09ae4abb4d6f5caf139a709e6447288484db7d208a", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354682, "uuid": "b9c0c6c3-2de9-467e-a9cf-a3d7d1722ea1", "comment": "Malware payload", "value": "cbd40bbb71db6429be19aaa076c1bdb1afe97a61", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354682, "uuid": "78aa6411-7b74-4adf-a517-182784e6f2fc", "comment": "Malware payload", "value": "0682b3009031840b47805c157d9dac2a06c360053a2d90e9e5c6e252ced353aaf32b710680bb4f8be9cecce35be17e54", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354682, "uuid": "ffa7f8cc-40f6-430e-bb9e-04a41c2f6385", "value": "T1FB157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354682, "uuid": "c91bec08-ec1b-4eb7-a3fd-ff25b1e8885e", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354682, "uuid": "3f363c06-f258-444f-9f34-c3c77da7324d", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6bG:d/QMnl5YL7WzZyQRdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354682, "uuid": "e9df6593-7919-4f2b-8068-27821893a75b", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354682, "uuid": "b35a3064-0b4e-4f3f-9142-1f1b159a351f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354682, "uuid": "d9a4d644-2620-4c5c-bb90-92304fb736f7", "value": "Y823223893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03574d5-f9f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348118, "uuid": "8ccc90cc-0d54-4917-9944-16c2c696b962", "comment": "Malware payload", "value": "9c8fc01ef0b479a5bda10797603ae9c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348118, "uuid": "882215c7-52d3-4088-8e58-abe98235f633", "comment": "Malware payload", "value": "1bb4c84914707127007e6922b35319f142b56fe00ece18fc0c2fcd6e5e74c76a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348118, "uuid": "a64ca622-b069-4f6b-9965-71b220457601", "comment": "Malware payload", "value": "57624dbc9894fd67ba1303e15526c64d5c43dd9f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348118, "uuid": "d2dcdd18-5de1-48e0-b5b5-d829ad56be2f", "comment": "Malware payload", "value": "4dd387961e6c5c5159d9994fb2fd999950ffe82d478a929aab3f9df80f10af1aa85b5d8a2ff2960048bb62a5eaa480d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348118, "uuid": "abc35e91-22ee-47d4-8c45-47e793cc7baf", "value": "T143165C63ACA08D64C0ABD038EEB6514576717C084B3273D72A927F661EB77C0917BB6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348118, "uuid": "8cc49636-2e68-4ce8-ab8c-7176a3b24b12", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348118, "uuid": "37d75e47-4551-4005-9539-4439f82c24f8", "value": "49152:x5cb4syAKYkg2H02/uXoqCODMnhOESfihYJAf2oW4vKN6Apoh:xiBeOpWhhTWUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348118, "uuid": "23273af7-8bd8-48fe-834c-39aa1c382ce0", "value": 4306136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348118, "uuid": "30e8bf34-7ff1-40d8-8d40-23cfcecb1834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348118, "uuid": "5f886efe-8466-4208-9cd6-0edb7361a3cd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5d8b92-f9b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769321053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769321053, "uuid": "215d06a7-b59c-495b-a8d7-75aaacdb3df6", "comment": "Malware payload", "value": "89bf9cd49103ffbb6c667a9305f30be6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769321053, "uuid": "9fc1bf30-6a3f-49a6-9a2b-b5dbeabd9da4", "comment": "Malware payload", "value": "1bbf3484e95148f86b70c1ba5ff026eb561317ff61ac0bbe0332a63beb44be45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769321053, "uuid": "fca77fb5-cb9b-4093-9abd-34a78b8bb5e5", "comment": "Malware payload", "value": "eb2de48de057a8edb777903dd26327c08acdcea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769321053, "uuid": "bb419ea3-8c13-4564-8258-fd26be84936b", "comment": "Malware payload", "value": "f4ac44f303bc03cbe80790c3e0f7095e14f0c8b145a110af6232afa92b8f96952cd2d3c9238c03168ab21a6109ce7e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769321053, "uuid": "de5782db-72cf-40b6-854a-3a5fae210dab", "value": "T1A3A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769321053, "uuid": "c0c31159-1f42-4f19-884f-be7fb407b8c9", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kp6sId:fma7JLqHxcncWZViTH6xVRFOR6sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769321053, "uuid": "d1e9bda7-5fc2-4159-b90a-2edd245bfe68", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769321053, "uuid": "3e2f8824-505d-4340-b680-51ae416ab10b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769321053, "uuid": "4d5ef753-0dc9-4ef0-a224-f7353df56b6a", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cef5c7d-fa1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769366983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366983, "uuid": "06efd96b-931a-4a49-b8db-519aa57ca558", "comment": "Malware payload", "value": "bf4e98d4c9d90f7e66b20ae1a40854a0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366983, "uuid": "4b63d74e-12b9-4a4d-ab5c-5a91577f61da", "comment": "Malware payload", "value": "1c6eaa40a4a66b4b98d57d0fec3444bbe9cb3f6a8bcbeac528e719d7e92b16b2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366983, "uuid": "8a30b24d-2962-4739-9f2d-fbac23754c5d", "comment": "Malware payload", "value": "026fa869a53cc71abd65eb107a27b86de1b656f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366983, "uuid": "ccbf9d2d-b4c2-4a7c-b1b5-27b873dc8c02", "comment": "Malware payload", "value": "7b66e04e856b64ac603f1f5fdad8b4dd8e3260eacf4caf15ed77a7d155b6c0007da8cee5816362d945b937a952688381", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366983, "uuid": "2fdfcf62-7dab-456e-b48a-26a76630c8e2", "value": "T157A533E14764A43CCD41CD3E0BBC22F799A7636A9C84751FA776713939253CBC806E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366983, "uuid": "176fc8fe-00aa-4e8e-bf16-723a2e243f16", "value": "16115189c3817c69eaca44014ebe16e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366983, "uuid": "23d0fa8b-31da-4473-88ef-22d3a0ea158e", "value": "49152:2FHnGHV9n1SdIeMYHYrpaByI8Q121A5vZ0nap1KIEWwDKg:g8X760UByIDQAoarKIKDKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769366983, "uuid": "2e48dab8-9236-4ce8-8b85-0809eca7342d", "value": 2227200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769366983, "uuid": "ac1beb58-b3cf-48f5-b013-ac0fb46e0a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366983, "uuid": "0956d499-8daa-4ff9-9f9a-ed96e378b0a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e5fbdb-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361985, "uuid": "d6bcc413-a155-4bb5-b798-505895a26a47", "comment": "Malware payload (Mirai)", "value": "e45ed05e86d5d36f4f4d4e9c5e521963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361985, "uuid": "5099c8a7-d195-481e-a391-355ef6221e31", "comment": "Malware payload (Mirai)", "value": "1ce62141acbc58f340a7528764019ca42c469b7bc4b3803ef4e2a4d5d8854f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361985, "uuid": "402db802-4e58-4269-9ce5-8cd7634c7700", "comment": "Malware payload (Mirai)", "value": "b9966a51dbc59a502dda5199304464aad54f33a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361985, "uuid": "5976e4cb-930d-4af7-a918-70a93bfe40ac", "comment": "Malware payload (Mirai)", "value": "59cf98c3933b447acdbd59b2df8642ea71820614ba84fe1e05a59109278f0926c0d051a138e523b131f9cf16064ab111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361985, "uuid": "e13d0e05-c443-4faa-b947-c2d27e38efbd", "value": "T1B5B3080AAFB11EBBD4AFDD3345A6074939AD590631B93B793A74D81CF20A18F05E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361985, "uuid": "e8302a57-d407-4ba6-bc8c-53b0acb8889e", "value": "1536:8aEQclW1uEgG35/qmolhXFq36n0UpqBYCxZbxc81uhuFO/vyF/eZfqFX39wu7r8D:8hBBhXh+/wTrgUadssPgBroQNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361985, "uuid": "e25b9ac4-2b5d-4346-83b8-5aab41b4ff10", "value": 116380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361985, "uuid": "af656195-d32c-4053-ab1d-22a1e50c9ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361985, "uuid": "ef577b78-b246-43fd-90c2-5d55f625512b", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c983679-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1769330744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330744, "uuid": "1fb99f03-08ff-4708-b902-e7bbe7dd6493", "comment": "Malware payload (Gh0stRAT)", "value": "28160dfb1c12be46f244bfee5b478f46", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330744, "uuid": "93f29450-0446-468d-89c3-a326dd0151c1", "comment": "Malware payload (Gh0stRAT)", "value": "1cf893d7d4a8773c80ad43af156336c384af2fd6fa92f6a68a84c1ae30fe296f", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330744, "uuid": "5f56a114-4a5a-4598-b00f-ede84bf04365", "comment": "Malware payload (Gh0stRAT)", "value": "4836a3182d502e3dfe0700713c0a5736abe2855a", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330744, "uuid": "7cb29c9c-8930-42f8-b779-8de9de96d8a5", "comment": "Malware payload (Gh0stRAT)", "value": "b2ac1e796c431bd05d6d3a67d83d3e68d016a1d91db328e770f2e1ad54982607dddbb0416d46331ac3cc4da4ce2bbc3d", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330744, "uuid": "e0bef825-1995-404c-ba7b-7cfa61a4e945", "value": "T182373325A6DBC536D56E0177E958FE2D0578BF73173040EBB3E8B99E84B58C29230B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330744, "uuid": "f2bda209-dc6d-44e1-8170-8f4744ab9a19", "value": "393216:NRoIp3Dv6ygHOFP6YFPfHGLhAxzLYJ3ERH02C90xIynm9LBoejnJNx62ITqlard6:NOWX3yYFPfHHHK2CqxTRWtsd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330744, "uuid": "eecb36d6-9817-4498-af90-6415908305b3", "value": 23179264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330744, "uuid": "5c029266-41af-493b-8fab-84ce95512c97", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330744, "uuid": "f4a04acd-7a55-456f-95ab-a71ae095c9b8", "value": "DeepLSetupA-7018.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9659e1b1-fa32-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769375562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375562, "uuid": "b45c9900-927b-4fc5-b1fa-09a4e3c4469b", "comment": "Malware payload (Stealc)", "value": "2877f3dcc58d4d42dc9f5220a0c910a2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375562, "uuid": "e76c60ff-ef0c-40fa-ad9a-b1b7701efc34", "comment": "Malware payload (Stealc)", "value": "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375562, "uuid": "18c7e28b-4746-47ba-a103-b044d7ffd089", "comment": "Malware payload (Stealc)", "value": "5426419fbebd92814ed2536aeee47344447733d2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375562, "uuid": "3725bb8f-d3e6-465a-8ce5-bd0f1c4e2463", "comment": "Malware payload (Stealc)", "value": "12a056bb4538734041d45475f08e62565a1d303f08e864acc7390772d7c7e8e03464b394990e5d166abdff20f20a7819", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375562, "uuid": "f022739c-56de-4818-9014-515706ec8132", "value": "T15A164A53EC93896DC4BAA239E9AE11827E703C090B7173D72A507A691E777C4013B7ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375562, "uuid": "3d40ab8d-c340-49a8-b6fc-01f579b36cb5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375562, "uuid": "b8abd547-a1bb-4025-90fa-6bce566e1480", "value": "49152:JSmoRJKk214X9mRuYRLp4wvAPdK09sj8LqzwWQ71:JJdT8qwWQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769375562, "uuid": "187ffcb3-1b65-4ff2-8459-eed517bef475", "value": 4184280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769375562, "uuid": "ceba7b81-f1ad-4530-91a8-2a1efa47bef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375562, "uuid": "fa78ca7f-25f4-473c-abef-c59d7daf23e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0320b75-f986-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301813, "uuid": "3576be8d-fcea-4801-86f1-c44da3c9011a", "comment": "Malware payload (Mirai)", "value": "6eb2645673b30a68d0163f598306cd66", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301813, "uuid": "691cb977-40ab-43ce-b4ba-149c4474f6d3", "comment": "Malware payload (Mirai)", "value": "1dacc14342923347c798bb044e1d9bdca818d81907526db670fa29687ad159d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301813, "uuid": "5e5a4501-217b-4d3a-8b24-34c3c5aa66a2", "comment": "Malware payload (Mirai)", "value": "b43fa6d6f540d7e3a9c802c5391d49b81abe6b80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301813, "uuid": "07bf9c2b-35f0-4c63-88f3-ea0ed173d6ef", "comment": "Malware payload (Mirai)", "value": "32140386adcc8dd4c0adf32c85810f66137459273caf5eb2c286e616cb07fa5d6282d9cd781fcb3c661f5035a1ffdef0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301813, "uuid": "e0bdf488-bca7-4be7-90d4-2d401e0ca1f9", "value": "T10601F7D10332EAA1F805BD1430B2744A23C77FAC22A87F4DBC7C499395499B0B901B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301813, "uuid": "29af272d-cd04-434c-a518-fe0a2e2732d5", "value": "12:BufSnGf2FhfAewofiOWNn+0cfSnvivfsfAewt8fiZt+JGy:+Vi5ABC5TWABIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301813, "uuid": "7ca6b540-5665-4426-81f7-4cae4a3cbabc", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301813, "uuid": "9cc6d80d-b9ef-435e-8a04-13264d62b84a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301813, "uuid": "78adc911-3b11-4e81-a996-feb2fdf4c923", "value": "tbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910c426e-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383284, "uuid": "db4f8611-5813-4532-89b4-23331b550c79", "comment": "Malware payload (Mirai)", "value": "525fde52a6a4e11e8609b91b287f8747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383284, "uuid": "ed867d83-bb53-40bb-9a1c-2f096c3e971e", "comment": "Malware payload (Mirai)", "value": "1db8393738f9732c74bd79fe6b05588b0e70c484015d4511b75a0a9648b29779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383284, "uuid": "df99f4a3-95c0-448f-9afa-ebc43e2afefe", "comment": "Malware payload (Mirai)", "value": "0950ff01fef81329482b095a1913519ff718bbbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383284, "uuid": "ba1aa7f0-281a-486c-98cd-aaae1c0c45ba", "comment": "Malware payload (Mirai)", "value": "66465a44ef2f8043dc6c10a1ec73fcd8b826153f7211d53101aa78893fec1b97d354baf6a38cce6bc560dbc88adcd5f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383284, "uuid": "c786b8d1-6b6b-4931-bf3f-a279ff1ff6ff", "value": "T1FAB3B64F6E529F6CF36C83354FB39B2AAA5523D633A0C185D25CD9411E6034E286FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383284, "uuid": "7fd12dda-ba28-45f5-a2d7-777df60571e7", "value": "1536:C1C1fSSvrVvriZr2O4PnJ9J4A8juQOyXR2vKDkUa58h8HXN:C8fE4VvaIeeMks8HXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383284, "uuid": "73b8ea4c-1a42-4da6-a822-099e60d481f6", "value": 109360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383284, "uuid": "6b2bd1e0-44e4-42ed-a502-779a08f14663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383284, "uuid": "3a91f7d1-f08f-4513-9582-8bca8076eb12", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550eeb01-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333362, "uuid": "b3b6a55b-8c19-477d-af42-2e7dfa10284d", "comment": "Malware payload (Mirai)", "value": "bf4add8b85b763f2f34216541389b5fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333362, "uuid": "7f09f80f-5b84-4931-b66f-494a5fb494a4", "comment": "Malware payload (Mirai)", "value": "1dd459cfe947a16429e8b4e31b48d14e386864ca8e246f9a729440f827ebe285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333362, "uuid": "a9fa45e2-d849-4466-8664-f11a5c650064", "comment": "Malware payload (Mirai)", "value": "e13831c166ba66c9e4de3abdad62ca386eabba4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333362, "uuid": "11f4d193-c49a-4aac-9ac5-34ec3754c254", "comment": "Malware payload (Mirai)", "value": "f84bb35c6e889d9d741babce8a78fef34410033e2fa65660b000b3ffb3d1fc38e82153de954df2dbc594b74cd35f0ad1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333362, "uuid": "dffe493a-63cd-4bb7-b7a0-9268c428798b", "value": "T1B4530B42B991CE12C5C622BAFA7E418D33137BB8D3DF7212DD106F9067865AB0D77A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333362, "uuid": "62feec2e-701c-4b60-be73-774f43f08770", "value": "1536:Kpnbmx+SusFD4B6znnOqz1FFwOPDIjilhSAFWZL:1USuG4BQnVzfRhSAFWZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333362, "uuid": "5fafce18-7cc9-406f-9436-ca29edf4722f", "value": 62644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333362, "uuid": "db294e74-ec13-420b-bc27-c5843e64ce06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333362, "uuid": "e16e7f9f-9f58-493d-b0b0-91cad9cd0c53", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb80a815-fa48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769385100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385100, "uuid": "dc1783dc-1233-4fa7-b0f5-537527f7ad26", "comment": "Malware payload (Mirai)", "value": "2e5fd1f0a73d393bb4cec4deabfa11ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385100, "uuid": "21835121-d849-4265-9a44-9f19f955344f", "comment": "Malware payload (Mirai)", "value": "1effa1192e900d9d26e85959604db438aa026079348f7c7b436775762510da2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385100, "uuid": "2bd08149-f495-464d-80db-eebb70611b10", "comment": "Malware payload (Mirai)", "value": "2c4b388e3ba70b44637f0c5e47f2e7d8a78d51f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385100, "uuid": "3ee11775-7532-4a8a-8432-133dd280b38f", "comment": "Malware payload (Mirai)", "value": "0010b8bfbbf9d16ea0b9f3e82cb8c16e7d39628968f793db0c46fcb1ce5e4f34948db8966fd161b0c415eb594ebf09e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385100, "uuid": "bce9e64a-7269-4ac2-bf89-c5c1326fcf8b", "value": "T1B2834A0273690447F7A74DB1282F6BF053AED5A122E0F285695FEB0F8175E321586FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385100, "uuid": "67be3747-c71c-4a34-8a2b-6147a2cecc28", "value": "1536:gfODWUmHvOJJmXzjgjBkrLYIHiv2Nm7BFOGydbdcHu6bQ3nQLRqmSUsXq:QVOJmC77BQGyjEbQ6OXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769385100, "uuid": "9af9b868-0826-4dba-aeef-25e6e826d3a9", "value": 88116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769385100, "uuid": "b0a2b9aa-cafe-48d1-a35f-74b428bac924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385100, "uuid": "9f18485b-3992-4960-8f0f-ea97e976be93", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25291f2d-fa49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769385251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385251, "uuid": "b1a7022f-e9de-4512-baed-08b4eff45cc0", "comment": "Malware payload (Mirai)", "value": "223ca337346dcc46d92e6b20f42b98ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385251, "uuid": "2ab24958-37b6-4729-aaee-d2e19b85219c", "comment": "Malware payload (Mirai)", "value": "2015fb9e9c12382a0e4cc2aacf482e3bd3ccba63c3a77e5a40288f6a1eea01fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385251, "uuid": "b2ac7ee5-c242-4eee-85f6-cc6bd381e7bc", "comment": "Malware payload (Mirai)", "value": "3948956febc6caece595772e7cd2e6f37af25863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385251, "uuid": "8a0fd726-d416-4bc3-a6b5-36571d329f76", "comment": "Malware payload (Mirai)", "value": "2b6c14ea91217a0b62f37a2694662be3d0865b2e159850cf4fcdd26a0b0f700123b2423d37b6150836b6350305198320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385251, "uuid": "c9020f3d-b006-4dcb-9b26-78683f55fb1a", "value": "T18873E50ABF604EBBD86EDD3B46AD0B4635CC959722A83B753534D428F25A18F09E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385251, "uuid": "35f100d6-19c5-4c48-87ec-c074a2374765", "value": "1536:15N/qpytT5DgveGHTkXNJCvKt5PzktZ/TYocZ0ASdRveX:155q8tVDgWGUkt20x2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769385251, "uuid": "8130fc98-f8c0-4afe-ba0e-eab49c2e3025", "value": 76828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769385251, "uuid": "6a62af9a-74d1-4126-a80d-714e1a9ab83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385251, "uuid": "b9275059-64cf-4bd1-9a76-a8fcf9da8948", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2733358b-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302361, "uuid": "36f6b214-ea9c-4ba4-80e6-3b5eb8ebbab4", "comment": "Malware payload", "value": "8ee398dc8c16098da7829cbe7f511598", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302361, "uuid": "3de81c7b-4d98-44fd-b3e0-f3f612e5d4cf", "comment": "Malware payload", "value": "21745dbdc293a6c1764729da0932431b2e24287d71da526eeeaf677de5bba8bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302361, "uuid": "e8b5188f-ae36-4a39-b582-099754d07e01", "comment": "Malware payload", "value": "cc91689dda3eee0dc0686f8eda9f832d66007ab2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302361, "uuid": "f5127e44-5333-4a0a-a173-e9ecbb039557", "comment": "Malware payload", "value": "0ce6f3c84103ebc82d6641f3edfa770e97ec25b3dab65a63669c4349ee436353dc8ba4f2b021f089089264ef496cfac2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302361, "uuid": "a1a0c009-8039-400d-b7eb-a34c3e538d37", "value": "T17B51F7F9BA70A131B20C8DFCF02AD48CBCA394BF11746A3158F69DB0C2AD558515A27E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302361, "uuid": "97647d56-e875-490c-8252-a8464d933cfd", "value": "96:0ivgRByuZ4M656LGn92YZCBAf7ZV3q4jfDi:0ivC0xZA2r8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302361, "uuid": "77bcd291-7296-463e-b54a-7d6e1842c881", "value": 3154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302361, "uuid": "f453fe40-204f-4b30-83ea-8613a60e1a3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302361, "uuid": "7391f19d-5d0b-4e96-a835-b5ba5bc11a9f", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ac1c4f-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354595, "uuid": "4b28bd2d-5d33-48a2-a0fe-66f412bd210a", "comment": "Malware payload", "value": "497eb60e4a1eb69867bcf22de75663bf", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354595, "uuid": "57a3bf85-74b0-4c14-960d-a1b313f5ed03", "comment": "Malware payload", "value": "226be5fa2852414cc9818a5ecb98bbba845ce5c7215f4d80c29f84dc23d1d53b", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354595, "uuid": "78fe6e89-8b81-485a-a720-f72f402f8590", "comment": "Malware payload", "value": "a1b7aa205a3dba44a85ca47148461c5b3eb5855a", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354595, "uuid": "d3c36e43-96f4-4219-96d4-9f88a33eb628", "comment": "Malware payload", "value": "38408cc4ddf7cf1a46041b2a3083cfc689f52ea600161902e49d53b81975050c96f54e8c4e971f96c05df4e0facf342a", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354595, "uuid": "89d3b355-506d-40b3-8012-8838aa69b61c", "value": "T1C6C080EC4D56846151C5C45EF03524104875F5F05157BC328CDDA4410E155B41092C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354595, "uuid": "f75b1035-7ef9-49bd-a992-1bf6458103b6", "value": "3:Fvsa3LWecqcdXh04hhLGOtjve5CRViEDjNVHyoQ2ofeTYUWAJ5tzMFvn:FUNZjhdGQLbAEHN4v2o2TFJ5tz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354595, "uuid": "3fd74dcb-7c85-4dbc-8b19-75a5a28b7d07", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354595, "uuid": "2d176763-4dc3-41ce-8a8f-b0eb2c1d7df9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354595, "uuid": "03d90377-486c-4b5d-9709-5995c148913a", "value": "Y501970287.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247e0eb0-fa49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769385250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385250, "uuid": "3dfcd6ac-f7f1-4648-9ce2-04910a8ba586", "comment": "Malware payload (Mirai)", "value": "13fa56b2693b0432e794617bcf4db6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385250, "uuid": "7396f85d-b088-4ccb-8778-93e924216950", "comment": "Malware payload (Mirai)", "value": "231303ee910463f6d2cd645cac877d784d89a300537ec7c985d8d3326059075b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385250, "uuid": "b30c2ea7-223a-441c-8533-4aad41974000", "comment": "Malware payload (Mirai)", "value": "6cc211d45e35317c66c02501f0ff53a9772f452e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385250, "uuid": "4ec93a7d-da6b-4784-813e-5d4ff8f3a7ae", "comment": "Malware payload (Mirai)", "value": "6512654f3fa988667529bcb00e80c174a504beed8f0806a4a6ab17ee0ce12e5c380812d5350cc26448c3c86d5b29c976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385250, "uuid": "82a1810c-1ff9-4b21-b6ac-b86b563348c6", "value": "T11B736CC19243D8F5ED490278603AF337A532DA7801B8FDF7F3685A764469AA0718774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385250, "uuid": "9a731c2c-95bc-4061-9564-0cdcb9490931", "value": "1536:VNZE/pgn9HvRR8p2CoSjWQRj62YMKWg79fAHjiEgJTy1XgkyiEgFNQvvr7:V/Gm9PRRsHZjuMHg79IHGdyZQneeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769385250, "uuid": "dc381a99-009b-481d-81cc-1499fbeb4303", "value": 79028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769385250, "uuid": "8f816782-962b-48f2-8ee7-393da7939adc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385250, "uuid": "5888e5bf-5593-4e3a-b5c1-42a01eaeed88", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d102d879-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344737, "uuid": "13daabb1-d2a2-4796-ac15-e816b01e4ea3", "comment": "Malware payload (Mirai)", "value": "c08c18232d7b3e5ce1693cdbc923c312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344737, "uuid": "c178e04f-3008-4688-ad9a-f38a4fb3e307", "comment": "Malware payload (Mirai)", "value": "239d22c2de73458f22e29788e84a4405791d7b744142568949f0e9d2f098a4cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344737, "uuid": "afb29596-a8d6-43ee-a33f-14a867db8f5b", "comment": "Malware payload (Mirai)", "value": "47f7032b89d19a6f9ee6a70d80b875bdb4f1e723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344737, "uuid": "16622cc6-3851-4f3b-9439-e7a9c90a084c", "comment": "Malware payload (Mirai)", "value": "fb13a339edf7ada4a9d2bb6fb26c162501b263749c15394faa602b14a9fb97710b48eee191dbf48e4a81218303dfc346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344737, "uuid": "0dfde574-2137-4f79-8f26-d4deaaa06c00", "value": "T1C9C33912F98584FCC0CAC1340B6FB63AA936F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344737, "uuid": "a12d775c-e176-46a7-bc41-7d390082b48c", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bh0zXzGszQgV8IattGV:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344737, "uuid": "897b932e-fe15-4b4d-9047-7978f47abfe0", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344737, "uuid": "ce2c71dd-ef14-4df6-a057-2b12c1cb2ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344737, "uuid": "e1ee2de0-8331-480d-85cc-a67d502b2055", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847657e3-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384122, "uuid": "b33a4999-62a3-46ff-bf1f-e7de394d7905", "comment": "Malware payload (Mirai)", "value": "367ab9c98d0a482a7698583ce4e4ce2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384122, "uuid": "b9e07478-d3f2-46b5-8e43-b7ef1245e221", "comment": "Malware payload (Mirai)", "value": "25267c4d47fee4fd9f58c1442fe26336afcdcf0ec6c208b1065e416aa5c1a8b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384122, "uuid": "ed413bb2-ef4c-4185-8747-c61c23ebb9ee", "comment": "Malware payload (Mirai)", "value": "a25f199c2255c40d58f51b28280e2d93c420a9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384122, "uuid": "03a57903-1d23-4bba-8939-2a454f594aac", "comment": "Malware payload (Mirai)", "value": "b87a3e8e99a418b30ff093ecfb17dd808439987218c1d9e24f1c40d1d7b9ba7a0ae400e9a33b4664e9691b33deb75c5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384122, "uuid": "2f305c18-d19f-418d-a5bc-0ab9a1fb7eb4", "value": "T130334AC9B683D4F1E91A01B4253FA7731732EA7A10B5FB57E7699832EC23601A24774C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384122, "uuid": "74cb2375-dafd-40df-bf79-f3945c50c0ef", "value": "768:ZEnm+IqKquhkJBr7u1E3B4WDxWaCX4yCm+X5awSJcmyz99kxqJ2zRmg+IOMHxO:ZEnrfJt7ME2USJc5KJcX59kxqqZ/HxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384122, "uuid": "b777c3f3-1d16-4b14-b045-54ba93f2200e", "value": 50612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384122, "uuid": "c2cf6201-c84b-4ebb-be69-d95dd02a6b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384122, "uuid": "0a7d2aa3-976e-46f3-9275-3c457251c60f", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57bac3d-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383426, "uuid": "fced6123-ac42-4591-b728-1152d7d0c349", "comment": "Malware payload (Mirai)", "value": "7c6c8751b93804692107da76599e561a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383426, "uuid": "4f5d346d-839a-4521-98bc-80c5992efc69", "comment": "Malware payload (Mirai)", "value": "257225c983ed6adab97e8a4e3fdf60057ff0d227aaf0c88801210ad9b5ee66f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383426, "uuid": "c5d6acce-c5d8-41a9-b817-bc8ba6fa0304", "comment": "Malware payload (Mirai)", "value": "9b0ef01f07283d2a2d7900a1a9cb63f270ff7fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383426, "uuid": "b80f9318-e522-4093-bf53-5397a173bff2", "comment": "Malware payload (Mirai)", "value": "09c1553931a7c5f5a8e4b5551a11a1c7143496ae022574d81deb26ad6e872546beaf4c2370b92a62fee016fbbd0528d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383426, "uuid": "b73d85e9-bf8a-4c2e-8b60-96d2c8f1a019", "value": "T160B31989BC859B11D5D525BAFE0E518D33138FB8E3FA7113DE185B2A538E85B0B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383426, "uuid": "50386f88-4d77-4ce2-8e7f-68fc869d3fbd", "value": "3072:dpSyp2EtW1myEtLfezviSlukeoQ6Qb30vgyV0ZUQz4KxX:by1icviSluLb30vgyiZUQcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383426, "uuid": "7ff1845f-275e-4e69-8e34-0019523d33de", "value": 116980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383426, "uuid": "49484223-a067-4176-97cc-7835e6aa5c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383426, "uuid": "b44b04b4-4b4b-4d18-b491-6995e34b5cab", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ff8e61-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769330110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330110, "uuid": "db04cb83-a0b8-4704-bf24-a8992f0b32aa", "comment": "Malware payload", "value": "6427e4c13912ea971603ad352dda564b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330110, "uuid": "3415ca38-2a7d-4a92-be2a-e98db400fe79", "comment": "Malware payload", "value": "26e8fd243ad34cfb5d2b0498b03eda9381579aa42c891fbfd1128f03db5f1497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330110, "uuid": "c6a44034-c5d4-4b3b-a289-686b79f28f12", "comment": "Malware payload", "value": "6a0ee38d0db496f0e9b55ece83271895a8142a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330110, "uuid": "21cb27f8-c0ec-42d2-875f-1873b15615d0", "comment": "Malware payload", "value": "6532eda920cf4eb40415d9d462044a92c62c88cde47600ba9057597dbfaadbb9c339fa949988da57ef9df2651c81a73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330110, "uuid": "611aa867-b00f-4d1e-bfe3-1c00f0dead92", "value": "T1BAF73333B3CBD03EF09D4B379676D21894F7A6519123AD5A96E4C49CCE391212E3DA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330110, "uuid": "b3d95df5-6012-4433-aab8-24b6842ed028", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330110, "uuid": "2983b071-b13b-4142-a97e-ec95b5a19a66", "value": "1572864:XCeUE69jsiR50vzvsl2XtmfWp9jiCtKi+GUlnEeCLtyq0X/uJ:X3yBRiz6Otmf8kdGUNQxN0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330110, "uuid": "9e54c104-c194-4efd-9ddc-e8822e0708a8", "value": 72588744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330110, "uuid": "758b7ac5-e498-4556-8a59-b5a8c2c0811d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330110, "uuid": "dac68798-1bc2-4319-ab37-a03a7aeb4b3c", "value": "eyy7000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bbabef-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769362732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362732, "uuid": "49e26a6a-77c0-466c-87ee-bb1c78df6947", "comment": "Malware payload", "value": "2627ed6e3e61f89a12db1f546f9dd559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362732, "uuid": "2aaa84c3-e605-40ec-ab54-b62b4024bcda", "comment": "Malware payload", "value": "288e370927fda7f9e8a48e103ff8712daa0c6e8d0350ef2c1d88285f12cbc395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362732, "uuid": "aef726e2-7279-425a-8a61-10f21c4d10cf", "comment": "Malware payload", "value": "da1738041493a9f0092dfd87c534a8a8c4b932e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362732, "uuid": "7585a57f-91f8-42d4-9b11-97b7ac69e066", "comment": "Malware payload", "value": "c350d67a887bafd5897957f81d1168e67dd394ef8774590f31e361dd469016914c71bd7c133a3d4b30e257f1c18b1780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362732, "uuid": "3b369a07-9332-4fee-85fe-115c518c52fc", "value": "T125331A45B985CB11CAC42577FF5E46AD7B1A479CE2EFB20399196F60238B82B0F3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362732, "uuid": "65346e3d-ef46-4581-adf4-39350bf448f3", "value": "768:zy6W8+GdFvNEO8jxFL41uhFm2dpxcY0JT/hWeW56a/bfj4sPIP1luX:68PdZGRVFm2dpxcY0JT5WeA/LIPuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362732, "uuid": "b37d4e84-0251-4f67-95aa-bd1e1b21c988", "value": 54664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362732, "uuid": "35756724-ce19-402c-9a28-6e3e306cdd6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362732, "uuid": "58d55a0e-3e32-475a-bc60-cad79f1d969d", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630acf85-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362162, "uuid": "461e6a8f-80ed-431d-b56a-963946b903fa", "comment": "Malware payload (Mirai)", "value": "0da3bdfd3e6c74a9ddafaa6a566ee9f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362162, "uuid": "63946acb-906c-48f3-82e3-6baf45645f8b", "comment": "Malware payload (Mirai)", "value": "2a7cd17a10860ebc4ad5d4bd705af30a153d220b6eea0498409cff17d79787d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362162, "uuid": "29467d98-78e7-4360-993e-62f07bef1a8c", "comment": "Malware payload (Mirai)", "value": "bcb30ada952cd36e9d9c060398a2aaff83fa687c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362162, "uuid": "62899ac3-436a-485e-abe0-770ef5fc6c19", "comment": "Malware payload (Mirai)", "value": "b9aa6303a39cb5d13717ac339323a5a5d7c048ed2e7d783ff0e796a8dbe0c440839b03f5d53967796423fcb83de10fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362162, "uuid": "8d5cd221-ac93-4eab-b2d1-5dc2f00a0ad3", "value": "T181145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362162, "uuid": "f15c101d-0e8b-40a4-bddc-6570eafc6aa4", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NX4UaN:HZ15BTYCrYq1QDY654", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362162, "uuid": "f7a3573a-bb15-41ed-ba58-4a529908639b", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362162, "uuid": "e9d0d91d-e89e-4df5-b2de-d7bac11b8ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362162, "uuid": "6870a6ed-6ddf-4764-920a-3b62b9434c6c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498e92e2-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769362119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362119, "uuid": "12542dd0-cbf7-458f-9b8c-80eff7a207df", "comment": "Malware payload", "value": "b4fe011b58e2842df4152d8bcb9edef0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362119, "uuid": "b01f72d2-7bf5-4ab0-9f68-26285b0329fd", "comment": "Malware payload", "value": "2ade4cf2a34c8ed4a570e6e09fab3119065a807be5c65593dca59d2e483bd11c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362119, "uuid": "a32f5b4b-e6ab-40ae-8a22-53bccda06ade", "comment": "Malware payload", "value": "38d346615a4ac5dd70f00272e9466b44d78c55c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362119, "uuid": "39cd950f-f1d1-49d8-9614-e21657a6bb73", "comment": "Malware payload", "value": "bc968cca2df97c1ad64e454a4cd010fe6b6ac7239aae76fcfe83b4f95cc0671bca9655c5e7a171255136555f29d6865c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362119, "uuid": "2f7a65fa-33cd-4e63-b125-f0c9603c4cd7", "value": "T13493288ABCC5C702C6E061B2FF1F519E371643A8E3E6B107CD19AF29674B85B0A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362119, "uuid": "faec01cd-8861-4008-b4e9-d21f30554dba", "value": "1536:EP+1hG0KbytkvJ8TidfJ4bMhACIJnqDv2/HvCCY0J25pec8ogzDK/vYX:EW14h9h83IhlIkDvG7E5pTNIK3YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362119, "uuid": "796f9fdf-c24b-41b3-8f20-6d9c34d57d88", "value": 95624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362119, "uuid": "c0de413f-6043-4bc0-b591-33a831fe2cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362119, "uuid": "d7df5249-5a8d-4a1b-ac6e-f5ee024b5865", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b06ee7-fa2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769374033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769374033, "uuid": "67ef8d88-6ad0-4c45-a761-448fee4aedca", "comment": "Malware payload (Mirai)", "value": "04a4bf4e63cf6fa95dddf048f3d559d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769374033, "uuid": "932d5106-019d-42c7-83ee-6f62552c7348", "comment": "Malware payload (Mirai)", "value": "2cb19f4151e090be3e5c774f37f90dbab1f5dc9b20d62056546a612a88bbee36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769374033, "uuid": "ce68acb0-1bc0-42a6-90b3-3bd96e4b4718", "comment": "Malware payload (Mirai)", "value": "649dae76c4a869ae84c71874887198cf431bf874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769374033, "uuid": "6806d910-142f-4d6a-9d21-e69c0ccf3371", "comment": "Malware payload (Mirai)", "value": "b2671a5e3fd8ae771d72bb7d3b214a24f06f5feb785e757b5e9aa9c247881728ae0b8d34b61a6b1111bff50e26d8d5a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769374033, "uuid": "a3e0623b-d549-4d14-b995-505860dc5f48", "value": "T12E833AA6B410DC7EF45BE7B780031A16B121A3F54E426F277627FD67DE2E1682822D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769374033, "uuid": "b11b4eb1-750a-4623-a282-3ab0de505355", "value": "1536:zv1l2oWJL0fca6NC+R4M+5IdTfFhhCkkLDFITilBr8J9CCk:z1l21YP6NKOTfLUxD2Til2tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769374033, "uuid": "98d8f5e2-e40c-4533-aa53-86fcdc46631f", "value": 87304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769374033, "uuid": "9746ecac-246d-4a37-878e-8fd6a2dd3aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769374033, "uuid": "90cd0471-df53-4100-946a-a44f4d687d17", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca61ed78-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344726, "uuid": "34e0bcba-57cd-4e93-83f8-f24389a094cf", "comment": "Malware payload (Mirai)", "value": "e00f10c178742fa74f10e3c3683e6d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344726, "uuid": "c78613ee-68d8-46aa-9e09-1e09f6446818", "comment": "Malware payload (Mirai)", "value": "2d3089c3fe4d0a894c8a526545aa53b1d1271b411be14f5c665df690d173a916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344726, "uuid": "7625145d-7570-4557-95c5-f8f534dbd514", "comment": "Malware payload (Mirai)", "value": "b353d110d20347c9436619e7c4794617484aefd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344726, "uuid": "8b540d2f-cc11-4dcc-9aa7-f5f8e7ede4cc", "comment": "Malware payload (Mirai)", "value": "78c7a1a4371718336f4fb35869a7fa740d12d8f61dc327f9ea53b14258373d9d602c97323eb07254ddca443bf1857af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344726, "uuid": "2cd34935-c7ac-4acf-a24d-3750529bbd42", "value": "T1B7E34D99F402DD7EFC0BE5BE44670E15F930A3A13143172E529BFDA3AC321961D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344726, "uuid": "63a10ae4-50c4-4327-8bc9-b7ef443092ab", "value": "3072:RmmyBVk2SJgv+okkSxUcCl10cvjvF9JrT7vyb2n:8S2SJgW/UctIvF9Fab2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344726, "uuid": "ccb58dbe-0bf7-489e-830f-bbaa1414d48b", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344726, "uuid": "8cca1708-1bfc-4549-82c2-68ed3591113b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344726, "uuid": "279c4143-d1a3-49c5-84e7-628e37bcec94", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dadee2-fa18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769364146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364146, "uuid": "09bcff6e-add3-48d0-bd65-6fc0f6aa3e12", "comment": "Malware payload (Mirai)", "value": "230dfe610de7c65bff7a49358662c79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364146, "uuid": "d6dbdb84-4f9d-4d08-8b0e-78b613c435e5", "comment": "Malware payload (Mirai)", "value": "2d680ca48b6a1071c91acfa07704b5b7f58016968115eecc651a207fbb2f53b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364146, "uuid": "7e5c6654-3e7e-4f1b-9ce1-018044018d60", "comment": "Malware payload (Mirai)", "value": "740d16304cd95ee5b86dab0ae22133493cdd8c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364146, "uuid": "1ed18574-09e3-4ec3-bb22-8e48a1404567", "comment": "Malware payload (Mirai)", "value": "e5dc93a0b03d0e1923609f37cb099bfb7eed4dc60f60f611fa9ecbd131d05caf3458de85f4365ed67e34c8d9a0538a33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364146, "uuid": "4f425626-3aaf-44de-a9db-2699fcb54604", "value": "T142333B85B895C712CAC56577FF1F419C3B1A075CE2EE72039A296F21238B82B0F3B445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364146, "uuid": "cdeda400-97b5-474e-acdb-0ac159bbbcfe", "value": "768:VIPQcf00rRRdnFuw2l2OP3BY0JG/h32eT+8UW0Uaultxx1lpv+X:V40+772l2OP3BY0JG5GeyknZpv+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364146, "uuid": "8f172ee5-13b9-44ba-8e36-4cddf6542276", "value": 54692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364146, "uuid": "eb88b0e5-cb57-478e-ba5a-64dc4c89ae62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364146, "uuid": "0b5f2107-1671-4219-ac78-7dfe42e47b58", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ec5d24-f99d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769311373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769311373, "uuid": "ed5cc436-5dfd-431c-acea-a6afb89e7f6a", "comment": "Malware payload", "value": "c241f9a0d19cb54cae6f62be58d4e12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769311373, "uuid": "2aa08875-dad5-4ce6-9479-a472a4c828ff", "comment": "Malware payload", "value": "2e2ccca36bcf1d83fb64dcb1bd4b4a85b34c6135a16ce5bf8a49f28c382a4c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769311373, "uuid": "a99a9db9-113b-45db-a48d-1830731ea262", "comment": "Malware payload", "value": "d5b522f9e68a97f0ce8efb72db1d538e5c34e1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769311373, "uuid": "b8a28487-5fb7-40d9-9c3a-3805b9b0429b", "comment": "Malware payload", "value": "f940a8cf82926f90e074b07055f5fcd4d2fc867842d14069eb91e583242436bd8eaa7171053abd954515a121f155c72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769311373, "uuid": "fc2904fd-bb13-4b3a-9a73-f8f1db133eab", "value": "T175E633C538A4BA37FDA39B301AFE5A79582DCC74B6209AC36355316E8EF56D00652333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769311373, "uuid": "68c5e132-a9d2-425f-8c5d-a2ff6ef98097", "value": "0f4742d118353293dc95de23c61419c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769311373, "uuid": "0ef395b5-4f11-4c1c-bff7-6158a697e5ab", "value": "393216:9dNLCCwIojaHWNcXUCFdbSwnRR0iT+BMDvxVCt1P8xvT:vNr3HJXLd+WR5oMDvx8jP8xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769311373, "uuid": "1d267353-bd8b-4087-971e-7e927c6b040e", "value": 15191176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769311373, "uuid": "97c815be-6a83-4f82-948b-58fce4cf7ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769311373, "uuid": "168d9a4c-447e-496c-bb27-9b395c242cbf", "value": "SecuriteInfo.com.Riskware.Qihoo360.22817.31493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52159c7f-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362133, "uuid": "97231538-9f94-474b-861d-39c1a4fef946", "comment": "Malware payload (Mirai)", "value": "f115c2cc98c04a38a48201f7ebd42d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362133, "uuid": "23666dc6-e332-48a7-98d2-62fc524534e2", "comment": "Malware payload (Mirai)", "value": "2e4f4ead4a00f26a1ade2d8da039807c693943080392a2dbb9204dffd9af8c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362133, "uuid": "b4da46c1-664a-47e4-8aae-927b04a65518", "comment": "Malware payload (Mirai)", "value": "ca690e0155fd611060187cc7b6e987d26adbd010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362133, "uuid": "79ec00d5-5480-4d47-9462-f0504727a366", "comment": "Malware payload (Mirai)", "value": "8bebaf0b616973f48896b8b92bf47f37827812ec42f5f58082748c70c438550b1a1a44372f281812e73e69439260bbfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362133, "uuid": "cf5cbf23-e376-4a62-8294-768cb08a574b", "value": "T1F0C3F185BB6369D1C1A242FDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362133, "uuid": "a491ee08-e5cb-4cfa-8256-13c63356d526", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTn5:0OCDjXG9qTWywxlxTn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362133, "uuid": "a3036262-1a64-4700-9b92-1089d66bc405", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362133, "uuid": "3ac3e7c1-e3ad-4cd0-8d81-1727f8292480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362133, "uuid": "4e4a0edc-31a4-4bf3-86f8-419a2c96f1ae", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18ec1c2-f9da-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1769337785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337785, "uuid": "da8414fe-abcb-4b4f-9cf1-38e87bb0d694", "comment": "Malware payload (MaskGramStealer)", "value": "004f1cf8091f6733fe838705f3003f78", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337785, "uuid": "ad4744d6-aef2-4215-ae7c-f4d3cb4dc027", "comment": "Malware payload (MaskGramStealer)", "value": "2eea9141841996360a27e88664110538a3a435b3e293d968526c2a3db8b2bdc5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337785, "uuid": "41c05863-9a90-4f68-adf6-72ebd682bf05", "comment": "Malware payload (MaskGramStealer)", "value": "5072446de22e3084ea9a194e4c6c0ddba1aa5c95", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337785, "uuid": "b34f2879-a345-4b02-95e5-2503d340d9ee", "comment": "Malware payload (MaskGramStealer)", "value": "df2d9332c3f8bd3d74727c8919fde83a5b78cae755f9b6415346fa518aec93d0dfd1d3476967d338322fe52cf1911908", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337785, "uuid": "57537023-3060-4cb0-b970-1dca4ecd3029", "value": "T190B5335294344334D0B678B24CCE0E47F715F2D96949125CEE7BD1BA664CDBBA887BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337785, "uuid": "bd8c660a-343b-4629-b7b3-c3fb7f422dcf", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337785, "uuid": "74ccbd20-174a-4000-b5f5-cef6509deb94", "value": "49152:YhpizbOPEa6UeXVjpxJ8sSbxhJ+xaQxbryxDbO6Rp5Gu/REiQE9WQ:qpizbOsa7eljpWxqxLxbryxDbHp5vpEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769337785, "uuid": "5aa7d3a4-55d4-439d-a768-dc64daebac76", "value": 2361344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769337785, "uuid": "03e52186-8e65-4eb4-820f-affc35ef915e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337785, "uuid": "7de6217a-4b54-4693-aa54-89c6802f7d55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc29fd67-f9f6-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1769349909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349909, "uuid": "349870c3-29de-4419-b73c-0f8e59860864", "comment": "Malware payload (CobaltStrike)", "value": "83c870bbd6cc06873ab6f77e82ec0dd1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349909, "uuid": "36b62a94-1e17-4d97-bb80-1d8a535f8ae3", "comment": "Malware payload (CobaltStrike)", "value": "3002767556c2382da98ff769bf9fdb8b60a030e2ee4016095f5726045b385628", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349909, "uuid": "70e1bb73-c609-4f8e-8e18-30caf6412893", "comment": "Malware payload (CobaltStrike)", "value": "66dcc5cbc90f55538689145a99e8e4478855d962", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349909, "uuid": "77808006-efe2-405c-9cb2-adc4c1175543", "comment": "Malware payload (CobaltStrike)", "value": "2dfe4c990840aa8146a0505624fca10e5f7fa9cb982438c03e77ade8904600740a5796211fb1c8090147cbec0defee94", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349909, "uuid": "4bd397f7-a15a-46a3-9f3b-49d935d460dc", "value": "T114D35D237691A1FCC85AC07482554A62B771B4DA1B326AFF139442383FA9EF62F3C754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349909, "uuid": "c76aeed9-a94c-4387-bc5c-28c2ee90eb09", "value": "47fde78ce463ed49022955995ad43dbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349909, "uuid": "c294a51e-28c5-4674-a640-6dc47c4083e2", "value": "3072:8Ow0hfx0UQycrMwafLVpeFKhLeqKptsNJjG/UHuFtuV:8Ow0hZ0UYwFfeFKhyqKptsNJjcUutuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769349909, "uuid": "279ecba3-213c-4df7-9232-6e1e73c48bbf", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769349909, "uuid": "fbeb1bd5-9318-4c28-a3c2-9d4bb1404716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349909, "uuid": "9c7342f3-060f-4457-ad02-3318a33e5e3b", "value": "3002767556c2382da98ff769bf9fdb8b60a030e2ee401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df351695-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331446, "uuid": "3e1e5531-cdf0-4834-9ed0-6735e31156eb", "comment": "Malware payload", "value": "58e05aa4d0845b47acd53da82654b401", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331446, "uuid": "7dd180c4-6fac-4718-bddc-282b03fd1ccd", "comment": "Malware payload", "value": "306211d186edec4026e2191095949488583a625a7df922166073a98716d12737", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331446, "uuid": "d9baaddc-f18f-4e47-bfd8-f3c813e75a48", "comment": "Malware payload", "value": "f0c8b0ca7ab8ac741f114dc585730a97da1b890b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331446, "uuid": "98559ae4-130c-4789-8cd1-a251fa8ffdbe", "comment": "Malware payload", "value": "e5b2717658828f04c22e8e607ac267dba5bba6ea8bed678fad8de5c0653711fdbd72b2a044786715c6c4c28d8471aa0d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331446, "uuid": "961d1e0f-c019-49d5-9e9b-9ced13c8f1ef", "value": "T13C07232063DFC232E15D4177D42EAE0EA539BDA7033041DBA3B5789E5E324C25A7DB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331446, "uuid": "744b5f8a-d234-4266-83bb-c9b304e7e122", "value": "393216:G12wBj5Ef/twnrJf2cJSPLkkwh+XjbYZtIh+5Cyd8k2iN:G1JjWfW9fhY4kJXjE3YgbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331446, "uuid": "ed731fb9-0fdd-46ba-aa7e-975e3e73858e", "value": 17484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331446, "uuid": "7807630b-3278-4b64-90b5-dd568e7fc1b9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331446, "uuid": "643b5507-00a5-42d7-8e43-fbb73396587d", "value": "gugellqcha.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6bc5c9-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383115, "uuid": "c6009783-e7e5-4d66-ae64-ee72858c12b2", "comment": "Malware payload (Mirai)", "value": "a25edd476ac50195932e11c8da975336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383115, "uuid": "a0fc6bd4-d1a9-4200-9ea6-d2b586d3efd1", "comment": "Malware payload (Mirai)", "value": "31fbd5a4cb53048cb780455fc0973eaa37baef2cb874c3f51298298c2be7d273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383115, "uuid": "881cab3b-b07a-4163-83a4-919be5904967", "comment": "Malware payload (Mirai)", "value": "5d4ed53ce3bdf2579f7676419de2b46de004d71d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383115, "uuid": "ce3ddd1f-5983-4e55-a7ee-52de953197a1", "comment": "Malware payload (Mirai)", "value": "24961af9383b8bd1b5672dce7292a88071ef6f4e920dc7eaa1d1731677b0fd3a6427c16997d6de689d8aa68b698ca4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383115, "uuid": "8cc5684e-e8b3-4232-bd18-aa0778bfe797", "value": "T1F6C3D40ABFB11FFBE4AFDD3705A60749299C594621A93B357674D81CF21A28F09E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383115, "uuid": "01da0ba9-c815-435a-ba6a-319d2fc1e238", "value": "3072:CtBa061yfEkFRTxUNxgUmgIcJ6rVSuRX:CtBa06YfB7T0RjJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383115, "uuid": "f1ed95d1-1e27-4712-9bda-e396fbecf011", "value": 121700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383115, "uuid": "3a95a7e2-94b5-473b-9e8f-b3e4f00f8be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383115, "uuid": "63031197-7e4a-42c8-b5ec-d1d796571bbc", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7953a2-fa3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769381107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381107, "uuid": "76e38e27-428c-40bc-8500-398cac72b088", "comment": "Malware payload (Mirai)", "value": "2f4b5fe61550cffebfcc58041a8cc883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381107, "uuid": "f0d3a084-2e59-4bcd-a16f-dfe71740428d", "comment": "Malware payload (Mirai)", "value": "32215d5ef9898986309b2c83ca8d9a40cef938953cd8e9936038e6d81be99139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381107, "uuid": "fcd1c01e-0da9-46cf-8602-b184a41440c4", "comment": "Malware payload (Mirai)", "value": "e767a187f23852045ae7530c834794e03a848b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769381107, "uuid": "b0f064d9-c66b-42bb-9f08-3ab5b99c723d", "comment": "Malware payload (Mirai)", "value": "03267468578677d8ce6a8444e341122a7bbde5689e25e7c141969c28989059fe80718d2bd7b5b9cf1c02038dafea9368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381107, "uuid": "2deea3c4-5883-4874-9446-526e0c908313", "value": "T100C3B44F6E539F7DF32C83354BB39B36A65523E223A0C285E25CD9501D6028E586FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381107, "uuid": "1520dffc-a7dd-4514-bbb9-3543796a21ba", "value": "1536:hIxSNn+3jjNjjtejtqH6EIgghCI4yO4azFrRRB6BRcAsYKQNFhKAmvxSHmEQqj+0:KAnWHLIRL4EiRBBYtKAixIAFgEXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769381107, "uuid": "d41ebc23-800f-4b1e-b230-1676d6dcddcc", "value": 118564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769381107, "uuid": "6242ddfe-dd9c-4f36-88b0-aea2a02ef9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769381107, "uuid": "4b832d57-eb0f-466c-a4c4-91e005cfe484", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519d58e3-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331209, "uuid": "98544b1b-9604-461b-9642-0e402fe91e15", "comment": "Malware payload", "value": "db30c2ebaa6c761622885b19f09019fd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331209, "uuid": "24025a51-97ee-481a-b6ed-ef0567a61698", "comment": "Malware payload", "value": "33a639f9d03eec508bdeafccd8b3555e17aa8561e7dc13227c93c0cf2a857874", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331209, "uuid": "89132fe7-e2a8-4d3f-9562-549d97d6be4f", "comment": "Malware payload", "value": "db055bf9355a61c4a6e9ef0ddd6bbb6b56edd4d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331209, "uuid": "65cc4078-741d-426a-bec2-c64f7589c24b", "comment": "Malware payload", "value": "024fa95011feb37c19e68e0b4220af50318c7aa1ea467dd9267d554f309343ead8862a1667fcff62329bc56e1216c28e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331209, "uuid": "fa15a9d1-002a-4067-ad44-f6ffd2746624", "value": "T169083321399EC132F66F15B1562DEA2AE13D7CE2077044EFA3E4F9596B304C25639B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331209, "uuid": "71b94fdd-888a-4238-a3d7-2721e31811d9", "value": "1572864:TxssIrsrOjdkhnl7yEoZbm35OUBle+zFyXIV/HVb:TqVrsrSkh53oZ65rzFyGPVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331209, "uuid": "1ca62a42-a196-4aea-858f-685cf26993fe", "value": 79867904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331209, "uuid": "3183cbde-2545-47da-9fcd-93b14fdd03d9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331209, "uuid": "f34534cd-8f13-410a-a5ab-310dcc4b9c25", "value": "XianrFiua_suan.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d84f25-fa0f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769360507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360507, "uuid": "b833d6c7-c721-42ab-8d0d-d330f547c946", "comment": "Malware payload", "value": "8222c58380d848d50904952b34568cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shadow", "colour": "#8A09D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360507, "uuid": "348de0f8-047b-49b9-bc22-c243a1c0c1ed", "comment": "Malware payload", "value": "349d21d4479dbaed53f98df40704afdb7159f4495f82c1a1c8410eebcbab061b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shadow", "colour": "#8A09D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360507, "uuid": "4f227dc2-96d6-49e0-87e2-1e497a86a105", "comment": "Malware payload", "value": "30b79ad1b358f2065276587d81086ad7b485d448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shadow", "colour": "#8A09D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360507, "uuid": "b9a8aaa1-e3ca-451d-92be-cceed9af4f1c", "comment": "Malware payload", "value": "73848140d84539924d18664919b8e029f96824ac2f370acfd49135ed656ceeb284620063c42eb141efb519b2a0e6c93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shadow", "colour": "#8A09D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360507, "uuid": "57ab706b-31e3-4318-9c94-b8dfb999faba", "value": "T1C6847E16FA6404FDE16BD178C9624906EB72BC8B0371ABCF23944BA25F176E05E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360507, "uuid": "1e188cf6-82cb-4177-b083-ac6f66078f9b", "value": "fe10067ba07b4453fb68a621f5bc1dcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360507, "uuid": "b8d52e78-cdbe-4e20-9361-29848b5249aa", "value": "6144:nSU3BgfK0U0S1GEicudvVqh5nJYF2KOEoi6:bT0GqckkfdKOEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360507, "uuid": "ca4e9a3f-389c-4bb3-81ed-6eb0e5702176", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360507, "uuid": "23095b49-b0db-4d8e-9efd-11966fc6c21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360507, "uuid": "aef6f68e-c01d-4ccf-a1b5-7d8ab52502f9", "value": "349d21d4479dbaed53f98df40704afdb7159f4495f82c1a1c8410eebcbab061b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd801c50-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304358, "uuid": "2de2bca0-17f0-4451-a61c-8890b5e86e03", "comment": "Malware payload (Mirai)", "value": "3b1b046c942f2b2d7afb6f209934f0b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304358, "uuid": "bf110786-5acc-4e22-aba5-265be6703834", "comment": "Malware payload (Mirai)", "value": "34d22d6992022fbfcf4a3674bed61559297920cc9f336578dfe14dc9d7e41ff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304358, "uuid": "50030490-a61a-455f-9312-cc10fe59548e", "comment": "Malware payload (Mirai)", "value": "88652d46a88132ede4047228c42ffb13020789da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304358, "uuid": "adb1e66c-648c-4411-aa2d-a6ed696eee04", "comment": "Malware payload (Mirai)", "value": "6fa8679f929e095089c40e83bc0ed587062567c61c953fb43b6ca0f6156319b46a4b43aee3dd0957f5b97997c2e3a7c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304358, "uuid": "7615a634-3d22-4abb-926c-34d567f71d9e", "value": "T18F535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304358, "uuid": "2f55bd89-da6c-4adb-bc29-7142cf2dd4cb", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E84:N1GjR8EVGO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304358, "uuid": "09857ecf-bd45-477f-9865-1a1c319ae43c", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304358, "uuid": "4469abbb-1f62-4173-9c53-69936bf925a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304358, "uuid": "4bc6cace-5325-4612-9783-d5fcc7ad839c", "value": "cosmic.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71db51f3-fa22-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769368629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368629, "uuid": "30268ddd-fb14-4a37-a2e0-3fb32574dfa4", "comment": "Malware payload (Mirai)", "value": "baf0a66fcbad46f82afca7e98c467449", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368629, "uuid": "38da2533-4db6-43f5-a96e-64c374e3f7b4", "comment": "Malware payload (Mirai)", "value": "360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368629, "uuid": "710f1e8c-2535-4994-b797-ad52c7c62a2b", "comment": "Malware payload (Mirai)", "value": "bcd6d4f9725a0e5af57c1283892b4474b467069f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368629, "uuid": "3121d6ed-0b04-4d4e-91ea-90e6dcd40bc1", "comment": "Malware payload (Mirai)", "value": "231e74fe5926199e6dd75534995710e87abcb32a38fdbc62ac5dd2b13cdc983ba1ba3e8776d075d68afb1ae74c8bd960", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368629, "uuid": "9950c34c-8345-471c-b8b3-8b7bcf42b5de", "value": "T109A1B36150114FF2DE0E8E16A9744F0A358857892992BE48DFFA39DBD6CFFCA3105E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368629, "uuid": "7848955e-bf7a-4f28-a353-fcfa5a430996", "value": "96:rfLklqkfm9+Ftflq38SfkfcrPfcH0zHfvAhugfz8tiMfkfcrsGf16HsifaZK5Jft:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769368629, "uuid": "0db01a08-b794-4198-8f1b-a95e46914ef2", "value": 5027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769368629, "uuid": "98a207f2-8b8a-4b4f-a19e-4a51f451ac81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368629, "uuid": "a14f8a52-fd60-4bed-91fb-56852f75fd23", "value": "tol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5fdc48-f9ed-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1769345960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769345960, "uuid": "6dd07708-9f64-43c2-82c7-1fce86804d3c", "comment": "Malware payload (SheetRAT)", "value": "2421efcaaa42e4392fb406465f39f540", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769345960, "uuid": "5b49a06f-b850-4624-838f-21d7dcef203d", "comment": "Malware payload (SheetRAT)", "value": "36475613c59d70fd45ba0452aa30ce456b39df88a50b44d49373e1394c0549f5", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769345960, "uuid": "b8a2d95b-6d42-4522-901b-b6a4772a4bc4", "comment": "Malware payload (SheetRAT)", "value": "4d7f34b0fe36841d1b579bf536d87abe70b7bb31", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769345960, "uuid": "d9d8253c-3aae-4610-a0f5-22f2770f8c3c", "comment": "Malware payload (SheetRAT)", "value": "4c27bd38bb9b6c23e2b932bb1d51187a00f3a10c2514dfd40c17e9035df08d79f2c159609c538bdd1a196663ada1ee7f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769345960, "uuid": "66885af0-27fb-4946-ab32-f5c263deab65", "value": "T1A325CF1527A9EE01D2BE57FE017805C843F4AD045E86EF1BA3A83CF2AEDE7555B1600B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769345960, "uuid": "2b500b1d-8ba0-41bf-b625-615220f4f907", "value": "24576:ptOX6eCVn8BOuU6Yjqw91zGW22U+zSUkQ:HC3U/xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769345960, "uuid": "27495086-b3c2-4ac6-8b27-3c7d56c5e62a", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769345960, "uuid": "6dd01ccf-0fcc-46e0-aa76-9c782735dae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769345960, "uuid": "90fe7927-c2cf-4520-9aa3-20ed6b3c21f9", "value": "36475613c59d70fd45ba0452aa30ce456b39df88a50b44d49373e1394c0549f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4d0d40-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769330156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330156, "uuid": "5ae37fc5-c0d7-4930-83f8-4dde671fa7f5", "comment": "Malware payload", "value": "45f075a1442eaafb618d743e7d5cdf7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330156, "uuid": "f8916680-ec8f-43d5-b995-51f12f70c6f5", "comment": "Malware payload", "value": "370aa6da4b82c531ff45d749976ae57565dc34461b6d193ee54437779246bcdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330156, "uuid": "e2ec66d8-ca57-43a3-9cfe-d367f7ddb814", "comment": "Malware payload", "value": "ac471edb9eaf489551372c301675a2a6045ce3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330156, "uuid": "d8c7e14e-a45f-4fe3-a386-c50a3c53b33d", "comment": "Malware payload", "value": "db3fb5a748fa4f62515e3130bdcb985ef3b3fb02287d7c1d90ae128cd368d98d4777360032aac72682b1a8d926830482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330156, "uuid": "33acfbe5-6a57-4eb0-83f1-8377818fec76", "value": "T1BCF73322B39BE07FE4064B3B4233B514C5FB7A216E67BE67D5E08869CE550200D3EB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330156, "uuid": "0bcbcb7e-ecfe-4156-85ea-837fb97a4049", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330156, "uuid": "cff6ab9e-3921-4093-b4aa-6b3d1fe67ba3", "value": "1572864:Q9A5NugDn7tNxj4dFABaWHmwP13/xmsZY2IEa0qJoTdTgsNidVZ:QG5NbD7tNxjgF0PHl13LZ5IEaLUTgGiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330156, "uuid": "8519fa1d-f9a0-4168-b3e5-56e51d4a03c4", "value": 75283944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330156, "uuid": "2f2e9c01-81ae-4361-93ba-ff33d66978f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330156, "uuid": "5748efdc-ac83-4f33-907b-cc0135a3b56c", "value": "MeiqiaWinLatest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e5f4db-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383289, "uuid": "25228e59-6442-41bc-a8b8-bbe5001ce94b", "comment": "Malware payload (Mirai)", "value": "4e7cf4bb54cf99eae5b135d50ff1832f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383289, "uuid": "e950a7d7-116c-4eac-ac4c-111d1bd32529", "comment": "Malware payload (Mirai)", "value": "37446bb3ba3fe51da4ab8c3e02f1130c09778496b9cd299dc73818b2b1b27c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383289, "uuid": "9311b38a-dcd5-4293-a879-df986fe65fdb", "comment": "Malware payload (Mirai)", "value": "b6fd71d25f581c7ab7a913df1110e2c8894da404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383289, "uuid": "eedb04c4-5047-4bc5-b6cc-8e88f1931639", "comment": "Malware payload (Mirai)", "value": "c4728e9f66d2eff128a405931bf269ae4cf66ccfc02c1fe1426365f4b7efeb44fdaa74104d9151d84b00381905f99aae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383289, "uuid": "56608ad9-0771-46c1-a5ef-d85dc17b2337", "value": "T1F3B3C84B6E529F6CF36C83754FB39B3AAA55239233E0C185E25CD9411E6034E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383289, "uuid": "b8b498c4-4b28-4918-b9ff-03152ee99017", "value": "1536:kBCF7Suv3Fv3cn3oIGlnVq5M/kRVjUBCy3QWTPbrTGoKCOeMXhg:kY7gGcM/0HzSjrWeMXhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383289, "uuid": "650fb0c4-e33c-426f-a1ff-2b560cfff9a8", "value": 109360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383289, "uuid": "e21778ce-016e-4478-9d75-f2b2f02d1bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383289, "uuid": "db0a6398-a3d4-4f97-9a50-0e81bb53864b", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8911cb06-fa19-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769364802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364802, "uuid": "25b57962-957d-4065-b180-f2de3a63c8e6", "comment": "Malware payload (Mirai)", "value": "a35f43f6d8c9e79662ef1d53da463348", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364802, "uuid": "c21521c0-0ab4-44eb-ba73-6e5f0499e285", "comment": "Malware payload (Mirai)", "value": "3931e46f26515d83fa1630ab3b43a414453c59abec3a804d7e223854e3d7b89d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364802, "uuid": "8683b705-d021-41fc-a4ad-14c1157f22df", "comment": "Malware payload (Mirai)", "value": "6c1d61a3bd683018d583fccb23d61bd56898750a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364802, "uuid": "2afd7ecf-968c-4880-b74b-76653b6d7372", "comment": "Malware payload (Mirai)", "value": "5b2f90084a412640b2c051b736f5cb27adf04e15630b5dea714c96e67f2b50027e104229e3be7ec7fad9ba8645c4a684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364802, "uuid": "b7f2e59d-c07f-4329-9477-5c36eaf194de", "value": "T195934A4273690447F2A74DB12C2F6BF153AED5A221A0F285694FDB0F8135A322586FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364802, "uuid": "3c890cb2-63d7-4da2-8d4a-9c09fe57568f", "value": "1536:5hH4gxqHHOwX3RfzaXkrLYIHiv2wTBnTWZGV197I7XDbG5PyDV79qzIgnXw:5AOwxmdBnTWklI725PuCXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364802, "uuid": "a0327278-f410-4670-a3be-df1dad9e5adc", "value": 95724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364802, "uuid": "7fe261e9-cbbb-4353-a469-322e15a4abb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364802, "uuid": "16010c19-413b-4aee-98f6-fe8d85f92cc2", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0045582d-f9f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348252, "uuid": "74f4ad11-a20e-40a5-b773-71df18e4935a", "comment": "Malware payload", "value": "1fb2bb665d36ba2bada6abbd7a171fd1", "object_relation": "md5", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348252, "uuid": "3d2ef372-2bdd-4e8b-9a14-e4113f5a18e3", "comment": "Malware payload", "value": "39479c292950e8c9e3a6667397875ce8cd983a9787d72a2bc84a29b281f1ca36", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348252, "uuid": "318fbbba-cc81-4437-9811-21ab2c2abb54", "comment": "Malware payload", "value": "a5a59b74502bf7b9490381fd4ea1b21ecd1a89fc", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348252, "uuid": "d3f26b8c-6127-4611-9802-acbe668c5af8", "comment": "Malware payload", "value": "14a879e780681418b5c94c1091f7c29573d534e6143f9fdfbabae18a1d5e465d92355619317646c68fb1ba2869ede10c", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348252, "uuid": "2913700d-61c4-4fc4-97f3-371629948e65", "value": "T1E567335CCAB6C8C8B43DE03D4559D1D1EDEEB1268C84A16B7160122B2ECFBFD7A0B156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348252, "uuid": "4b56a0ac-2a2f-4736-bffd-999dd4ecbf6c", "value": "786432:WvEpuINj4lHuvxRyITKgFFr3Dts6CKqTDVhjcuhj:buqjbGgFlDW6C1jdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348252, "uuid": "ec1e8396-f949-49d2-98d0-3f1c01d56613", "value": 30406927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348252, "uuid": "d35a7ad3-f938-4c1f-b250-9b1b8b3bd37d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348252, "uuid": "60ec74ab-c993-4f05-88d6-01ecbed38c0a", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65403d39-f9a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769314062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769314062, "uuid": "5f008c73-e9c2-434c-a440-38195fe9a891", "comment": "Malware payload", "value": "423e8c53c44c5fad56f8b2339d3b8e18", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769314062, "uuid": "606e9de3-1a08-4853-9518-083adba18028", "comment": "Malware payload", "value": "3a94f828f8125399ca3e2fb6b9a14c0c264b22a845fea952ec86f6a26df995a6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769314062, "uuid": "63805787-044e-4858-940e-29c4d87981aa", "comment": "Malware payload", "value": "a7d6c62485a5a5fcda92e4f39406ab813d781c8d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769314062, "uuid": "09ff72a0-41a3-423f-bd30-0662c47f29f8", "comment": "Malware payload", "value": "af1add7d13123e6c4ecb6a6b502a30ce4dd0faba4c12a6bfe78f74a371fbc30cd55afe8ac511dbda9c3f42826055957c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769314062, "uuid": "f884b6c5-36f5-4a73-ac27-a43765ae88ad", "value": "T1EC75236243ED2057F5F22B3368F6068395B274961724A3BF16C2C63A4F327D1A53936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769314062, "uuid": "7580c532-d310-4ead-83ec-20d325c4bb8e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769314062, "uuid": "e90280c5-bea0-439e-814d-c88728ae1a2a", "value": "49152:yjVJ6BkIc2WxrmxbsoOO3Rm5aQ9sIZxEa0Y7V:yjVJ6mcWgxIohY4XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769314062, "uuid": "6b82dad8-8c77-461b-b32f-e642f5da76ed", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769314062, "uuid": "5481a160-5f58-4135-91f1-87282cfa7671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769314062, "uuid": "32a60bd3-d48a-4baa-adb6-3a835273cf40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cd0736-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333363, "uuid": "24af7ccc-a49b-4720-a99d-80558a6ca955", "comment": "Malware payload (Mirai)", "value": "2f78e6517978ff0ffd33419bf3912845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333363, "uuid": "65a29094-901a-4805-b791-0d45178f20b2", "comment": "Malware payload (Mirai)", "value": "3c30abaaa5645d6e09cb07aede0d97adbb28123b9ed309170f33af63aa232fdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333363, "uuid": "55c9cfe3-5364-48f0-a850-830a14ec153c", "comment": "Malware payload (Mirai)", "value": "5852f0c6b8556b63779ecb3e70ef43381d980bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333363, "uuid": "fcae6156-d3ad-4d7e-902e-8b71b91855ee", "comment": "Malware payload (Mirai)", "value": "2b78bde7351f609499f59bd16da4c248676858db827373997058ee212c4a9ba45c77d33b7601f2e61e225a6852bc593d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333363, "uuid": "9d5ad230-68bd-42b0-b2da-bb51fe8f0b6a", "value": "T1FE639306BF610FF7E85BDC734AE91B01248CA41A25A93B75BD34E858F24B29F15E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333363, "uuid": "30b970f1-eda3-4108-9522-1835e49ab1e9", "value": "768:yRuYJpIk5I1yZQ0Qf69F2C0GtOSyYCAN15MoeseoMex3tRLQlPXirONh/L1nz:yRuQI8Imt0GsSyGN19NVMS3tNQlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333363, "uuid": "8db5fa84-5483-41cd-816c-f7899286bc22", "value": 69160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333363, "uuid": "444b6dab-699f-43ff-b6d1-3a9b28e4ed9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333363, "uuid": "cb6ef212-9be4-4fd0-858e-eff2da0070e5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea95e37-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344733, "uuid": "85239026-1164-4277-ad3c-c73b8303ce4a", "comment": "Malware payload (Mirai)", "value": "20b0df4d7ff01b8e40204d991deacaf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344733, "uuid": "9b4d82f9-6440-4c2e-8b90-c7188441e1da", "comment": "Malware payload (Mirai)", "value": "3ca32132130a999b589e3da4dfb47ddc44527b8e6ee15176bf6b9354cd62ae67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344733, "uuid": "24bf7f59-9cec-4de0-8455-c05004f02d94", "comment": "Malware payload (Mirai)", "value": "ce45535ff6ca3a4a97d2ce5b87b9948e058a0ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344733, "uuid": "7b2e5a8f-3a96-414e-a2a5-30d9f6aa06a6", "comment": "Malware payload (Mirai)", "value": "37d9050a7b158099c6136a22d9aa64895d1908b4420fc389c4a9257f4c864e17c582f545cc0cd6a2e482df6b48ecc059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344733, "uuid": "d6d751e5-30ed-4f3c-8202-d1aa12b59dd8", "value": "T156B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344733, "uuid": "732260b7-3a69-4cce-a629-cf33b3b6f66b", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wYzSr9bMFflH:Pbj4doYGFB0/45gdQ9ulH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344733, "uuid": "240af563-cffc-4def-ad35-4d291c5676c3", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344733, "uuid": "62e733fb-25f4-440a-923a-c1df08d29946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344733, "uuid": "249d0389-afb1-4c79-80d7-639f4dd4f6e1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5006ed51-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362130, "uuid": "90d0be21-9b21-451a-8098-378c39d413fe", "comment": "Malware payload (Mirai)", "value": "df0840637d98a36fe0e627e9648be908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362130, "uuid": "570ac9f3-69ac-4af0-a7a4-2ad7731631aa", "comment": "Malware payload (Mirai)", "value": "3d7c9ae2082261d04b6247d34b43eefaf95d726e0525e89fb4aa598de82fc08e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362130, "uuid": "afc21d8d-3ef6-40ae-be7b-78cd32c4a0e8", "comment": "Malware payload (Mirai)", "value": "3bbcea27f67f6cec09dbd8b1edc34e411d15a59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362130, "uuid": "56b6f653-d5ca-4443-bd95-8adc75004557", "comment": "Malware payload (Mirai)", "value": "f5e65d4a215db7e339c4abcda881e16d44e3335db47fe87541ee638eb332687582e715667d5c30f5d1607df06a1a23dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362130, "uuid": "1e7d50f3-39c9-4c74-bc98-d3c0aeb0bdda", "value": "T1D1D3B021E4005DD1EC2129F578BA96B80350EE700BDE5582EFFDF95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362130, "uuid": "4dbe27ac-8f6b-4f60-8ce9-a139bebd58fc", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xi:PiySSGp+PMmT7zMplc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362130, "uuid": "d3303b59-d40f-471f-bc5e-24ddc80e0f8d", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362130, "uuid": "a06e64f9-50b0-4da8-84e6-1211dbc76c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362130, "uuid": "3783c737-44fd-4881-84a4-c9f6216bbfa5", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d92ee-f9f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348005, "uuid": "887aad28-c1c6-44e9-a7fa-a6b9435310fd", "comment": "Malware payload", "value": "42657e2da3ac2c738f8c54e9fc530996", "object_relation": "md5", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348005, "uuid": "29e27b93-2a8e-4a0e-b86b-536d3893b250", "comment": "Malware payload", "value": "3d8d4cac07b960ebc63c1cd15c8695a41e1fd71327a247a29526c90b8a653e3f", "object_relation": "sha256", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348005, "uuid": "aca378c8-d8c5-42d5-8f7c-d0c1332dae40", "comment": "Malware payload", "value": "9c4f379b7c1f453fdb9a1527bbf8b3d829d29509", "object_relation": "sha1", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348005, "uuid": "ae376eaa-7850-4377-a651-526f13511149", "comment": "Malware payload", "value": "ffddac82c131bb263cde9880026902aa6a850cc4d19db4e32e15ce1371fa03211e97dca0eb264babf6d1a5c577597f0a", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348005, "uuid": "a1e2e0b1-73a9-46c2-a02a-3a0a00cf4d50", "value": "T15C96AE22B543606DC4D9C87193AB4BA349A1BC894F22EDC760C874BD1F753E26BBD319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348005, "uuid": "4deac013-e477-43b5-8591-6a0005698058", "value": "88e87de6c1cd25baf0c731a778bb1647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348005, "uuid": "838506ff-34af-4375-a074-b9a69545357f", "value": "98304:hZ0kO4KQYi40hOuWH+JMoXQ1YT4EzXK95+7VlgpANGuRsUCn+ovoZOXs:hDxqSvXK95+ffGkNes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348005, "uuid": "a9bad03e-6691-4440-9e96-b4bcdd4c1e54", "value": 9424224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348005, "uuid": "bb3b3011-2be8-4a34-b8eb-bb1140df32bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348005, "uuid": "13c50d01-de04-40f2-8989-afb3440b1c6a", "value": "python39.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bea12b-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383285, "uuid": "811be93e-61d5-4284-ae4e-84b6bcffc5d8", "comment": "Malware payload (Mirai)", "value": "726b3e137e1a3630d1b2a5be68b6ff50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383285, "uuid": "930be7ff-f7bb-4460-ba6a-590ddfe96734", "comment": "Malware payload (Mirai)", "value": "3e86432046e3acbcf5b9b4730912499a3e22e482a6edbecfa5efcbc43831ac4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383285, "uuid": "a7f1e65f-198d-4a0f-9772-2b3fe3e082c9", "comment": "Malware payload (Mirai)", "value": "702fc3203458429dc1e869a3123a59298f0935c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383285, "uuid": "163e631f-6cc5-43ac-9138-37cac79a4dc6", "comment": "Malware payload (Mirai)", "value": "e6f9b2c7a39a12998e0a3c7681b5b39cd9059d5bbc2e99adc73ee9eba974a0462e0c9e853bab5381943b13dcf97adea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383285, "uuid": "47e414fe-929a-4921-adb0-fc27381231c5", "value": "T19193288ABCC58712C5E061B2FB1F518E371643A8E3E6B147CD19AF29674F86B0E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383285, "uuid": "da71748b-070e-4e78-a239-5a265e507eaf", "value": "1536:wftmFGqLn2C9X3l7LLHHG4I1SMqfa92yH2+YUto5JeMiHC7xmx3rvIX:w1UG02u9LPySVa9g+65JtxGLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383285, "uuid": "d9d1bef2-5a67-4b8c-8751-e18427f84d46", "value": 91528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383285, "uuid": "79fee21f-1eee-401a-8495-d1571110620b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383285, "uuid": "67f3b98f-946a-45ed-88ba-0bfd0dfb7473", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc605f6-f990-11f0-a129-42010a9c0007", "comment": "Malware payload (FirebirdRAT)", "timestamp": 1769306053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769306053, "uuid": "74cd8b6b-e606-497e-b430-3bde2261b0b7", "comment": "Malware payload (FirebirdRAT)", "value": "63da65e817baa3ea06116da5caa26622", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "FirebirdRAT", "colour": "#111047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769306053, "uuid": "2aede394-fd2c-4731-9d88-66164dda5a98", "comment": "Malware payload (FirebirdRAT)", "value": "3f36a00de7a3e1784b8bbd6f91158417910c0203a96eb798e7801b2c442b0f69", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "FirebirdRAT", "colour": "#111047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769306053, "uuid": "35790b5c-0af9-450f-bf62-584fd3ae0eac", "comment": "Malware payload (FirebirdRAT)", "value": "2cf2edab6eb2bb9338503bf958f6db85ab24490b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "FirebirdRAT", "colour": "#111047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769306053, "uuid": "5bd351c1-45a0-4e91-b0d3-dedc31c82835", "comment": "Malware payload (FirebirdRAT)", "value": "e6bea27f2e270b1b21b4860660af3396977fca0af7e5ba3563ad59233d28f3767600c952ad6be3c28ca5874302df85a3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "FirebirdRAT", "colour": "#111047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769306053, "uuid": "dd679351-f355-4031-aa71-9aa6f04aa421", "value": "T156F54B41ABE8CE1BE1BF2775A4F201011BB1F489A732D74B1698E6792C637416D0A37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769306053, "uuid": "1ed1d676-e855-493b-b5f2-4b739f9b0a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769306053, "uuid": "328b93e2-da10-465c-a711-7a7cc318126b", "value": "49152:PGHHBF+azKPKWkQJz2MAzU0jdBdo+6uuDayPvr/NxJ:PraOPhkQmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769306053, "uuid": "62e23211-ac58-4bf0-a44e-af774561739d", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769306053, "uuid": "dc88a7a3-f789-4a75-920a-1c11162258d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769306053, "uuid": "90f5adc4-6fd4-4bf3-8916-71e94921bcc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b194ce-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769330680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330680, "uuid": "e2194bac-f4a8-488b-b961-b1f9908db513", "comment": "Malware payload (DonutLoader)", "value": "6d8ece0a340284b7438743338315c270", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330680, "uuid": "d1e15326-a691-491c-9af8-dd51cb045f1a", "comment": "Malware payload (DonutLoader)", "value": "3f68e521572f0d3fa00147691199d00f2f95888882bc084aa19356262222742e", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330680, "uuid": "49eeddc0-9172-4ece-862f-f907b87b65ee", "comment": "Malware payload (DonutLoader)", "value": "b4a2129f6f3ce4bfad54b0f9a3a89d6d1e229d54", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330680, "uuid": "4451529f-f467-47f8-93f0-8963a9e4e848", "comment": "Malware payload (DonutLoader)", "value": "ab0033e80161b45800e36d298fc71f461a65186b9fe19c3eb88177c9710fca61ebfc22c0e054ef9b7199da3ab4642686", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330680, "uuid": "6ab68507-d688-43bc-b01c-c243f7adc04d", "value": "T118671230324AC52BDA7A01B0692CDA9F546D7E760B7254C7B3CC6D6E1AB58C31732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330680, "uuid": "86737804-e075-4408-97b6-a7f1d330949c", "value": "836688c7d21e39394af41ce9a8c2d728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330680, "uuid": "e4b65678-6d50-437a-ad25-bdd173b3bdd1", "value": "786432:qxSLlr25YY2XidT7dfUWT1Mdkcwrwun/IF:WSp6aSX8WTYGrwunAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330680, "uuid": "67870700-ab36-48d8-afaa-bbd5f913ed4c", "value": 31680693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330680, "uuid": "ca6b67fb-c0c9-42f5-9889-64c03565ba55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330680, "uuid": "81ba4116-5067-411d-86ae-e2dd8cd21a4b", "value": "Chromec62-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e693b-fa49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769385384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385384, "uuid": "7af82930-8283-4083-9c76-fa452198a107", "comment": "Malware payload (Mirai)", "value": "324b20f299679cf3a3d0d97b2f63068e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385384, "uuid": "dec6b736-eddf-44bc-b614-287b3b5c2248", "comment": "Malware payload (Mirai)", "value": "40a6b12ec3aa4583c2f18735fcd6b70bcda02124fcd435c92784c58e62c416f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385384, "uuid": "180d73f8-c41d-47be-abd7-c045973f7588", "comment": "Malware payload (Mirai)", "value": "72c4a4056ad211f3b3b0b06b6a5c3a64a305f5f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385384, "uuid": "e58c4b63-aa83-4701-9d7d-1c14acc65b92", "comment": "Malware payload (Mirai)", "value": "b5707fa6ec61b430c7f0733b4fa98a7134b40e7929d9a0b2f93615b296395de5de73f30cd0d9e3a62eff5ac34d134edc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385384, "uuid": "b5033e4b-1c63-47c8-a582-df09ebad9815", "value": "T1A1C36B72E8296E58C5A5D474B0A8EFB91F5391C482475FBA1AB2C2B05443CCDF50AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385384, "uuid": "8b619ad4-c07e-41f9-b8c7-ea7e448ac56f", "value": "3072:IcRn1br2hnKQgnu8U3M5UTyWMnpWT1x+:/Rn1OnK28U35/MpW1x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769385384, "uuid": "0d95106c-0502-49b2-a7b8-bdef82510bd0", "value": 129636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769385384, "uuid": "47827e15-61b0-4aa0-b6a0-8cf71c14f8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385384, "uuid": "4a777da3-18bc-4986-b8da-49ff79d25ad9", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecd8de5-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362289, "uuid": "71a1ad36-6252-42a8-81f1-95233a740c2e", "comment": "Malware payload (Mirai)", "value": "baa5fb47a0df11a59983d449407d6064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362289, "uuid": "f0b1cb2a-9abf-4ace-8d5e-1fe9bd75b121", "comment": "Malware payload (Mirai)", "value": "40f213232ac39c7feaacddaaa73b900883e9b23b045c0bc8692bcbb5affb6891", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362289, "uuid": "c4977517-f092-4ab2-beef-7bb3a767cfad", "comment": "Malware payload (Mirai)", "value": "3d1c90b5fd6e8e102b2974e87ed6ffa0ae80e9e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362289, "uuid": "7a25e645-9b5f-4e2a-941f-cdc79c8f22bd", "comment": "Malware payload (Mirai)", "value": "0b4dd8bee29c005cfccdb68825ca3eb8166fa42a3fa88a264264715366af286ba735af839d9838fbfa00479cfe0d44be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362289, "uuid": "0a98a98e-128a-45a7-96ab-50ec54a948fe", "value": "T100336C42B30C0987E1671DF43D3B2BE0839EEAD111F4F649664FAB4A81B2D321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362289, "uuid": "771a8631-3097-475f-b50b-9ef408d37c57", "value": "1536:ZDt/TIOU6kxklEIXzF5Bgf9DqHAsrYkXR:ZDRTIt6kqTF5mwXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362289, "uuid": "8b4264bd-d1f9-4678-ac29-f69584aafc6a", "value": 54812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362289, "uuid": "ce821006-eb09-4381-950d-94d99818054d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362289, "uuid": "a0ed3c93-e52c-477a-b4bc-608d32a7d5ba", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268ab5b9-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302360, "uuid": "b04dce4c-7f31-45d5-afc1-fbc83ab06e79", "comment": "Malware payload (Mirai)", "value": "d041fc0c1ec44414918b70c42cf0e767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302360, "uuid": "fb587a25-abf0-44d9-9c74-de8b114eff4c", "comment": "Malware payload (Mirai)", "value": "410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302360, "uuid": "89f622e2-b9ef-4724-b592-befcc7d41a26", "comment": "Malware payload (Mirai)", "value": "131a88931259f858c499baa07436077999abb2fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302360, "uuid": "2ca83ea0-f426-447c-8f6a-c6d10f92be5b", "comment": "Malware payload (Mirai)", "value": "94b28602929151aac24a3fa34dbb00c31ea7fd1c7f2fd730349ef5812599c205f1828cccbc442a4586fd54f723f24a1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302360, "uuid": "debb48db-a88a-42ef-aa41-f69b89a45c00", "value": "T13A51E9F9BA30A130B60C4DFCF02AD488BC9394BF11746B351CE6EDB1C2AD558916967E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302360, "uuid": "40eedc57-e551-43a6-a218-2f2c285345a4", "value": "96:yinKoSByAm6s5O9nEfYZZI3y7cs3dpjgD+:yinpS0Kfq2ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302360, "uuid": "68eeddab-c324-4fde-b12d-0a35ae68efe5", "value": 3120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302360, "uuid": "95aff591-59ae-47e3-831e-1c3f6908a598", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302360, "uuid": "aaa51801-fd6b-4d8d-9b9b-86f568f9f514", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54274223-fa07-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769356983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356983, "uuid": "1a52084a-bd89-473f-ba09-534d3df64c67", "comment": "Malware payload", "value": "c8a0d0fc5372b7888c4d9e0636a0c8e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356983, "uuid": "1b3e0e1a-86d9-4fe0-aed0-7101242f6038", "comment": "Malware payload", "value": "4194a5ee84cdff080903120dffe8ff65169e46cf79015fc489f18e2f3f0b3aba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356983, "uuid": "c430aa16-90e7-4796-838a-77e0c1423386", "comment": "Malware payload", "value": "e5eb4500e43488dcbf07bd41ef46ca0dffc64ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769356983, "uuid": "0c8daae2-5d79-4bef-bf83-2bbe593cf0e0", "comment": "Malware payload", "value": "cd82a0219c5bd712e2279d6cda16871199a04086c76667d00deb50e851cd073ba48dc97685028f2b88b321a85bc8cdf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356983, "uuid": "58b7c4ac-59e3-4070-a894-0459a3995f80", "value": "T171262A1BA5E320FCC6DAC074476FD623BA71B89942247EBF2198AE302F56E50671DF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356983, "uuid": "ee96a086-c6a1-47e9-abcc-af5f51090996", "value": "98304:g8DPu7AJOgt5Gnuk4zX06WOESLAsNFeuLSgPETesUVLFqK4sB9sPBVrZDEtq+Ud6:OVaGFesaVBjHm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769356983, "uuid": "3f39fc06-e4fb-4e7e-a5a8-50bb6b534465", "value": 4824252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769356983, "uuid": "4a7c2210-6991-491c-a8b0-c83e8177b0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769356983, "uuid": "e33a5e7b-12f1-420f-ae31-17364b04aea9", "value": "f33.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c03e70-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354430, "uuid": "29baa7a3-3c9a-4c5e-8a9b-1b037894d7d8", "comment": "Malware payload", "value": "63a3b930aba5918f44209d3985901a48", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354430, "uuid": "9f945f23-5fbb-4856-b768-8116f4996172", "comment": "Malware payload", "value": "45902968d7f41e70de9eb380de5fda07f5ba6c90e668ca6df7f3ef44d8716617", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354430, "uuid": "5bdf6242-8809-4bc6-9f67-56eb20aca4fa", "comment": "Malware payload", "value": "ae834308e239d01c88a2a9a4786927571935df5f", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354430, "uuid": "d2ce7c54-65c1-46a4-ae3f-9e2f1e225c8e", "comment": "Malware payload", "value": "ce4ca216479221aef24c7e7fc6ce3d82f033287ccb2e03b6627fed0c9bff51f6246bdd849325c48c1443165f53756cc3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354430, "uuid": "62f9fa18-de3f-4aa7-9a44-40d0652e19d7", "value": "T1F1A62252E318502FD9BB15328DAA132542532D47C883AB43F938721C6DB76C89F5EFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354430, "uuid": "0511ff81-4afe-4bbf-b883-b403a96f8920", "value": "196608:NSuR2woaK0MABYlbpPZDyF+w8Yeo7X7E9sX+9JL5g7WiWREafBERhNhbeDdNT:NYPaK0Zulb/64YekX7n+3YWiWREpaLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354430, "uuid": "3aa04bd2-90e9-47ab-b071-1789db408392", "value": 10187704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354430, "uuid": "e8242cc3-e7c4-4b5f-875f-81cbde90b4b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354430, "uuid": "1c47ce0e-834c-44f7-b352-4f969837f157", "value": "Fresh+Cool+Cleaner_4.0.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0744b65a-f9cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331513, "uuid": "87e6ea06-2a30-4793-8876-10de0d320e4b", "comment": "Malware payload", "value": "dbfa3950da1f27998e21e1d458f0e6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331513, "uuid": "9c57e90f-9723-4b75-b8c2-3536e124ee30", "comment": "Malware payload", "value": "46e0f2a189d5601ab28a27ea0ad1ebc1c0aaba59e6227a3d8f735970e5d41d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331513, "uuid": "97723cd6-e59d-4433-90af-cc9db734f44d", "comment": "Malware payload", "value": "c9e61fa79e5f0cd27a526ce3399623cd943065f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331513, "uuid": "7b0ee08b-c72c-4c4c-aee5-5087946b2a09", "comment": "Malware payload", "value": "7523543f6e512cd06a8505df023233492757b195a9430036f52b5824454ac5e744234e1b3d1597d14d27b233e627a687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331513, "uuid": "8b8462e4-6311-46ee-a6fa-0210b1a14af6", "value": "T102183317A6E7D03DE5AA073267B1E26418FBBA7510232C37E6E1848ECF250596DBD307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331513, "uuid": "104979d2-50a2-448d-a892-86bc590f9947", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331513, "uuid": "7406570b-95b1-41e6-8a53-668ec8a28999", "value": "1572864:DUfyN583NpQvWX8o6mDiAozqsnZQ4MSx8k4pwvfvljoPwrSylcUtsH7Lr2vfADrv:DUc5So28E8n1MDSvfvBSOLmUm7Lr2vf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331513, "uuid": "7d1d5a0e-91c2-4946-924d-35df4000e1c2", "value": 91657747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331513, "uuid": "9c07dd60-6917-45c6-a762-573e7931d874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331513, "uuid": "92c8561e-a6cd-4e86-8ff4-baa173fc41ad", "value": "Cfor.Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f04fffb-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354504, "uuid": "19178178-b5e8-4ed1-aba3-88fdaee13d55", "comment": "Malware payload", "value": "c84193d37469df043667993832837dd8", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354504, "uuid": "d62ecbaa-a2bf-4e33-a235-b3f830c6c4a2", "comment": "Malware payload", "value": "471f1a9f9d4fa4640c0ae354286353ff8b834cf06f651e49f9a7813c079655a4", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354504, "uuid": "01f12fc2-4b59-431a-9b57-015b823505f1", "comment": "Malware payload", "value": "4e6b9e46024ae19494c2ac50f8798be426d02a18", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354504, "uuid": "b4ba6347-e6c9-4767-8872-aeccb359762a", "comment": "Malware payload", "value": "a8a9e632c219fe30491f7c4f321d7318068f1f0c7d4d43708bd8bee4c8cf90c3ea3aa44aff97f4ebf1c0a25afc997d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354504, "uuid": "2be656fd-0b1e-4156-beaf-476b65b1a822", "value": "T165C02BAC0550CC1110C02DD17052B8204DF0D28072C0B06004B8F0815F05A5C7CEE802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354504, "uuid": "9152ed2b-ecbc-4cc3-a87c-1bde1c4223b4", "value": "3:Mu6vsUSK7Ud5RSTFt50qYGRXkZiEDjNVHqKpAtzMFvn:96UU1rtFYWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354504, "uuid": "c93717a4-b205-46d3-a607-9a5b3e0a0c2a", "value": 139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354504, "uuid": "7ed59f2a-c40a-42c4-bc19-891df30af439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354504, "uuid": "d9035592-d987-4bd3-a186-e00b21b4eda6", "value": "Y361339431.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c04b32e-fa16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363331, "uuid": "9afb39ff-4cad-4367-b10b-825a4628bf59", "comment": "Malware payload (Mirai)", "value": "0123d04d3d9c4db6b872aa76e8d18ad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363331, "uuid": "1bf88f6e-ff2f-4b5d-8e62-e0b549545d08", "comment": "Malware payload (Mirai)", "value": "479af425ec40111a2bed6cb89b8621e89f0d26384af6290ae6d2c608c6b6ea12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363331, "uuid": "5ff7fc59-b7c1-4476-bd04-f1e4d61abfec", "comment": "Malware payload (Mirai)", "value": "bbfdf8882b0ad89010da8fac86745342ed9b2017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363331, "uuid": "4a23e913-0135-4bc2-a989-0ac9361fb2e2", "comment": "Malware payload (Mirai)", "value": "dd79ea7bb86d25c25e1e346ae7d913c295f5754acb8e932bba425ac6905183471e786108197f3b1f40aadb37aa6063b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363331, "uuid": "08b38553-8932-4d32-b7cd-52bde626a304", "value": "T1CD935C11ED791D27C5C0713A51E34A31F5B643992ABC9A4F7EA31D9CEF18310312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363331, "uuid": "d72f2231-7fed-4593-a515-dce8a5549f12", "value": "1536:SL12J2Yg0ofKvmDdLlU6sCimO+DXtAet31te/nZ0FPleOEwvYdniv:SxDcoUSLljOsB1tmGwOany", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363331, "uuid": "88ba1a93-d3b3-42a0-b115-7470603f20aa", "value": 93872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363331, "uuid": "d17c2e37-0afa-4cb8-94c8-5b9de852b74f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363331, "uuid": "ec63bb22-6c5f-43cc-9bae-bbb529c75c07", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa719780-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331358, "uuid": "55da09e2-ff7e-43a7-beab-d54b1b776e74", "comment": "Malware payload", "value": "5d480d47fd988d7563afe8b9a5384a59", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331358, "uuid": "193607c2-8133-4b97-8ac0-adc5482dba0d", "comment": "Malware payload", "value": "482f51e57f724cd6abd5d090608e47838c77f52f3e92a9051323132f5b81a319", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331358, "uuid": "db1d3b13-89cb-4387-b106-0f7fb2a75184", "comment": "Malware payload", "value": "65e8c42c65d256eb9251762ed0f0d3fdaad1a898", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331358, "uuid": "102a75a5-b20c-4df4-822e-cc30808c93e4", "comment": "Malware payload", "value": "92832f1a4a4f7580d00e782e67147318e1f1bd1ba63efbe089e8f5698eca07394cef28bfdea526f25bea506a74361cc8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331358, "uuid": "faeb3f5c-d58a-4f0d-95ed-61e17a311f06", "value": "T193083331B1777998D62FA7BFE0685F8984317CE1B31BD66B63783BA546B064350B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331358, "uuid": "20dc8457-a889-4d8e-8512-0a65ddf056b2", "value": "1572864:5CdPxPofx0hwEPuT6e2WJWq3rVCyGIM0DEFNTnN0cX:5kyfx0hwE0/zrABIMiCN75X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331358, "uuid": "a0a877a3-8554-4d81-adea-b157d6c0c7e3", "value": 79863808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331358, "uuid": "e1144ff4-fed5-4200-ae27-2737cc1198d3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331358, "uuid": "ce89b46b-a876-4e60-9d95-adb41b163d2f", "value": "Win-malqla-x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89dad0a-fa3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769379566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379566, "uuid": "bf20e323-9edf-4b9e-a7f5-4a5b05286d76", "comment": "Malware payload (Mirai)", "value": "5004f8f533b278b078d9f77148fe2ace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379566, "uuid": "58dac86d-6c7b-40d8-9704-422763a970cf", "comment": "Malware payload (Mirai)", "value": "4887adbde4cc2c7298b2f1fffbd058a66779b01a0dbc810f62686dc7ba2959a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379566, "uuid": "096f91e3-4771-499a-9335-2bb27cf460cf", "comment": "Malware payload (Mirai)", "value": "4be523f34a8f6f46c57943012fa2284fb6b35e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379566, "uuid": "f74482fd-219f-42f5-a6a8-1d37a276e613", "comment": "Malware payload (Mirai)", "value": "ef702284ef96674cce34d8b30e8d06823f694001872560a7dad282ad6a7830223f577232ba8abebf4614ee34f0f635d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379566, "uuid": "8404d680-309b-435c-b296-be3ab8c16f8d", "value": "T177634B22BEB51D2BC1C4B47A21E74631F5F6438631B88A2E7DA20E9CFF545503217A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379566, "uuid": "0ba68df3-d575-4583-8ca9-c71fc3ef63a6", "value": "1536:ZbQ0pIxDz9DIldMH15XvhWgvROZ0TaBo8fdhlnZQ:ZQlhz9DIlduJWgElaanZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769379566, "uuid": "6640ff12-f649-43e6-ab04-5f0a1574562b", "value": 67012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769379566, "uuid": "c0dd240c-9add-49b5-a3f9-18a2e5b2d759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379566, "uuid": "24be906c-c155-4b9f-8e45-ba16def7fd1d", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013295f8-fa02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354696, "uuid": "bfad8a84-db16-47aa-983c-d724dac8505c", "comment": "Malware payload", "value": "10dbe2be55315f18544fccc552273d3a", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354696, "uuid": "3babcfd8-dfde-454f-8960-80eba2027880", "comment": "Malware payload", "value": "4975bf46219543c0f8346544a60e19b7a977c4dcc713b035819aac7c6910ed78", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354696, "uuid": "c211fd99-5179-4591-b103-f9ff1fc2c31c", "comment": "Malware payload", "value": "b9717a59d4a295224890bd2dc5d34914db401606", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354696, "uuid": "ac1399f1-a062-448d-8d60-07311cd67544", "comment": "Malware payload", "value": "58250f49dc623246324256c39b06215d8534a945f6287ccfbadfbc9d50b80f129a59e89e4b2167dc095304e028d89e95", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354696, "uuid": "079ed810-654d-478a-bcd3-5bd759b2252d", "value": "T1E9157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354696, "uuid": "1012fef9-de56-4f6b-a21e-eb1e277d75c4", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354696, "uuid": "c2ac3c71-5858-4813-89a7-90528efa2977", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd68G:d/QMnl5YL7WzZyQRdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354696, "uuid": "135c698b-bc44-4555-8a18-45558190826d", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354696, "uuid": "926e6c49-19e3-458c-81a9-d034e44e744f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354696, "uuid": "47dea8b5-7613-4a73-adb0-09401151d21c", "value": "Y869238197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016370cb-f9f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769350401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769350401, "uuid": "57e50088-594b-4e39-9f58-892b7f5bf4c2", "comment": "Malware payload", "value": "903475552ea7497b38c95892c4c49f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769350401, "uuid": "5a686c3e-2268-4729-8b02-76bff7b75002", "comment": "Malware payload", "value": "49b8559b056e1370329c8733c396f0cdf7811a2647a124387d9a147235b637ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769350401, "uuid": "5c1f22e3-cc03-4991-93e8-2fac57a98b9d", "comment": "Malware payload", "value": "8965f2ee2f4db1334e358738efaf8d58ff9bbbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769350401, "uuid": "b5895374-51e5-4ec6-b080-58768dd41622", "comment": "Malware payload", "value": "fa4da14f9f14fefec79c7d395fcc3d6f0e8951409d564d5101ef337633672d7c986b4c00875aa5c2f2c4a3042ea457cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769350401, "uuid": "f04e73d0-0a9f-4651-970b-13834c1a8b38", "value": "T1FA664A03FC9555A6C0ADE1358972B15BBE717C485B3523D72B90FB282FB2BC0AA78750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769350401, "uuid": "31d1d0d5-60a3-4a17-a2aa-01860afc7b0e", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769350401, "uuid": "04e4a84c-2cee-41b3-8cac-b993fbe3b09e", "value": "49152:dNgXEfXs/wmOuKAy9fqROjgSvfF13gq3G6sEtkahTazbh8i4O/EH5EGxtwdDDsQN:dmv8fL3TG6Dt3U3b4HEOtK1s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769350401, "uuid": "97ea5abe-f0e5-428d-8458-f25542f67017", "value": 6564864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769350401, "uuid": "e6aac4d1-273c-40f4-b06d-ae6afa80b12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769350401, "uuid": "d8c1e24a-8aaa-4774-9f19-ca8bc4816395", "value": "49b8559b056e1370329c8733c396f0cdf7811a2647a124387d9a147235b637ee.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ea8d1a-f9fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769351399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769351399, "uuid": "3432b56c-95c0-4233-81ef-c55826852ad2", "comment": "Malware payload", "value": "9d11eb411ea2dd7243ef302214db8d67", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769351399, "uuid": "5c480577-9fc1-4ee1-9a0c-a87160f41881", "comment": "Malware payload", "value": "4a58cddf58435367ded0958fe806f3ad68efee97a2a4c152e3b9c081f5993ce5", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769351399, "uuid": "64f62597-d8e5-4170-bc9f-64d68a160933", "comment": "Malware payload", "value": "736d2580347d3f580554dc6f89d03ce32dee0b35", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769351399, "uuid": "fd6a3ecc-3d6e-42da-8e9a-0d3da0c22e0c", "comment": "Malware payload", "value": "77a3f434976c7d52770fbc7ed7c03a9f9fd4c9d1c48ef25751119af173e3e47a025187ce53f8bde52a13407367baab29", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769351399, "uuid": "bc3d1c2c-0a03-414a-a124-2e7537f8559b", "value": "T12755236E8BF9647AC0A25375A8F78107A9F17CA0472447DF215DF9B98F322C4B872742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769351399, "uuid": "d22ffb4d-b134-4262-9fab-431c2d386a4f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769351399, "uuid": "6a3540e3-e4b1-4297-90d8-f660361a4ad8", "value": "24576:P0vXzbq/QHvpaByRy4Hc+Op/9gWwXpBWQgNwGKbVpKDXoMx5:4XaoR039gfBWQO3KuMMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769351399, "uuid": "e29219f8-f80e-4f36-8765-953331a24356", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769351399, "uuid": "ae593296-7dbd-4ea8-8011-876eb6effa7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769351399, "uuid": "d2004482-f01d-44d1-b46d-0bb31ddfc57a", "value": "dondino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ad9872-f9f0-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1769347244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347244, "uuid": "7c30a4a3-3b87-440f-a356-7087a01c716f", "comment": "Malware payload (LummaStealer)", "value": "ba3aac817e5c1c85ad0ed29d3fd9671c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347244, "uuid": "485b39b9-73af-4fe8-8038-94d09399176b", "comment": "Malware payload (LummaStealer)", "value": "4ab70ba34fe8dc048a4878e841831ae8ca4de1b97abe5fa605eff38c00b0b1db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347244, "uuid": "d6bd80be-8b28-439c-9a2b-671d047938a6", "comment": "Malware payload (LummaStealer)", "value": "aa824b5eda14b5271863ee5c4ede73b17ea910b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347244, "uuid": "a4b92c38-5aaf-446b-bba8-edf9a6fc6943", "comment": "Malware payload (LummaStealer)", "value": "482d7e353c63eb5c653cd89dc66c8adb7f16b3d63866963703e1de0cf5679576da29fcf063145305c1a166fdd2acc2b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347244, "uuid": "c8f7356a-05a0-46c2-bbd7-3c2afa32ade7", "value": "T1F3064B13ADD48DA8C4ABE138DA76518376303C494B3173E72A623F251EB3BD5517EB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347244, "uuid": "cd2b8aa5-1d2a-4e9e-9dcd-1a989c113d42", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347244, "uuid": "b38c66e6-6249-47a9-abc8-22e831ec8da7", "value": "49152:tPzijcDK/JiEVoHHwBhWDQ8+F+fXwO2oJjCO/07P:tzDFlYtoJjC9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769347244, "uuid": "e5f23eea-3f5c-4f67-b063-d42043e163cc", "value": 3748056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769347244, "uuid": "7f2608b8-df34-4d27-a6c5-669d39bc9164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347244, "uuid": "b47a71df-a256-4e2e-b632-b8180c9f80a4", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d28988-fa0f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769360628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360628, "uuid": "d6bba7c3-77a7-4233-9f88-f587f7c69a4d", "comment": "Malware payload (Mirai)", "value": "a21e98726ff5a66246d415d73cdacf83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360628, "uuid": "b431987d-e1cb-4e0a-bd4f-d953e38fc3e7", "comment": "Malware payload (Mirai)", "value": "4ae6607472fad075c5c06c322b873c9255c512569ca40477b2925b864df9d34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360628, "uuid": "662df290-606a-4374-b5bf-caed4c0f8366", "comment": "Malware payload (Mirai)", "value": "d66955062469bb51b8e20904025f28d44724b584", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360628, "uuid": "99cc27af-9ff3-49a4-9e54-14b52fd4c140", "comment": "Malware payload (Mirai)", "value": "8cdb96e1530e9bf45c6e17caed99e332cb66048ed7f3b6032c292e3c94d69c8eccc3fded9a4113eefba632dfff727cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360628, "uuid": "34263e1d-24d4-44b1-9dfe-a6b03b096603", "value": "T119146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360628, "uuid": "eb238d3e-6beb-4d49-9163-0ea3a67ff866", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtI:BZAyFzQSdS7Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360628, "uuid": "19cea84b-dd8e-4e16-9ac7-fdbac4ba6ed0", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360628, "uuid": "f6286e1c-2583-4a9b-9773-7ae620563e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360628, "uuid": "c39337f5-0621-4d81-bf9a-0dea178fe3b1", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949b5835-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383290, "uuid": "8a090021-9e86-40c5-a7d1-89f42fcd69a7", "comment": "Malware payload (Mirai)", "value": "263bc410ad018c70601e1070db044b4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383290, "uuid": "757a1ab5-cfe0-4791-8ae9-a932c75afcef", "comment": "Malware payload (Mirai)", "value": "4b17cba8cefc6e8cc79416d5ad03bbcb678f08c1a555a1e7659b754a1a04193c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383290, "uuid": "1bede78a-3004-400c-ac29-73aa1fa3a3ac", "comment": "Malware payload (Mirai)", "value": "cc9d9c381051cf1ed35444911ae34db2de7b6fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383290, "uuid": "eaaff398-3bd7-43a4-a16d-26969a7f0e0c", "comment": "Malware payload (Mirai)", "value": "4eb1be3c3b14ceaf425d8da6637ea75b6ed95c55991e160616fab5b5a1cbd51d25544e9a8969447e0ef9a10baa7aa712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383290, "uuid": "98a84679-3365-40e8-abcf-2bad4ef6a577", "value": "T13B934A4273690487F2A70DF12C2F6BF153AED5A221E0B285694FDB0F8175A312586FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383290, "uuid": "aa411f34-c34c-4118-ac01-ad734e3201ff", "value": "1536:EVjVctHMOmCt/OdnbkrLYIHiv2I1zx9EGgvUxu1XJuKOzYU58+0MmyvqnQ7Z7X4:YHOmqsnPzx9Txu1XJI58+5p7X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383290, "uuid": "735c7cbd-7a6b-4bd9-8b37-c8a8dd050066", "value": 95724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383290, "uuid": "4d0b2cee-2ae3-410f-a6aa-1e81b16b9695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383290, "uuid": "d2c051b2-6e0e-4d01-b7d8-a7c255eb3e46", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee7201f-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304361, "uuid": "e478b18c-6d63-4b86-aa1b-0efb7e50472b", "comment": "Malware payload (Mirai)", "value": "935159faf345be963a68a9a2a732357c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304361, "uuid": "38ea80c6-43d3-4391-a2d6-9afbf2bf8f06", "comment": "Malware payload (Mirai)", "value": "4c55943b7d11335547cc20c16ef43839d09b473fbe968fed3222990307847c9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304361, "uuid": "20fcf0a1-e027-4ffe-adc1-b269c5cf1d9f", "comment": "Malware payload (Mirai)", "value": "79fa3c520fa5a51558583d7cf5dbbac1263facb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304361, "uuid": "e00fd26a-abce-4ebd-81bc-8fedcfaad8b7", "comment": "Malware payload (Mirai)", "value": "1a5f41a7b626c2e5e95647b58acbf182fc8bf5efa097e18c2148d5fc95422b408353f3c5cf6a55f50127354e8a131053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304361, "uuid": "c4325fbe-e804-4e88-91ec-d7ba2636054f", "value": "T1BC539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304361, "uuid": "c7fc382b-97dd-4cb6-9e0d-39d672876295", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304361, "uuid": "aff1b237-b57e-4c37-b32d-ae837c0703e9", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304361, "uuid": "1bfee6cc-8cf0-46b1-8f12-958c7825425c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304361, "uuid": "cacf7dd6-303b-46ad-83f9-5fc8b3ff5e81", "value": "cosmic.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a76bb4b-f98a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769303279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303279, "uuid": "8a4a4617-4b96-4e4b-a4e7-5dd6744975d8", "comment": "Malware payload", "value": "8a439eb49be66631c6bd07d889805a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303279, "uuid": "9e28ae57-aec0-46fb-8d77-4265be8a5c18", "comment": "Malware payload", "value": "4c6aee33c54de0f3d81bc3ff3088450ae41b9aa83394bed4a67d09a89d0d8b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303279, "uuid": "66ed2200-de6d-4edc-a3e2-2e326416e03b", "comment": "Malware payload", "value": "1340a84d2e935d96b4300cdd5f219b067ea41899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303279, "uuid": "47cde344-0f9f-422f-874e-1dddd71f723b", "comment": "Malware payload", "value": "739350d9622a5e05f81e78165ecd5576ae5eacb40d3b7b3d7ef1bc9f5969f895d4873f91151c168d4c53a7b56926fb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303279, "uuid": "7d67f067-e12a-4dd7-897c-55c3f01af9c0", "value": "T105C733A759F25928FFC60870D554217CCAFB740A2E63E03EC61D860265333C6B9B6DAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303279, "uuid": "245b6b65-3833-48c0-9d02-df5238aa69f4", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303279, "uuid": "ef5b060f-c101-4f1f-af7a-aea7b9c7498f", "value": "786432:XSjFQAVRtt3W8tkaLrSsvBF1QNUw4oGVblrbqfnY0iC7aCBHZLKAxgT1Br+7aGjz:X+QA/Tv/bpF1FaQgYaWCDxY19JlQtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769303279, "uuid": "16c132a3-72f6-4b77-8338-aa057bdcc5d6", "value": 57537030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769303279, "uuid": "54522f25-5293-4f71-9f99-62a7aa46f28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303279, "uuid": "3a51356b-2407-4c9f-be69-91384cfa8415", "value": "PotatoChat87a-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6225b725-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362590, "uuid": "8fdb9562-e7ef-419c-8579-eb4341d63faf", "comment": "Malware payload (Mirai)", "value": "de5c7fc25ae682d43be8ab58d2518e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362590, "uuid": "ab98498b-5c11-4a9b-abd1-5939670afea4", "comment": "Malware payload (Mirai)", "value": "4ce83f32f26d1ad3087797b8004e5c45039596d17848c20191999b5212bcc7b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362590, "uuid": "4da8155a-1514-4b27-9a5a-8f987eed7da7", "comment": "Malware payload (Mirai)", "value": "2f75391150bc04cd0601fd96bf07eecff319399d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362590, "uuid": "21a40c57-e1be-4314-9d5b-5609f43e74e6", "comment": "Malware payload (Mirai)", "value": "2a3aa05dd6ea7fc58a45c3da2b90aa051f7e867e4a74b9b25b36874a91ad48bcea43b1dde239c77eff611c6fac0363fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362590, "uuid": "c688bee4-8a61-4dcf-8b43-597d55fd344d", "value": "T16AB31999BC819B10D5D635BAFE0E518933138F78E3FA7113DE189B2A538E85B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362590, "uuid": "ef82f76e-f774-4f31-a8a6-985e4c3cf5ac", "value": "3072:VPIJKG6tiDmoEzofDZYnwoeBjne85ogtdOgCPQh/lytX:mdDOQZewje85ogtdbCPQBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362590, "uuid": "70c63b87-c0fe-4c5f-ae46-eec84616134b", "value": 112160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362590, "uuid": "cf1698e0-c992-4dc1-9c36-2b2e00818813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362590, "uuid": "c8677129-7923-4e94-9f1c-409b6b9b420b", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6cffba-f9f0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769347308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347308, "uuid": "e1991d70-0b2a-44d6-bbb2-ca80f490c738", "comment": "Malware payload", "value": "fa1b80fc45f273b607a5b1202d66ff2d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347308, "uuid": "ea0aa56b-713a-4b34-9421-fa26d244f8bb", "comment": "Malware payload", "value": "4ec12a8139c5996df385817bfc42b438ae44879fc37287d56eeb2abe12c54cee", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347308, "uuid": "392a7dc1-3728-4b1d-bc60-d896d4d54477", "comment": "Malware payload", "value": "8dc42e6c42829576e3cd51b2fc9d262749344c69", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347308, "uuid": "38adcfac-0e0a-4a46-9534-9c499234c21b", "comment": "Malware payload", "value": "4d9b1a053530d1eabc4d2a1282fe84d3bbd9ec7aee0cc20d6501d680445c1746c2c75d685a086786aef9566a45e7e3fb", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347308, "uuid": "7acb7dbd-f248-4e6a-8d86-8c0dc956e3a8", "value": "T1C9E633B50E5A1526EC8B03B16AB1F13547425EDAD4B0821FB18EA44FBB5EF3FAD406D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347308, "uuid": "f9756b2b-6397-4ffa-9a70-9b6f1f862fbc", "value": "393216:CgoJQMYFp0UQxMXkVuwqZfR6Zk9TtunwyCduE:/s+n90MXuFaRLTtusEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769347308, "uuid": "359fbadd-b1eb-4424-b5d1-2324ebe09608", "value": 15075328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769347308, "uuid": "83275690-a328-4add-98d9-4bf8b2d137f0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347308, "uuid": "28c6b1ab-e715-4e58-b123-a828159a1cfe", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927cb564-fa1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769366966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366966, "uuid": "692d916e-3e64-45d5-9095-e73c083cd1a6", "comment": "Malware payload (Mirai)", "value": "454c3fb6862221d8f5f23f6c47b11171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366966, "uuid": "0e8464fb-5b1b-4204-85d9-7bd93bbf5349", "comment": "Malware payload (Mirai)", "value": "50357a77bc179d2df0d7f1acd8e65d605586d941f1233a5179ca7a95f75b7e8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366966, "uuid": "fda7ea30-1afd-4e02-ac41-3120e2022dce", "comment": "Malware payload (Mirai)", "value": "4a26e71c1911150f1b1ae97c17bc38d587a21d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366966, "uuid": "c6eac390-68a1-464b-8653-e38bf240f3a5", "comment": "Malware payload (Mirai)", "value": "37abd47134cddf0ac007c8021cc9845c34c7865a87d2ce34d8ee754864010ed8cb2b65400998596bf7ba8228454566be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366966, "uuid": "d0d51051-b70d-402d-b7c1-b2f21339ef13", "value": "T176D3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366966, "uuid": "d9b07cf7-6d98-4e77-a866-85fdabdafee4", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xH:PiySSGp+PMmT7zMpld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769366966, "uuid": "9c37fd25-ad13-408a-af26-fe1e68d95406", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769366966, "uuid": "96dac2c9-a84b-468b-868a-9c68f4d94abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366966, "uuid": "e888a4f9-c423-43ab-936d-dbb49864a65e", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdaadd25-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384755, "uuid": "8b3d95a1-5b1d-4da0-8c98-06698d6cfce0", "comment": "Malware payload (Mirai)", "value": "cc2c7847ff4f10ea7e1fb943c92e94cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384755, "uuid": "9694df32-3977-478c-89d8-bd3ab203ce7f", "comment": "Malware payload (Mirai)", "value": "51f85bb0cab812860161ffcfcfd36b3bd3e7d01fe1de8785f49c7378edfc98de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384755, "uuid": "5c5d8542-3afa-4ecb-bc84-8318d3d6da75", "comment": "Malware payload (Mirai)", "value": "e0997f9d060257b9eada671e4ffecee07d82d313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384755, "uuid": "a11cbecb-e4d5-444a-8e57-b54bc5a284ef", "comment": "Malware payload (Mirai)", "value": "3afdf6b1afc876884f4f37e73083b51dce787a2e917f4fdc155a867ae12d6d631d0d0e736a3078c4b8ce980ddadea446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384755, "uuid": "e1325aba-198d-49a5-b19f-fde56a5c5996", "value": "T134330990FC815A27C1D11379F5AEBA8E3B2073E4D2CA7227CD604B207AD55DB1CA6F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384755, "uuid": "db9d222c-6b41-48d2-9a04-fe8875874d87", "value": "768:V759ePJmypGX/SBw+eIUi0H/+XzGaf99ikRzBSwy2kT8h6wHUGyVIDKoKEuMqTRn:VFEmEBTeIf0H0zGafWkRdSHoso6j2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384755, "uuid": "c3c604ad-722f-4bf8-b418-6f8be4353f08", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384755, "uuid": "fccb8ab8-775d-43d0-9132-f003916531ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384755, "uuid": "39112c76-47ee-43fe-8850-6bc2942884b0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8984d9b6-f9cd-11f0-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1769332161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332161, "uuid": "ac028e1e-846c-46e6-8071-3cd763b2734c", "comment": "Malware payload (AmosStealer)", "value": "e5a4c63761b9b402b8dfa0cfd9b68a71", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332161, "uuid": "7b36ed17-9f93-47fc-8f7b-afa70ccfef9d", "comment": "Malware payload (AmosStealer)", "value": "545dd5cba264bf242bc837330ca34247e202f7ac25f03eec63bf5842357519f1", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332161, "uuid": "c7bb6f68-49ec-4d53-a1c8-e6269be9fca0", "comment": "Malware payload (AmosStealer)", "value": "012f52bb2dfd4751c47781a6c846dd0b7e4a53aa", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332161, "uuid": "fa092f0b-1b20-4545-98d2-1f0998274ffe", "comment": "Malware payload (AmosStealer)", "value": "afe52c097aed8bc916aa8c354896675de6185ba17a54080bfba21c54f0847a716eb3e832265226f1fae7d2578485b718", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332161, "uuid": "3fdf2e0a-ef67-4656-8c35-0b9186d22f26", "value": "T1FC84AE0B9F2C5D1AD4C0D07C978E9A639222F1781722A33F3F50465DBE58AE47A1DB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332161, "uuid": "76da1bc4-97bc-4f50-8f55-39b2f7c62a55", "value": "6144:ar1PJZNODiR8Cl6X64fH0OfKD9XxRb2Hv7oeYPMXNxgm:ahxH3R8Cl6X64fH7CDFnb2P08Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769332161, "uuid": "5483b29a-7675-40e3-97ff-7f16fcdaf546", "value": 370944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769332161, "uuid": "cb2f6450-5d9e-49a7-8c2a-7bc420a26f9c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332161, "uuid": "512972f1-543c-423d-a585-4c93bf37ae79", "value": "545dd5cba264bf242bc837330ca34247e202f7ac25f03eec63bf5842357519f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7c5b29-fa0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769359897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359897, "uuid": "74657094-8207-4e98-82a5-c7f4860ba031", "comment": "Malware payload (Mirai)", "value": "0b895122b45a1fd8f234104e4ae4f313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359897, "uuid": "1742cad8-9b67-476c-9d98-c037567235db", "comment": "Malware payload (Mirai)", "value": "574835b8f9f6027a5f2a29fdfd91d2918a99376b6b4df4c380d0132543fc1d22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359897, "uuid": "e43ca18d-ca51-4ec7-ae75-f3a2d9905f32", "comment": "Malware payload (Mirai)", "value": "3a06d2b15833b6444c6ab5b6960d83ba9cfc29a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359897, "uuid": "c6596986-93f8-4b20-9b8a-edbdb8140919", "comment": "Malware payload (Mirai)", "value": "fe6ffa49e6d5d90fd94490c57c34e9a44cb9d6b415423b8f3ce937ca63b57083c55d992d2b18c76f4fc1ab8ef72b30eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359897, "uuid": "86c7ddb9-e5c5-44be-98ae-53ec344451a5", "value": "T1E8F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359897, "uuid": "94303f2a-d544-45fb-9cc5-365ea25c2ff7", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH4fam:9FJMgWPZr8IaCWReS1WpPeJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769359897, "uuid": "6eed8e99-7a82-4342-9739-9990f6cd5241", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769359897, "uuid": "ae3b5808-bd11-45f6-8a51-24acefbb5b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359897, "uuid": "6812a966-3c87-4b7e-908c-0a2a15636945", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d184fcca-f9cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769333141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333141, "uuid": "d84dfd29-1785-44ce-960a-c029fb88d7a8", "comment": "Malware payload", "value": "ad39078f42196ff355f7025964b27326", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333141, "uuid": "6ae3a1e6-315e-4e5b-875f-cb2c01fea76f", "comment": "Malware payload", "value": "5803b10eb18e37f87070f975dfd4a3f2d4772422a1d5fc96f8ce69fc488202b5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333141, "uuid": "4b793479-9539-454b-af0f-6501fbc300ec", "comment": "Malware payload", "value": "3eceb178c0daa78ee3209009b9fb3c4afae8dd14", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333141, "uuid": "387bfe37-56ff-4ed8-8433-cf92904ee557", "comment": "Malware payload", "value": "3c62c194944ccc6f213d3aa544cb6c2f5201c582f3ec45259c5b1595f9b5ab5ec75ac09f477f236fb89739604d4575a4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333141, "uuid": "66d34396-25b6-473e-83ef-7d0472f65b8b", "value": "T142E2072AC908AFF0CB2F62B6AD97295541604329A674390DB5CE95DC2F34360CFD52EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333141, "uuid": "552d2da4-63d4-48fa-818c-89b8013bf557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333141, "uuid": "af86ea8a-c329-48c5-97d5-47f7b1c6019f", "value": "768:v8q76fwJzsiKPY3tfTt3dc8KGk39DqTfeHIilKR91:0VfwJJKetfJ3dc8KHDvPgR91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333141, "uuid": "114986dc-a1e5-4beb-adbe-75c1754f0575", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333141, "uuid": "82957cf9-7137-4b56-ab84-fc58a5f22930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333141, "uuid": "16960a7b-e2d9-4cc9-8c9d-27893ce5627d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdddf13-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383572, "uuid": "b2541ece-53e6-4a83-a324-fdb14160b2ab", "comment": "Malware payload (Mirai)", "value": "9d02921baa2721b268882e63d102027e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383572, "uuid": "6b3f38a9-8b51-4659-a49f-1ac8873a005e", "comment": "Malware payload (Mirai)", "value": "58437e27972eaa1c41a3979eb2702a162859de6989ec13c2320c8167646154fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383572, "uuid": "2511d490-6d39-4a6c-9adc-017e28b06054", "comment": "Malware payload (Mirai)", "value": "ca5734f68ad053ccbf5d69a3de6deb5e8fad60ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383572, "uuid": "078e8dc7-4c16-4744-85f6-519b0c98801a", "comment": "Malware payload (Mirai)", "value": "7e74250a442d02c80cad51361a63d46ea7a6602d5d485f1ba8a0b0cf52327f5816a0be247430bdf47362af8c4f2ec68a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383572, "uuid": "b63c6e3f-586d-411c-a8a6-33cca5a1a466", "value": "T142A3189ABCC58302C6E0A1B6BB1F558D371643B8E3E6B107CD19AF29634F85B0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383572, "uuid": "b02c5d7f-13e6-4f75-9876-8253532d11c5", "value": "3072:GrzWvVphiV5aTvrL2SwbFtf25+8lLKWBX:CivVTizabrL2SgnqLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383572, "uuid": "3634f1fe-951f-4cad-8f7b-f5309ab6db25", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383572, "uuid": "e90c05ba-1cb0-499a-924b-de7615e14dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383572, "uuid": "f00964ea-1317-41f6-8538-91f89471bd32", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a3d78e-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362887, "uuid": "83c75c2f-e89e-4b9f-ae63-0f499ee36678", "comment": "Malware payload (Mirai)", "value": "f0a56aeb81ab6131c0d1b5ab857f256b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362887, "uuid": "081b0138-21ff-4c13-8303-e901c2995a94", "comment": "Malware payload (Mirai)", "value": "589d44e94d3f7148b809ccf4e43773e5261240318c4ae2ab934ddc5147596b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362887, "uuid": "cda0af07-74c2-4fe2-89a5-dc69cb03cfbb", "comment": "Malware payload (Mirai)", "value": "9eb5dba2aaa483a7b67171ac82a46af52d2bd8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362887, "uuid": "5f6f9b53-b572-4ce5-909c-cf6f5064f048", "comment": "Malware payload (Mirai)", "value": "70708867d958229435639677e1d9c97f703913a2976f22bc444364de9fb38ce3f91fc982ca9d1861b76aca37f5282d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362887, "uuid": "f52e0e67-a9d8-4fc1-afb6-72fde3e85350", "value": "T14E631257FFDC1FA9ECDA16F807AA65DF13A1903250B341B41DE64989816FDB020EA8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362887, "uuid": "a5382900-0f16-4644-9364-486d7d7f3631", "value": "1536:x7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgtoKrPM:x7Mbp2L+Xqdfoz2sbKrPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362887, "uuid": "eb7fae02-10d8-4a04-8476-45051a77c4ba", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362887, "uuid": "dde12618-bf40-4d24-921f-d638afcc1f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362887, "uuid": "6fc857ca-f89c-4de0-9b55-a0abde6937fe", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c2b466-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361982, "uuid": "6d7900f7-61aa-4c80-8466-55a432d53473", "comment": "Malware payload (Mirai)", "value": "18d54f272f8e09ae3eb26b21aa862ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361982, "uuid": "2c624fc0-bccd-428f-967d-e24a64311ada", "comment": "Malware payload (Mirai)", "value": "58a0d51631cae74dfc0744f29558eb8da5d233356498ea0b3811281ac8773c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361982, "uuid": "54a946e1-6565-48f2-a0d3-2f0fe1253441", "comment": "Malware payload (Mirai)", "value": "c5a7ac69f16838ef817ececf6e69a1d98a408cf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361982, "uuid": "16f56723-95ce-40a4-a5f0-78ed32727a11", "comment": "Malware payload (Mirai)", "value": "f073e1ef04054bcaf5f31e0337f29524bc006633cea90d5562ab3f5dfdf0f7114c2d433a45a8d00ac6f3edd39dadd86a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361982, "uuid": "0990790d-553d-43d5-b506-e6e381523554", "value": "T1C4836C12CC756ED8F03A6E3110F9DDFA4717A445A80A6CBB3C478715511B988F9E6BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361982, "uuid": "29efaeb6-4967-441a-9616-479785c1e75f", "value": "1536:i74lpncHEQ+pa/loJaWhXZmdZxZIim3V5QExCB/4fXX:i7ypcl+pa/KJaiJi2b5fxgw/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361982, "uuid": "43389e25-3441-4e08-995a-ed90b19fd826", "value": 87716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361982, "uuid": "07147455-345e-42bb-b3db-3c44798fab66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361982, "uuid": "3b34450c-6965-4618-88eb-3bbdc455e335", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b8f0c7-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1769331432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331432, "uuid": "e8179354-d334-47ce-bde4-ad44ba797a18", "comment": "Malware payload (Gh0stRAT)", "value": "93edec2a5aaf7716485e775c37012f1f", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331432, "uuid": "8d6436e0-b3d3-46e0-b39e-f9ef2320e289", "comment": "Malware payload (Gh0stRAT)", "value": "58bc12f3b1d5f2e3b5d7838e26b0cf9e4d85a3ded294812c2060adfdd0467ace", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331432, "uuid": "c6d22e3f-5e4e-4971-846c-0cc49d2c961e", "comment": "Malware payload (Gh0stRAT)", "value": "a9da9a07a3e67feb040708c14021254191bcbb1a", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331432, "uuid": "ee99cf92-98fd-49dc-8e6e-0f12e043ae63", "comment": "Malware payload (Gh0stRAT)", "value": "b9705792e1b44b598eac01cb0534fe9456145d192accee2a8fc4346c4b74e70bd9ead90c70bb5c46bc68473dd10715f4", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331432, "uuid": "34e4ed4f-9180-4e4a-b30d-53657c093fa5", "value": "T11BB73321359DC272F66E01B19A29EA1FE13D7DE20B7004EB93F4F95A6A314C25235F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331432, "uuid": "cb384c60-b0fd-4168-82d9-9d1370dccb24", "value": "1572864:sxsavv2T0W/6G/PL7wvxkrsWZtQK1IoL/Pk:sq2vqLUxossQKuozPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331432, "uuid": "707a0e9c-53ff-4b3e-9ecf-8ce3a408e9cb", "value": 51538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331432, "uuid": "bae2e261-bfdd-413f-97ca-7b0e9cfe741b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331432, "uuid": "70f90521-4181-4f60-8869-71410cb61387", "value": "ToDsured-star-x6.4.rar.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f21b3c-f987-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301873, "uuid": "d9626edf-1305-47f6-8e28-e2714c74242d", "comment": "Malware payload (Mirai)", "value": "e59eac37dd452a5fcf06a905ca1be260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301873, "uuid": "17ad06a3-6940-4cb4-af1d-0debb7fa6e0f", "comment": "Malware payload (Mirai)", "value": "5c6889e2642aedfe061d8bf4e03c975f2e8485209438e47243c4c4aed8032451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301873, "uuid": "71b7e07b-db22-495c-883f-866d3358d06f", "comment": "Malware payload (Mirai)", "value": "564b7fd3982940ed4d64af0d47a9da9a76abecc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301873, "uuid": "addd92b4-c958-4b9a-a9cf-ef76a8049e31", "comment": "Malware payload (Mirai)", "value": "4a716205c975609303dde4d96910682ce664b739ee6f4141090ee4024a968f0936937e3d77fcce7336b70b4d3e1013fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301873, "uuid": "d79ad4d0-aa06-4ebf-ac26-5ccd8d0cc114", "value": "T10CD3F885FA43DBBBE40706F051B7AB324932FC3A142AE683DB64FE7669609C0D61535C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301873, "uuid": "02f5ca4d-cad7-4b3a-bcc3-91a1dd974183", "value": "3072:blz6dOLERdDvXIMXpq4H58RjW0w6JppifvURSaztAT/65d47j75bAg0gkb31FMlO:J6OLERdDvXIMXpq4Z8RjW0wkppifvURL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301873, "uuid": "f814bbc7-06d8-4e3f-9a79-35a65bb40cfe", "value": 142432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301873, "uuid": "34b1507e-910f-4896-824d-c6ade65462db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301873, "uuid": "ddc142c0-c45a-4820-ae04-34ac30f4abb3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd0c8a4-fa35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769376969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769376969, "uuid": "505f30a6-8436-45e5-b45e-ab49bfaaa48f", "comment": "Malware payload (Mirai)", "value": "ddbefae7f9f899cf4ba512a45367f8c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769376969, "uuid": "8abe2bc7-7c20-4a0d-932d-4bd175112f11", "comment": "Malware payload (Mirai)", "value": "5d969f4ff26b5c704fd4da24a10cf3c0df9756b72c569e09ed3a1ccc903bca6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769376969, "uuid": "8f762e4a-91c8-4fe6-a291-b2ccd6661ce4", "comment": "Malware payload (Mirai)", "value": "c11e3736b460b8d1af3eff91c9aa8b9705928ce5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769376969, "uuid": "fd651fdb-5a51-4820-8451-4a08ed828b44", "comment": "Malware payload (Mirai)", "value": "d23a96036c5256a84fc445a2fa1895e430deb66abfb5d23808777c2c996f98eb0f3772b9f498884ea36867d39f16ec4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769376969, "uuid": "dab0e4c3-242d-49ba-92fe-a082402d436c", "value": "T103A32986BCC58712C6E061B6FB1E518D371643B8E3E6B107CD19AF29634F89B0E3B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769376969, "uuid": "0e7ddaf5-6ab8-4b44-bfe7-3e19187080a8", "value": "3072:rYis3iAuHHyeGV2kDlpCc0ibR9tL5XqldroDX:rmSAuHSeGYkhpCctTSdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769376969, "uuid": "84a17801-8e4e-49c5-8dde-69cdab8d4651", "value": 98696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769376969, "uuid": "8acef1f5-3997-4466-aebc-445461f47200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769376969, "uuid": "599d6828-b3c0-4ba7-bb28-3758d8251251", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d87ec40-fa48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384835, "uuid": "6c989ad6-aad5-4fa5-be27-d465d4318307", "comment": "Malware payload (Mirai)", "value": "d5b6addf566227ebe3143615201dc819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384835, "uuid": "c33cb474-1b1f-4c75-8fb3-b49ed94f68cd", "comment": "Malware payload (Mirai)", "value": "5efbc6c9c1dfb901efa78f7e4ab20608a1da7772ed18b15912ca9f93ad0fd591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384835, "uuid": "eebd62d3-1c17-49a1-bc66-746daaff387f", "comment": "Malware payload (Mirai)", "value": "40956a189913553f71670e5d444660f1c7600ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384835, "uuid": "0d8a1321-0956-4ab4-944a-6aefa42648e1", "comment": "Malware payload (Mirai)", "value": "3d0c60d0249df572b40497996109d08fb4624c602f5652b0460db7ebf32b7fc7fcb417127a29394f2793b20d06e2adac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384835, "uuid": "1e06753d-b352-42ff-a081-c5286fbbfb6c", "value": "T1B7430955B9859616CAC46577FF0F429D371A43F8E2FE73039D296F25238B82B0E3A841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384835, "uuid": "05306a91-3df2-4bcb-90fa-83f2df145aa6", "value": "1536:Tq5ciTVj29hjq2DptFYt9z5IIe5vBaq1ukGQ7Nm1X:TDi5YhjqWFK576l1ufG41X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384835, "uuid": "fde0a61a-8b79-4e3b-8ded-b15c60031283", "value": 55524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384835, "uuid": "49034084-56ad-40f2-9ad5-57bbd9a4020c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384835, "uuid": "d1f6a65f-e33a-47d8-8f8e-31998e004911", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e8dfc3-fa1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769365651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365651, "uuid": "0d3ec107-357d-4edd-9eb6-65edfd7f6f5b", "comment": "Malware payload (Mirai)", "value": "a6e1581999eb3cdbc7d507187154c786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365651, "uuid": "54a01c50-788b-48c8-8088-38dc4d657df8", "comment": "Malware payload (Mirai)", "value": "5f3310f1cdd558e51a12d106ad59478a8b889aba6945ccfbc9a04c8ffe82e99f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365651, "uuid": "f5e5f6dd-93c3-46b8-a1db-6052241cdff0", "comment": "Malware payload (Mirai)", "value": "2680a5c7b0d8502ec6567684a2c806dbf9e856e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365651, "uuid": "c9f8e28c-a8ef-463a-9305-20b2738be1be", "comment": "Malware payload (Mirai)", "value": "41d35960c5f47e132f6eaa475aa98743ba72106f88af1879df9d78bf36ccbc3e96f5af35a2077bdd9172c8d945657e51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365651, "uuid": "feda5eff-10ff-49d6-8943-4df187150766", "value": "T16B73F74AFD80AB11D9D525BAFE0F518933534B6CE3FA72029D246B2463CB92B0F7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365651, "uuid": "0d3e0fc7-81eb-4961-adb8-fdf150846ec8", "value": "1536:3xnuf4gR9sFxoe4WuuFM3FbyLyWXPImIllZGifSMVZG0Z/YmNwXfG0:RgR9goeIFbyLyWXPuXSMVZjNZwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769365651, "uuid": "81ac3c4a-ecee-4589-b8a2-f2699a176955", "value": 79392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769365651, "uuid": "991ea0f3-ed14-4b9f-9967-c1bc4e9ab841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365651, "uuid": "48499613-3c71-4072-b204-1454f0c3a013", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62e47aa-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383830, "uuid": "aa7f8804-4cdf-47e6-9cc9-4b1ed875efb2", "comment": "Malware payload (Mirai)", "value": "7806ed5324ced42c111d5758d10507ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383830, "uuid": "201b0062-0099-46d4-b494-104e7580229c", "comment": "Malware payload (Mirai)", "value": "6026f19b1582325994a834ff4c15a4211d3a6e17ceab32da17d237821ea3c3d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383830, "uuid": "eedbbf0f-1074-4bd4-bdbf-d080013b56c0", "comment": "Malware payload (Mirai)", "value": "5654b68da33d3710fb410aef672e85918baa2f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383830, "uuid": "7d86d854-02fc-48cf-a60c-7fd9ad483950", "comment": "Malware payload (Mirai)", "value": "89a7693018ba9df23a820a376dba65936ceefca5eb83075878af86c02257a1fc7d51adfab5f68e8bbb5281b696860061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383830, "uuid": "c392ed4f-30a4-4774-abba-baff9a22cb7d", "value": "T15E933BA2B410DC7EF45BE7F780570A16B221A3E44E426F27B627BD13EE2E1742852D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383830, "uuid": "75357b76-d27f-4485-a8de-a40d0cf01904", "value": "1536:OhzzDqIJR0e+6+6ngAJuWgfFflZ+hmyuWmkWWOYPZeX1Fp48rpz:OhzzDq65e6ngmuWk4dFJMYYX1FDpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383830, "uuid": "d231d80b-ebe4-4d99-adcc-7354b2c7e5c8", "value": 92596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383830, "uuid": "f6b9b2e8-9b7b-4641-97c9-241ef1978cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383830, "uuid": "503f4fc5-0566-4f43-95e9-0626ecf4c66a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166025a0-f9b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769322519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322519, "uuid": "d297078d-4126-4a15-9326-23b66f721e99", "comment": "Malware payload (Mirai)", "value": "16b58f1ba2935fd6f184bda84ce8d02c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322519, "uuid": "d519c429-1c51-4a96-8f76-a85bdedba17d", "comment": "Malware payload (Mirai)", "value": "627cc17bb1eaf7a33c33e94a3637606d40b0c75f0e059b9384d5f5a47d8c1ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322519, "uuid": "48621f12-26b0-4ae6-9440-3cc8c52ede63", "comment": "Malware payload (Mirai)", "value": "81fe318521dcbef350e418c16c38155764f017bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769322519, "uuid": "80df2d32-4362-40a0-b394-a7197a2fad9d", "comment": "Malware payload (Mirai)", "value": "9533183ae1e81e70650cc00387d3bcc79c2dda62714dcf4898939437b7567e8db7d6c7e335e90f11e364bbf6459f6d8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322519, "uuid": "f6ffb2e7-dff1-4ffd-b12e-cd6ca4ece8c2", "value": "T19AC2E17FB59A6667FA6C233AF431C11B03A4F51C939D675727400432E99E82E7632CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322519, "uuid": "cb5d2df3-9ac3-475f-9cf4-416559426cd6", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH5t1k6t:vMwxdyoEUnDz+Y8tqHWXmZ/u0N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769322519, "uuid": "21f1c8e5-5289-4106-b10e-f486fc727f1d", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769322519, "uuid": "a29cb66b-2aaf-4787-bf93-0c64f39055d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769322519, "uuid": "51fc25e4-6f43-406d-b30b-df79dc0862fc", "value": "cosmic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3c8987-f9fe-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1769353129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353129, "uuid": "198e1b74-06da-4004-bc36-b84a87635121", "comment": "Malware payload (EternalRocks)", "value": "68079216b96b387f545ca68e6c9ed7dc", "object_relation": "md5", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353129, "uuid": "3929652c-5941-4be6-b029-28f2a5ca705d", "comment": "Malware payload (EternalRocks)", "value": "63432e376a1ac1303ea21ee5bab1bcf1f4f7661206cfe0d07059768866cecf27", "object_relation": "sha256", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353129, "uuid": "0fcc9bbb-f331-45c0-9e59-ff2c27387de5", "comment": "Malware payload (EternalRocks)", "value": "d28b7e41b336e518f3436b72a11d8bb6fa0ece85", "object_relation": "sha1", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353129, "uuid": "a302d1f7-4b30-4f31-84b5-c68640b39893", "comment": "Malware payload (EternalRocks)", "value": "c72eec0bebb7be7ec2c5e02d79b5a8d42e90894a4889167fb700afd793c23f4f20663fa3ccf0aa1ac925aaf0c458f571", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353129, "uuid": "dce9ae72-97d8-47ac-934d-86d9ff517a27", "value": "T171A52912DE676C67039956DE9947F854DCE2832F522EF4C432C8C5C930E8E7927A88ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353129, "uuid": "c6f146ae-ff56-480a-b014-9af08ecc4fab", "value": "12288:+7FSTvotc166lVDeH+gjyc15Qz5cPG8QLVWvLRJ+7UxvydnEm5g0JL3wVA24QC3t:+pztAlkvT5ZSUqIRK/Efm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769353129, "uuid": "948d91f7-bf79-4e05-91c7-da0b88258518", "value": 2112940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769353129, "uuid": "caec26cf-df9b-4416-aa08-a53a14eb0663", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353129, "uuid": "50bf2a77-ecbb-4f62-93fa-c38ca247d998", "value": "Qt6WebChannel.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c67396f-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769330770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330770, "uuid": "4faac056-9b76-4f5c-9e24-620cbe9cf4a1", "comment": "Malware payload (Socks5Systemz)", "value": "2ee79cf10258e106e8a8eeaac2c78e3e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330770, "uuid": "870ffe6b-c5cc-4f79-87d6-5c2e070b09d4", "comment": "Malware payload (Socks5Systemz)", "value": "6385ef5afa819616b15065de90d86132f029390c36495012df28f75618eb3e49", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330770, "uuid": "bb0fd988-2c63-4860-9962-1dc545b2bd17", "comment": "Malware payload (Socks5Systemz)", "value": "f34ff7b462eebbdf8219344624e46e8b176bc59a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330770, "uuid": "8489b800-60f5-43fe-8e68-9ea8933fb03c", "comment": "Malware payload (Socks5Systemz)", "value": "9a3aedf7176ac057518898cdb90e13829b1fde0e29e285226e6733260b8f75229681b954bbf4f705a3fdf3353d5142d6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330770, "uuid": "099f38c0-79ea-4e1c-ae29-46594bd9d619", "value": "T1F8C73324B13379D5D62F93BFE4695FC94030BDE1B31BA56B63787FA58AB064620B1803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330770, "uuid": "975f0dde-897f-422d-b651-6b33bf7f2a66", "value": "1572864:l4p1VfNDTCRLA1/BnMJ/HZF4vY9woeTh6:l4pHNmM1xMJZF4vYCf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330770, "uuid": "5e1b206b-7ca8-4997-b5c8-c9ff5f777f1e", "value": 55907328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330770, "uuid": "ba947721-f8cc-440f-be2c-c388276aa90b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330770, "uuid": "72c3815d-0ea3-43ff-b9b1-d8573e52de1a", "value": "leidianmoniqi8.9.7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7b9f5b-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362290, "uuid": "d0c9389b-6efd-4a3d-b890-d9b080d65cbd", "comment": "Malware payload (Mirai)", "value": "7d6e71ab47ea97a1e23bdf4cba825999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362290, "uuid": "b1dc4491-d18c-45f2-8711-668e2836fa18", "comment": "Malware payload (Mirai)", "value": "6416ac3b84bc53cb1dd2240411847d6110317cfbc67b236bba98c6efa351d856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362290, "uuid": "54a71a60-f7b1-40b8-b247-64c428eb145a", "comment": "Malware payload (Mirai)", "value": "b3b8ca96110cfbbb673354e160bae778a3c61dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362290, "uuid": "aeb49336-7c30-4ec6-abcf-0f9dd1178be1", "comment": "Malware payload (Mirai)", "value": "a8917155f197f15e628ca9ca0b33348a8a78fd0116f839cb9b7feb1331b5d7d0afc7498ed7c7dd319c272c94f7fe15fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362290, "uuid": "59519bed-b316-4d28-8cc5-5e07a7aeaf95", "value": "T1CB736BC29143D8F5E9190174223BF337A672DDB801B8FDE7F7689672D42A6A0608774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362290, "uuid": "7b8cc273-b96b-4244-a2e5-e2296446aca8", "value": "1536:bRvChyexcj5Du80uumwhi6Z52kCkDc24aH9rEdcjj9oiesHG0Fw8rb8t+:bB+ZyNDuJa2Z3C2c2jhx9zvmKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362290, "uuid": "cede1b47-8db3-4be9-9801-dc0f41fb2bc9", "value": 80532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362290, "uuid": "632b6609-777f-427d-b679-02f6cb163e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362290, "uuid": "a560be82-9b93-4d56-89b6-ff6466f060a1", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e43e75-f9f4-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1769348963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348963, "uuid": "61dcd27b-e232-4da2-a7ca-a238081739fe", "comment": "Malware payload (LummaStealer)", "value": "9ec82cca292768b4b06f1d7702b7ae66", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348963, "uuid": "ab794565-3d91-4b7e-bc4a-3b56093285c0", "comment": "Malware payload (LummaStealer)", "value": "64372ceac4021c25e56970c371da019d88aad00942e6dbc02e1ab2a1bc2d3811", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348963, "uuid": "4d0d7667-b162-4773-b2f8-f476219bc022", "comment": "Malware payload (LummaStealer)", "value": "8062bf6034b1ae61be827a34c8f8e1b19db87439", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348963, "uuid": "6d0938dc-59aa-4e8d-9b4e-0b8a3e949f31", "comment": "Malware payload (LummaStealer)", "value": "884938c50b7a8be04e7e985ddc25564d33dc042ad6f07c5ea2cca613dd61a72ec952d1e62bf250b784ab417443642c25", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348963, "uuid": "31d61b46-a414-406f-8dfc-42e3824f3fdd", "value": "T158D5F1102BFE9163F19911F2D0D035433EB8BD985BA4565E7984FAED0D316A23DBF222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348963, "uuid": "a6006890-de4c-414d-96f0-9c1b4fbf0cc8", "value": "761bff762ac9f7b22ad101ba7a197c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348963, "uuid": "bcf87b2b-f97c-4e03-a32d-6f1bbe3cd3a0", "value": "49152:bVLuIO5pxo0zEEEDEEEEfuV9OIiuAH0HPv3zHFGU48kFfD+ju1Y0WyqXB2rUBtIN:huzS0zEEEDEEEEfuVJiLH0HH3LFGUIFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348963, "uuid": "19262182-eeae-42ba-b648-5186eb8631d0", "value": 3005952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348963, "uuid": "1d7eaf6e-70e7-46f2-b2f4-a92324cccb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348963, "uuid": "817a2cc0-7028-473b-b022-0595422501a0", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db86cedb-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384698, "uuid": "8adb4c51-2434-4267-aab9-692571b45a3d", "comment": "Malware payload (Mirai)", "value": "5073acb65b14fc28f1ea9914ae63d179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384698, "uuid": "46b9c48b-208a-44b8-9daf-58958b6bcf88", "comment": "Malware payload (Mirai)", "value": "645e42550a44d8d0e0a2abe2b214eed4a608425b4107b9eac8d13a3121f1971a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384698, "uuid": "e29482c6-4cf1-45a4-9c78-e5982ca6b57d", "comment": "Malware payload (Mirai)", "value": "66c37d2a5978f9a8b2e0b894e238695dba47a75b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384698, "uuid": "c894cc7e-a131-4de1-84cd-fb431f0cc9a3", "comment": "Malware payload (Mirai)", "value": "ff2e8afa304bc8c04586167425dfdcf90a1aec64424c3b82aab985cd0f3c7ddd87ee244e3e4d88e12f29d9f1aa40d72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384698, "uuid": "02f5d773-9021-4f07-8a5c-9b952875a347", "value": "T112534952BC829A02C5D522B7FB4E428D772753ACE1EA32039D19AF21378BD5B0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384698, "uuid": "a3d316db-26ab-4195-8a9b-65241b52aaae", "value": "1536:AayesX9+tMKckpIanBnuhWUGYt8RO1kI21PErL5:9yesXwtb8aBnuhWU/q1wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384698, "uuid": "0374c59e-1ca1-4bd2-af8a-c2df25b68378", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384698, "uuid": "c7d9d2bb-4380-435f-8903-10afcccd0958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384698, "uuid": "d28ea3b8-e5ce-4589-9895-3f06277a031e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f265c8-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1769330729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330729, "uuid": "8ac469f0-ea3d-49ac-9d88-87f4452eba81", "comment": "Malware payload (Gh0stRAT)", "value": "adc629f8aec0431b92b14d8c8e108416", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330729, "uuid": "93e7809b-0eeb-406e-88ca-3886ad3904ea", "comment": "Malware payload (Gh0stRAT)", "value": "65713c6192a7322874f1e2cbb83473cc58c484c5af50074f6a853ab85abdbf15", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330729, "uuid": "be43342e-c102-4a8b-9046-48577effb6ef", "comment": "Malware payload (Gh0stRAT)", "value": "d0af843064d8f651eb4aa4a931ec8fff5ec50cc6", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330729, "uuid": "fde547d1-0957-4a20-9fc3-5e78f9b6e7b7", "comment": "Malware payload (Gh0stRAT)", "value": "f242d0289d202b63cdc684037013f44f9abc2395d95bb6744a5e8a125e9e463cf657642575b0d8560dbae096c8dbecd3", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330729, "uuid": "51e006b1-98f5-45c5-8b2a-bc90e6643833", "value": "T139C73335B5CEC63AD55D0076AA28FE1E09B9BE63033405DBF3E9BC9AC5758C29230B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330729, "uuid": "5d124872-08cc-4b0d-a96b-7013ca080942", "value": "1572864:2Tvq2MPudIkMUvHHfu9w/K7YuskJtov72B2cXIlM0s:2TyZuakM+dKVs4L4Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330729, "uuid": "c29fd5b5-2be8-44a3-bdea-e57cc8b02324", "value": 56616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330729, "uuid": "f2519cb3-be5a-46a1-9ef5-b0c6055c23cc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330729, "uuid": "6ddab7e8-4d4e-4d49-b85f-58f9805ad9f5", "value": "C.Verge_2.4.2_x64-9544.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb348da-f9f5-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1769349425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349425, "uuid": "749f4455-1103-47e8-9931-2566b17aa314", "comment": "Malware payload (EternalRocks)", "value": "b3d73c38d3bc73bcdb8a133a4c5da91a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349425, "uuid": "16e0d2e1-fe25-48b1-af06-807782148e06", "comment": "Malware payload (EternalRocks)", "value": "6758532f4e4e168d58e03fc54bb4352cd37f46b8ff9fabafd637fbea27675603", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349425, "uuid": "115323bd-2c8d-45fd-8de7-99f27d135633", "comment": "Malware payload (EternalRocks)", "value": "9e821950f1887f1a061e541528ad2826a81ec946", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349425, "uuid": "46c3df69-f451-4565-9fae-041993d14889", "comment": "Malware payload (EternalRocks)", "value": "5c8de933a6f0d1402987a05e36891540b9173ee672277fe01641bc577f9d4e143cd5b41203ab2aff55728f12416de1b1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349425, "uuid": "3c0a37d6-7967-4324-8afe-63b19e12efe8", "value": "T1C0852B11EE47E9465E87B2C5974BB608ED60A45D32E2F0F871979148F0D8EAB23C49FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349425, "uuid": "f3978679-5dc7-4fd1-9758-bb9919ca1002", "value": "12288:C9l8CT0LRnvLn4E2NPxHqBl0wq64q4e/yg2ZjlBxKcpHYqCed+AeQU:/CiBUNPxHqLXf4wqZZKcZCed+AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769349425, "uuid": "ac2608c3-4691-484c-8bfa-54e56f1a78c4", "value": 1806163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769349425, "uuid": "507d1411-df91-425d-a39b-2bfea702b670", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349425, "uuid": "0195d5e1-6223-48eb-9e76-bd57e8458895", "value": "window.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce4d56d-fa16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363628, "uuid": "48b078cf-c1fe-4e44-9c33-68a32ac693bd", "comment": "Malware payload (Mirai)", "value": "f4a387dc7522a206c614e6420e5ae884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363628, "uuid": "81334039-9a61-4dff-a776-a7944ca57211", "comment": "Malware payload (Mirai)", "value": "68e69576a27ad232eddcfd81a7fad0d1e9b3f7f1e50efac8f65663eafd0082e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363628, "uuid": "a795bfb3-8702-4242-9e38-cf2caef20e96", "comment": "Malware payload (Mirai)", "value": "5aac7687aa5ee51013f6b75bd7fcf4b64ceda647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363628, "uuid": "6a21aaa4-25c2-4c6f-88ad-4bf1b8052552", "comment": "Malware payload (Mirai)", "value": "44f7d6fa52b607031fd2906c6fdfbc29dcd0bf94714903fdc5169f81ce464e745a2a43a43ad94e8e9fb4cad84d9c0e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363628, "uuid": "a6b64a2e-02bc-4888-9c68-8fc6960bb724", "value": "T17AB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363628, "uuid": "317d45c2-6619-45e6-8c1b-3a56461d0589", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzO8rSR:t3SrlGWnKTU83AQB5A5Liy36fSUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363628, "uuid": "625e91cd-cca3-4a3f-8a06-16b184ea4791", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363628, "uuid": "3729b028-9cde-4547-8a1b-aa3dd091b136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363628, "uuid": "294ce3e7-4f37-4ba6-bc1e-36aeede51537", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c4dfd8-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333546, "uuid": "08a6272b-460f-49ee-969f-7a49207e0f3a", "comment": "Malware payload (Mirai)", "value": "30ba6f44bea3d46ee61b8bc966256d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333546, "uuid": "4e229aa1-15bb-488e-87ee-57a01652868e", "comment": "Malware payload (Mirai)", "value": "6940b214ee175e9d43e168d90f50052cf055a6ff72f7da9ae9b92ba29afb30fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333546, "uuid": "10352477-2f84-465c-ab6f-8aecf5c6fd6d", "comment": "Malware payload (Mirai)", "value": "dc81505458571b21ecf77b39a082fac7f14499c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333546, "uuid": "ecf04583-da16-42f2-b6e4-40bb32f00a5e", "comment": "Malware payload (Mirai)", "value": "f825e481fc64a8255fc24e2af37a206b2a113c0cb205d3af78d73d5589486b813ccfe3f1d13de8ff13203d620c203db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333546, "uuid": "e68739ec-2ba1-4a12-a9f6-6203507ec9f8", "value": "T1B5331986B801AF2DF84FE6FE41A30D19BA217A1554930B2AB777FDC31D321D4AD52E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333546, "uuid": "ed12887b-e074-4bd8-b875-ac3833cc7ffb", "value": "768:nJ7keKz6u5BES95IZI5To1bIxLu/84RfFCvs6uhtKVr3:Jg5z6QjqIjxS/84RQvs6YtKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333546, "uuid": "8c050e95-944d-44b3-9b9d-74251c2c6f34", "value": 51320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333546, "uuid": "c70f3476-6c33-4fdb-8a9f-12c2e61855cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333546, "uuid": "8e611bb2-32e9-40d1-ba84-9d7773eb4c21", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1d05bf-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383117, "uuid": "cb3f02e9-e877-4f6f-9f43-90d991f9883c", "comment": "Malware payload (Mirai)", "value": "9fee485624169d15221f0b104a9e6bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383117, "uuid": "2d226038-12b5-4840-9db3-535a5abc5c19", "comment": "Malware payload (Mirai)", "value": "6a3c41c7d09e20ea0b1cdb9cdd0ca3ebc7d84ffb270df9c01a7a1dabfb9580cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383117, "uuid": "53fc25d0-1c78-4ed1-86cf-7560eab85bb4", "comment": "Malware payload (Mirai)", "value": "39ab3687cd353f35b995267037ae404f58164089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383117, "uuid": "b9a7d8c8-c235-4dc3-961f-734fba6653ed", "comment": "Malware payload (Mirai)", "value": "c95ce7abe6ab04fdabcca89a5fda89d2fa3e7af66337e2725a1c656e6e03b97b62684c3f86f70ee3706d7bb2751f61bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383117, "uuid": "d11912f7-88df-42b2-b664-b5da441c1d28", "value": "T154A31BD6BC858B11D5C165BAFE0E518D33134BB8E3FA7213CE185B2E574B86B0A3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383117, "uuid": "f8e06946-2c81-4189-9e39-82f5e284876e", "value": "3072:9alKXZLqtNmIEQxfhiKD/cvpHeCHHqrVE9P31cIbX:wtNRaKD/cxDqrVwPlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383117, "uuid": "587b35d1-cca1-4c4f-a35f-b0c59df0dcca", "value": 103804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383117, "uuid": "9a481b07-d2bf-4c44-a41a-e98519ab6a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383117, "uuid": "0a42fdbf-427e-46dd-876e-bf18f0f35e8d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd7717-f983-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769300257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769300257, "uuid": "9d479783-2011-4017-b814-db0b912b52a6", "comment": "Malware payload (Mirai)", "value": "7ba5c537ec38b553f96f6839eb06afae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769300257, "uuid": "1ee2188b-0d53-45f4-9d25-05912234d280", "comment": "Malware payload (Mirai)", "value": "6a6056edae97ca66bc2f631125771f06c393a03f043a15d22bd324c54b4061de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769300257, "uuid": "6f470de7-5b17-488f-8889-0799a1b7b4d3", "comment": "Malware payload (Mirai)", "value": "c13a5ab2ebc47b60792f814c87fd5376cb8c412d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769300257, "uuid": "37d7ad4e-7395-48fb-9a86-3d12beafab54", "comment": "Malware payload (Mirai)", "value": "268924352f811e0928a239d894de3ee48cfa07fcef71a5b30af87659306184b2343537a6eb000bd6c4c90b7263030eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769300257, "uuid": "ffe017be-a0f4-445e-8391-1109c258e630", "value": "T198B3090AAFB11EFBD4AFDD3745A50749389D590621B93B393674D81CF21A68F06E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769300257, "uuid": "eb074be3-00f5-428a-8596-9b4bd9708785", "value": "1536:H49QgAWnEuEgG35/qmonly0L36n0UpqBYCx/bxc81uhuFO/busEyZfqFX39wu7rZ:HGN1BlyjTEkOyMYhg2VbiHVsXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769300257, "uuid": "9c1bd691-05f0-4ebe-a9bb-fbbe823c97a9", "value": 109356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769300257, "uuid": "724f879e-3210-4af8-9f33-b220ba628266", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769300257, "uuid": "d175bae0-23e2-4d27-8285-5ccc5c80a626", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b7b375-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362159, "uuid": "440f1a59-e667-4808-8c93-8bdad84a53b0", "comment": "Malware payload (Mirai)", "value": "f430aa648ca57d95236ac48906bcbd26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362159, "uuid": "54236bf9-0938-4587-afbd-c34a0d4be4d7", "comment": "Malware payload (Mirai)", "value": "6b674185feacc1a5c89d565675f4f763c0914a42b615af2208c7e7c5c8739ac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362159, "uuid": "9840e4af-9a4d-4e88-9cd5-4327d85c1f25", "comment": "Malware payload (Mirai)", "value": "601af05e48fe38ab72a648eb0065b044f8d3d526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362159, "uuid": "94268b30-bb9c-4296-b8f4-c3158a3d6727", "comment": "Malware payload (Mirai)", "value": "89bf072d5d882b9daaa596c466aaa85641b113ea97b4d04e4e649301b75124b1295f9a1708f6ff6390ff4daf88b5fb98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362159, "uuid": "0061df43-78a4-493a-a32a-eee2d18fd491", "value": "T1A5D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DD05E15FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362159, "uuid": "9f16b15b-3757-41b2-b48d-a0a5bd9d7edf", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQl:yIRfe3xvvSrlvZZ7Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362159, "uuid": "435d5350-68d0-4d65-b819-b457962151af", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362159, "uuid": "e4ab7c19-e324-42e5-a742-88850d0d187d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362159, "uuid": "4ba5a93a-83cb-482d-9856-2e66cd23929c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ce0be7-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362134, "uuid": "0c64f3df-fd49-4c43-9506-5d3c4ad853d2", "comment": "Malware payload (Mirai)", "value": "99ea07d23a738f3fa8485ce8b2f38cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362134, "uuid": "a79358fe-fb7d-40ef-9495-45d03a38e69e", "comment": "Malware payload (Mirai)", "value": "6c75a3f9b8ca51d986fb2f67e1ce20d240f51a4622b52e97b64fb78833d31470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362134, "uuid": "ed22c881-65ea-4d90-960c-3eac836a5970", "comment": "Malware payload (Mirai)", "value": "11ffa9d142fe2b5d7d313b92722383df0e7f8561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362134, "uuid": "4967902a-bfdb-416f-a790-6bf1fc7f7c8b", "comment": "Malware payload (Mirai)", "value": "b4427342efc390b0ba91916d0062d2839ab4f8af5c3cc3de1fa2048dfb1a6b21ec5019fea9d2d78c5cd04d7eac848803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362134, "uuid": "4840df9b-22a8-4221-83bb-f1359734ff70", "value": "T18F531856B991DB11C9D165BAFE0E518D33134B68E3EF73129E286B30678B46B0F3B805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362134, "uuid": "a7864e12-a4fb-4d5d-8414-fcaac5544200", "value": "1536:DOnEfwLp7/sc6GepUvbEFiFhos+MUi4Ulv2/KWc7g6YQXj:+Lp7DxeTpUlv2/KWcU6vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362134, "uuid": "4d20bc31-eb33-45c3-a7ce-0eecfd0241c6", "value": 63272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362134, "uuid": "0912810c-ffab-4379-9bc2-8ca6c560b374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362134, "uuid": "768ea96d-795f-4888-87b4-7d89a6a51beb", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee91f3e-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302643, "uuid": "e92675fd-2d1f-46e0-afd4-9a30c0b4bcb6", "comment": "Malware payload", "value": "4cae88eee9745d9289668bd5be0752ae", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302643, "uuid": "0a9be60b-009f-4e00-ba8b-33f82eb50ca3", "comment": "Malware payload", "value": "6d9c91584132fe3f0eaea3d25aecef32f47331d0946d074cb5687f759c68750f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302643, "uuid": "610fa96f-4546-4ab8-8d87-39d3f50a3ed4", "comment": "Malware payload", "value": "e8c69780c04e073728fa8c43399c4a27a7c64b76", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302643, "uuid": "7e245eff-2d40-4843-bcd7-b49a58199c53", "comment": "Malware payload", "value": "1ce10b8eb74e53fcc6ebf3c6bc512cbce60ff5534b2524a3745037ff4e10f467a59fa34a81cd71269b9977cb26d347c5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302643, "uuid": "0fb9a38b-1efc-4f5e-954f-c407c0f7b300", "value": "T195F7333279CE8774E5BF92704661DF2E92F63DD0077180EB83E4986B1A368D1453AB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302643, "uuid": "0473ef3a-41dd-4334-b845-a140ec3c0a71", "value": "1572864:ouyq/mvvgkLE5KRLBMzBe56lhyI0KnaY4M/xhCbyHxDYlE:oxZvgshiT3yKaY4M/pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302643, "uuid": "bdf062c3-7ced-453e-8a7d-3260fa6c358f", "value": 75038208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302643, "uuid": "2d32aed9-0d8e-4f9b-b6bd-f26a2814f75b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302643, "uuid": "dac31dd7-5e51-4d87-8c69-43b06cdbf614", "value": "win32-Telegram.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d8a7e7-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362118, "uuid": "4c34674a-baba-47ae-b531-7d479e1241c9", "comment": "Malware payload (Mirai)", "value": "826353041d4a8e349cc53471029783ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362118, "uuid": "c159daf0-130b-42ba-b22e-6d5704908922", "comment": "Malware payload (Mirai)", "value": "6da977a98f60d9e654a0f171ced76e620e7079a422465e83f00ac4e88dda04a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362118, "uuid": "f14019f5-ee69-4873-9388-85311cdb094e", "comment": "Malware payload (Mirai)", "value": "591f41e7f9a00f9a12b31da1b3015389f749830c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362118, "uuid": "b1189f29-dd2a-4b76-8e58-1d2c31583850", "comment": "Malware payload (Mirai)", "value": "b8454ba6e192da4ddbcb9241d176934606bc42022883374072c3335860722d51a03aa4b8a81dbd036ed257afeba4ce79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362118, "uuid": "fceee846-5c97-4d08-93af-1cac70981e38", "value": "T1A1236DC9BB42C5F2E86601B06177AB321B72E83A1075FB9AD369D436DC62100F74778D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362118, "uuid": "604eab35-3558-41f8-902b-7c96203930cc", "value": "768:OrTRP02qC9IAwEzpaW/Iu5Sd4jEKS+dZvIQTn9Ia93jfc86qJjMnwg+q2srBBg:OrTp59aEcIIy2QrDNjfc86qi5vBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362118, "uuid": "907ec11a-4f64-4a2f-bae0-1021257be4c1", "value": 48052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362118, "uuid": "91a58033-6930-4174-af10-63304effd912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362118, "uuid": "cd55515d-db79-4c8a-9b30-063f4f420506", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a89eb41-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302555, "uuid": "f011c82d-8ce0-4c0d-b087-69c87091671d", "comment": "Malware payload", "value": "98fa86ba176a653a385573fe60d4821c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302555, "uuid": "d341adbf-4575-4788-aff1-62a033480b0c", "comment": "Malware payload", "value": "708a245a4cce74845d7edcca03432f36cc4f87cd03e58eee5ac038ce1cb963d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302555, "uuid": "932fd13f-8018-4231-ad1f-e77d10a60962", "comment": "Malware payload", "value": "0ebf60d86edcacd7c6d40774f48e48190e04fcc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302555, "uuid": "e245cdc7-4d23-41a8-990c-b9d8a07db530", "comment": "Malware payload", "value": "95448a96c4e08b3578914da3bb8362dcccb9b2fb70194899c6709a7a5f2c52b1aac6c920462799ac2cd374dad66920bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302555, "uuid": "c184847e-b497-43f4-8528-c97dd976ee1e", "value": "T143735C1AA34328ECD61BC5B086EF6733BA72F8B756309F2F5754DA351D10E902F1A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302555, "uuid": "4cc46ab9-c17d-41a4-8bf4-323a6f6b5f32", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302555, "uuid": "6df42c59-5be4-46d8-a4c4-5556020d2468", "value": "1536:g5l8EoNLDd0E7ccWlWUEvwznKklGgYtRFC:Ol8EoLJPWgFwWkl22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302555, "uuid": "f8845293-e280-4260-9f7d-02d9c36d370c", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302555, "uuid": "ae7baa21-f0df-4328-aca4-999e1561509c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302555, "uuid": "d2b42272-4b90-48c1-bef0-09f10ee50082", "value": "SecuriteInfo.com.FileRepMalware.54526356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23f6d37-fa41-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769382105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382105, "uuid": "3000fe05-c585-4ca0-87f1-754aa2c55d35", "comment": "Malware payload (AsyncRAT)", "value": "2c26b6f05631d3bccdd211e7dc0486cb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382105, "uuid": "2e1dfff7-6485-4679-a264-582a58d16294", "comment": "Malware payload (AsyncRAT)", "value": "70f71d41992900a2ed8e6246ca8a2366f031757b159bcfcb47cfd7ca299ec6b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382105, "uuid": "a355e049-9a33-4aac-a9b2-d22abff62a69", "comment": "Malware payload (AsyncRAT)", "value": "b43f49f0d5c5c92c90a75c46b81e43670d6a1e97", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382105, "uuid": "d2389de3-7847-4e54-ac42-d15284309017", "comment": "Malware payload (AsyncRAT)", "value": "feeb2fef0db57c1ca09eaba20311546756d62a5592406fc5aa45fcfa5376c973515368a68703e8cdd7cbbe13843527ec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382105, "uuid": "057e67ee-bf49-41a2-ae03-210ae3d36796", "value": "T1F2437D1CBBB5412AD1FE5FB099B2B213C636E2675503D62F28DC40DF2723E89C9416E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382105, "uuid": "d017b834-3b02-4518-8b90-4ee531cbad18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382105, "uuid": "46104770-7ff5-40dd-8a23-6f9a4a2c88bc", "value": "768:no9Iuxf+8VUx+N/aHAfVsFq7a4zkPOZ/kbJzBIQ3FxZOdhRVNv:no9nmb+NyHGogkPOhkbJzBIiFxZOdHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769382105, "uuid": "0801ad68-0ff8-4376-a33b-95c792d1f056", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769382105, "uuid": "7254e4e4-9475-4219-b1a7-53e0279035d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382105, "uuid": "11fd9a9a-2ad0-4329-bb6c-f49e9e85d5d2", "value": "Xray.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa5f717-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344734, "uuid": "d3084fd0-fc55-48df-9569-3a114c4120ac", "comment": "Malware payload (Mirai)", "value": "8952b6b266f0883037bd8a5c2d881e81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344734, "uuid": "548ad984-49af-4767-b0bc-c852b481b118", "comment": "Malware payload (Mirai)", "value": "717afd051e5da8bda3f26ebb733732c8f672db20b544aab2d23e924dcf9f596a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344734, "uuid": "b84654fd-e164-4665-bf28-235fff2275ae", "comment": "Malware payload (Mirai)", "value": "1fd4e0f308b6a8aead0c4ab1c1a467e4d336f948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344734, "uuid": "4c6aa3ba-9899-4d57-b719-1a0c8e72fcbd", "comment": "Malware payload (Mirai)", "value": "ab9322de6d377f465c9208f7200fefd19aa12d5002f36e16c3d33850a63938c5b0f1ab4ded4ea1602e2698dad651d150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344734, "uuid": "6f8479ef-2d00-4f43-89bf-5e04ecdc8e3c", "value": "T182D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344734, "uuid": "62cc0138-416b-4914-8a1c-ad4ac520be8c", "value": "3072:JUFczWKNZhc3JiwmS74Hr2Um/u4SM89tkMb:DvNo2kKr2Um24SM8PkMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344734, "uuid": "d3d9840d-833d-4a3d-983a-5c37581b8d4d", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344734, "uuid": "995f7f57-8080-47db-9776-5359c0c84e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344734, "uuid": "089dc7eb-f785-4d0b-87c0-251e91cddfe0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d9267b-f98b-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769303600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303600, "uuid": "e4d5c452-6f97-4f55-82f7-93e51c8313a8", "comment": "Malware payload (Socks5Systemz)", "value": "3dd0c88e0b90fbaa63e2acce107f23b7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303600, "uuid": "915b17b5-2d9a-4dd6-8c20-0a916af4f440", "comment": "Malware payload (Socks5Systemz)", "value": "728f7487e8f3814e2de6fb15bfdf9c604ca4409ee51b030c05643d5e6d59bd5d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303600, "uuid": "4b9d8edc-4575-4628-93c2-035d285edf62", "comment": "Malware payload (Socks5Systemz)", "value": "aa25669af78cd6599bbf0f09c1ab81c68e881498", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769303600, "uuid": "df1f8dba-ce17-4820-8fd9-b67f1c1be4ad", "comment": "Malware payload (Socks5Systemz)", "value": "8e6b91afbb243b58e430e11bbc7cb35f471e0868c84dd02d2d4d92ff3b7f71b836e3230336a4971c631478854969dcf1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303600, "uuid": "f4b2a6fa-9f33-4550-ab40-2544b215a3a8", "value": "T19DA5331913F53ABAD762A73856F20263D3727CA5A73081EF31C9A5BE0B236D46031727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303600, "uuid": "3a8093b2-be38-4062-af2c-0e151b2de664", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303600, "uuid": "97698dbc-74b3-4b87-93bf-8a906cced93d", "value": "24576:UeQVHzvlSsQ21ivDN7NsR8s5/gAVSN45tdO9MFs4ZdeuwVfG8Ibq8ro9ZKoSluYp:wpNQ2/8eVSNyeGS9GT+JwoSDy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769303600, "uuid": "97c99e51-d870-4480-89a1-90ea27abb234", "value": 2131968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769303600, "uuid": "046df145-effe-4105-a5cf-ec49f75d73ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769303600, "uuid": "96074de4-0751-4675-b58f-08bed12efda0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539ca962-f9f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769347962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347962, "uuid": "4090066e-e417-4ee0-9074-507d0aa6e28f", "comment": "Malware payload", "value": "a92266c09a476a78b49cb3f689bf9dae", "object_relation": "md5", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347962, "uuid": "f68db26a-0f09-47b5-8d0c-10e42895fa2d", "comment": "Malware payload", "value": "72fc71220d6ab82e677c478b5e3c381362db5458d4db2b5a67c79b6166919ea5", "object_relation": "sha256", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347962, "uuid": "58d34245-e01b-4578-b0f2-0f22f9619cb9", "comment": "Malware payload", "value": "899f0b6f294142acaa5cec1e2b15dc01ad61f9bb", "object_relation": "sha1", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347962, "uuid": "3d2aabfa-9562-44f0-b219-b7ead095a2f3", "comment": "Malware payload", "value": "e782ef0f3feeb504df04122015d7b6656cca60a90e1f5fb61044acca31e30e674b714620cd63786b4eb6a3ad4f417518", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-103-250", "colour": "#1F18CE", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347962, "uuid": "a9c4cddf-6a5f-47eb-bee3-4682c5907156", "value": "T1B63733456FE4DD837B2D7639B325990D8C86D02194A757B884F82C780CCBBCE53A747A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347962, "uuid": "afd8158e-a1c4-490c-8fe4-90070069b7cf", "value": "393216:M4cCf813cajLrubznYiNlBN+AnKTL3hhaqraHHIAGL+TNEgiI0qCt+zipJRIflvi:i+81siLKbzYKBkAnu3aqrKTN6IAiip3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769347962, "uuid": "d3dd8673-8444-4061-bfa3-1b21a5219d1c", "value": 23927155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769347962, "uuid": "7a0357be-5215-4ef5-bda5-ed35601c92d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347962, "uuid": "bbedc7ec-aae3-4421-81f4-a6b82f9a7313", "value": "Setup_1769280965352.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6cc518-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354477, "uuid": "9db2186a-3ef7-42c1-ae31-b0e79ae611c4", "comment": "Malware payload", "value": "ab1c4e6bca079453bdec78bc0edd5559", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354477, "uuid": "5cf01557-03d7-42af-bc55-24fb1f814e81", "comment": "Malware payload", "value": "74ec00e247860746adcdf7ae8c066b70b0f4631012e494fa44c51b5584962675", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354477, "uuid": "e801c751-9242-4610-92a0-401a93a10979", "comment": "Malware payload", "value": "ed7351cd2d93fb34e7aeb14b3aadda33025f2cf0", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354477, "uuid": "00b75c0b-9e9d-4288-8fff-f345518fe2fb", "comment": "Malware payload", "value": "bdc97db7e45b8d325d79b86529e6359e2e6e9c66b3c3bc44c0e7bae382391c0a61f17f2334e539c01051201bceed9562", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354477, "uuid": "7e631a27-e6ff-4a0e-8f67-873fa052894a", "value": "T1FCC080FD5916815154C9C49FF12224204876F1F0725E7C329D9D70410B055B41493C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354477, "uuid": "03d176a0-20b9-47e9-85c3-553b0fad006f", "value": "3:Fvsa3LWeR1UWRvrO2jnhhLGOtjve5CRViEDjNVHyoQ2ofeTYUWAJ5tzMFvn:FUNO1UWZdGQLbAEHN4v2o2TFJ5tz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354477, "uuid": "9d3a7532-1aea-4e1e-8e1f-b0ebe09d513d", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354477, "uuid": "0ec37627-1887-479e-b3b8-a1fe5012e04b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354477, "uuid": "39df1bcc-adde-4335-a291-5b1bfd823a16", "value": "Y276115399.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9e21e9-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354581, "uuid": "d217203b-6715-44e3-8637-1d12eee3316d", "comment": "Malware payload", "value": "c8ec46425f7e60c946aa0c2a632ecbfd", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354581, "uuid": "1efa97ac-0401-4091-b187-9dcc204c49cd", "comment": "Malware payload", "value": "75750330391203ac44bbe34c2010ec6f33b34bec9459d1f2a8d85c284c7893d6", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354581, "uuid": "055fbb9f-310c-485d-9a14-c1e6fff1f5f9", "comment": "Malware payload", "value": "fb8edfb315143988fe319f5a8f0724325de6b768", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354581, "uuid": "827c15b2-c616-4472-aa37-e40918050f7a", "comment": "Malware payload", "value": "341bba12c01d9c7e1619bd76116747a27386e1cb418c7638c699736ecdbcc93b09fd2e13c2189cca847da4c1458e910b", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354581, "uuid": "d1bf75d8-66bd-4547-bb7d-50b4330503d7", "value": "T1B9157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354581, "uuid": "61cd62f0-820c-4f7b-8293-cc598e4d45f1", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354581, "uuid": "9379b425-1341-4af5-bbb8-7d2376d6244a", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6WG:d/QMnl5YL7WzZyQRd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354581, "uuid": "ef66806f-75dd-4821-82a2-c168d2978f6e", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354581, "uuid": "a1c6a728-a7d7-438f-a2e1-76c20837f0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354581, "uuid": "274a425a-4bec-4e1b-916a-e39df66d55bf", "value": "Y497879760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d608f3-fa00-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769353949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353949, "uuid": "2d8ec155-ca13-4915-b4d7-e491e2715220", "comment": "Malware payload", "value": "20aa02584c7a896e46802a99a20d5fd7", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353949, "uuid": "13ec1e91-b2d3-484d-9226-4c9a33da85af", "comment": "Malware payload", "value": "75b302bbc5f4dadb983b696c112ca9bdf8de25b6ab534e6fd654eb519eb4a91d", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353949, "uuid": "1a73fad4-d3f3-49d1-84d5-ed7a888aa49d", "comment": "Malware payload", "value": "a032a17d4f9404d97bcb6c9e524334f6cf0b54ff", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353949, "uuid": "3efb094e-ac8c-4813-94b0-abfe17955a11", "comment": "Malware payload", "value": "9fdde704cc53feac2fbdef5d8a9e3a576f0b7e5fe9ca3d5d0737bb0e8eb1bb22347373ded5b8a56dd53f67bd8d601920", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353949, "uuid": "da0d0502-7a93-48af-b505-3b65d890221b", "value": "T1D6157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353949, "uuid": "94be4217-59ca-4a8b-ab66-bc619dc32bf4", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353949, "uuid": "b4f302fa-8625-449e-b179-b57b3748c236", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6WG:d/QMnl5YL7WzZyQRdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769353949, "uuid": "3c321f95-78cf-416b-80e4-f9012009def5", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769353949, "uuid": "f7b58f66-8d72-4d6d-8f41-67a3d2dd888d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353949, "uuid": "983778da-1a53-48da-a668-1fc8ad5c030a", "value": "Y171423869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadf4883-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384697, "uuid": "11482f20-7244-441f-a340-fed8d18b57b9", "comment": "Malware payload (Mirai)", "value": "a8502ff52ab2ccbe6d8fe6476fcf931a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384697, "uuid": "f7f1363e-fe73-4b28-a80c-c809913f60c7", "comment": "Malware payload (Mirai)", "value": "75cb064f489b12d4130786e1aa6963dfa2fc9de82b8d3b2150385ce9d65d27dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384697, "uuid": "5a76ff05-6142-4a95-8880-5176c5d6d3dd", "comment": "Malware payload (Mirai)", "value": "99dd27682d1f8bca1e57ae94b83f4ac433d757e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384697, "uuid": "0f100a97-57cb-4c84-879d-75b28b8b2a93", "comment": "Malware payload (Mirai)", "value": "36ba95f367dfa08741dd1974d09a0bb1d62766dec7e964e03a5d3d9a2d01d017e558a11084f9cb754be367d4c9958a5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384697, "uuid": "cbf8b6b5-df8a-4f3f-81ed-70d2af7ce9c8", "value": "T106436CC9E683DAF5FC1605785073EB765EB2E03A0068EF42CB649936DC61A60E71735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384697, "uuid": "51f6cf74-ded6-4aea-a974-ce4fb2b9a364", "value": "1536:j8dgPfbOn9ny6Fb1mFno2l7pLI37ZAcSG41omRR:A+7OnJ9FpmFvl9LI3VADR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384697, "uuid": "9ae455fa-ada9-4001-930d-16b75a0b5853", "value": 56720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384697, "uuid": "18c1e79c-9192-4923-846c-14b507929a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384697, "uuid": "c4be91da-7db0-4eb8-8909-7be729333aad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81654584-f9fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769353193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353193, "uuid": "889727ad-00cd-414b-b95f-c2b82ad3b107", "comment": "Malware payload", "value": "770960789fa9a9352d4bb12d494b67f6", "object_relation": "md5", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353193, "uuid": "dd1eabdc-ee14-4d7c-b4b5-e72086e7d917", "comment": "Malware payload", "value": "76308dfe1589e120846334322bb8b1ec22e276ceaa5b7eb93290dd93fd289d79", "object_relation": "sha256", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353193, "uuid": "15daf06d-b94a-42d2-9507-2cb28765471e", "comment": "Malware payload", "value": "b3e1b0b81a9cb111b98ee8fbd34756b56dce8857", "object_relation": "sha1", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353193, "uuid": "68e5314b-8306-44c1-a19d-32cc3adc1919", "comment": "Malware payload", "value": "9881055927d5f1491da08a3428dc196c8d2d6d7cbe788168c9cc7a3400bd70c6c1da81d002d9709be827dec26951c46c", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-114-54", "colour": "#4C27E7", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353193, "uuid": "24ccc20a-017d-40cf-a722-2acb3f6982e6", "value": "T1369633D5CAEA9364AA7BE973F3B8F34366670F61565F8D049B7C139F00CE3A80109856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353193, "uuid": "ddaed459-e602-4c86-a033-60fb6f98fcd2", "value": "196608:CrYJTj2czr3kHtistLu7kmZmkJ76hkN6fdf+hD9xYEgG3oDnB0BsI2QOx:7TjfUwsFat6h26fE59enWBn2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769353193, "uuid": "1140393b-799d-4f8c-805f-5bf74dae4327", "value": 9376287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769353193, "uuid": "5192d71e-ea28-40a3-b5de-543fde0fd398", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353193, "uuid": "b10447e0-bde4-4038-9a8b-a7bf01c231d8", "value": "Qt6Widgets.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9963096d-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361823, "uuid": "32048257-b0d1-418f-bb3b-d6beb5c02858", "comment": "Malware payload (Mirai)", "value": "2aba4ef861ef0e95ea64e0458f03ce2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361823, "uuid": "4a5cbaf9-4b6a-40d0-9df8-0489e83714b9", "comment": "Malware payload (Mirai)", "value": "76e2315c2ebd3ffb9162ec78bd657f5e82820c1aa0092b1b2d204cc2dc7192fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361823, "uuid": "9832ab71-6ade-4a55-89a1-9e1c7de5b934", "comment": "Malware payload (Mirai)", "value": "dae1d6e1f1223be73562c67d1db3644ff55ad9c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361823, "uuid": "4b402fb0-940a-44bc-b61a-a7af0879e858", "comment": "Malware payload (Mirai)", "value": "9cac1289804a2900231ef99e35c8136f3dfa1cc639ac2998e8850c40fa27255522571cf9b44d89d8172c332f065b5ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361823, "uuid": "7a20ee61-b3e3-43eb-b63e-445249cc1bda", "value": "T1EC935C11ED791D27C5C0713A51E34A31F5B643992ABC9A4F7EA31D9CEF18310312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361823, "uuid": "30ba85c6-3d76-4e80-8b92-39eeee5f0a51", "value": "1536:SL12J2Yg0ofKvmDdLlU6sCimO+DXtAet310e/nZ0FPleOEwvYdniv:SxDcoUSLljOsB10mGwOany", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361823, "uuid": "cc2ca52c-9e75-4d41-bcf2-b8786267de66", "value": 93872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361823, "uuid": "ccee7ea8-ad33-4a1f-a6b3-8bd20f65bb60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361823, "uuid": "f79301bc-ea8e-49c6-9b40-da5693de7d53", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb17bf32-fa0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769358524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358524, "uuid": "0e8ef889-65d1-4438-858f-607a81c9fd06", "comment": "Malware payload (Mirai)", "value": "eda3c4c5dbe9900539ee12fbaddcfc1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358524, "uuid": "11f27229-a6a7-4971-a9e0-dcfc9d4c5d3f", "comment": "Malware payload (Mirai)", "value": "7918268dda6967baf1313754f711484f98b10564698ce9f00a303a674f96c695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358524, "uuid": "6cdfde43-10cc-4a54-b1c4-de2a1b725914", "comment": "Malware payload (Mirai)", "value": "a5b2e78aab7c5e3fd97e2dbbc706c0df83950b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358524, "uuid": "7fe77b89-4b06-4b79-aa32-57d69e932dba", "comment": "Malware payload (Mirai)", "value": "41317bfeca8b66a41aeac47abcd7cee8a996bca3afadd9f3623fc0b9285fdb3cf3f6c060acba000754148563d188bd3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358524, "uuid": "b8d0ca60-1776-4743-b08d-a419dd492d90", "value": "T1D16302CB6DB02F67D1DCA171703815D9CC3AACC6E683869D93E1EB96073942364C8B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358524, "uuid": "5a91f1d3-e810-47a3-8d54-b49d92937498", "value": "1536:EaxZLmYKVDNSl2y08yumeJyGYVmIMGMNx:EaxZLmYKX+t08jmeJhYTMNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769358524, "uuid": "be249691-461b-4c08-a639-665cf7f288b9", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769358524, "uuid": "ff0cecbd-9d8f-42d4-bb88-78c112acfeca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358524, "uuid": "bd137d7a-b007-4faa-84f1-a8b6aa26fec1", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715b2695-f9e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769340281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340281, "uuid": "964cb87a-3ba8-4cb6-9441-f4cfc60c4211", "comment": "Malware payload", "value": "e4be95de21627b8f988ba9b55c34380c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340281, "uuid": "3d46e904-6178-4a81-ae29-a56258f1d331", "comment": "Malware payload", "value": "79569c91433c6e263cf48c8129023e5b5678fee5bdbdcb9a8075a412affabbe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340281, "uuid": "00dc6d0f-d6c8-45d8-b17e-d4592e9194f6", "comment": "Malware payload", "value": "a035ff1079359a9a550fa366a6177d9cb1cb99f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769340281, "uuid": "333ad6b5-4d8e-4c73-8050-6d527fa7f9bd", "comment": "Malware payload", "value": "323ab1292214d60eaa146531633e9d359f3ec551d1e53c9d06a50edf518b14a340e397f23af9ef2e3aa20c3a647729b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340281, "uuid": "56420803-2951-4106-b2d2-7a453cfe41d7", "value": "T1940146A97A918D06C82411B7F5734BDC330ED72AD21FBB47035189252E123EE9F18E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340281, "uuid": "28bdb1dc-cf86-40df-ba3a-1d2dadccb40b", "value": "12:BZuP/FTH8U+9F4T5HFzhZ8ND++cBNwu2HHgcsrvVx9mtNK72KIMVoO5+WvV:avGF2FMdLc3qHQrvVxCK72+qO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769340281, "uuid": "22ea930f-9e03-40f2-b330-19f533173d9b", "value": 764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769340281, "uuid": "bbc2d364-713e-4d54-8ca3-e95f7a3c8eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769340281, "uuid": "ecff4070-b7f9-4b57-86f0-4b08951f4a9c", "value": "installer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0fb3db-f9a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769315412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769315412, "uuid": "189a8887-5ead-4507-a1d0-6485473859a4", "comment": "Malware payload (Stealc)", "value": "588f54e7fc7a78414e0a8798c264b3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769315412, "uuid": "d8c4ac02-3208-4d32-9909-a2bf92d06b69", "comment": "Malware payload (Stealc)", "value": "79be87ad14b473f6ca727969014fa8cc27a8020200cf653096b6f77a0b331502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769315412, "uuid": "48ebcc8c-55f1-4be9-9f91-946ca5152e29", "comment": "Malware payload (Stealc)", "value": "3a6ff36b4bd649cf5e00ee845871830ad8b03ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769315412, "uuid": "e5a46f4e-5edc-48ac-9a18-9166021fd4c6", "comment": "Malware payload (Stealc)", "value": "590cdfb8a711c834fbbf5cb824eefb3014448e5254d8bbf1be4f0bf25f6983f306e8c238e1f74825b194ca9ca4546c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769315412, "uuid": "81a09bb1-2cdb-4cc7-9f22-1ecdfd844a57", "value": "T13C058D5AE7A602F9D0BBC178CE424553E7B2B8155770978F03E14AA61F372A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769315412, "uuid": "1ca74841-8bb9-4288-90e5-11c4f701e99e", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769315412, "uuid": "b4e4fc44-a7c9-432e-9666-c3e4662d5c78", "value": "12288:IU8VHX4ZPBuvzkOkW7UE+YTRqwJ4FfC6ALSQTbAK4lVA:CVH6BuvbkW7xXVVmFfCzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769315412, "uuid": "1b0f6307-769e-4ed5-840b-4621e1df10c2", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769315412, "uuid": "6c46c0ef-e525-45b7-9d07-70ce1200bf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769315412, "uuid": "ccdf0dda-e072-4dd0-bb25-586d76b03738", "value": "x79be87ad14b473f6ca727969014fa8cc27a8020200cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e630cba-fa20-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769367684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367684, "uuid": "d1945314-abe1-4554-9bec-c2e39edb7b42", "comment": "Malware payload (Mirai)", "value": "a052a17a4805ccc0f755268430a08bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367684, "uuid": "f291f214-52d2-45ed-96f8-df6bf1c1ecae", "comment": "Malware payload (Mirai)", "value": "7c931fc87eac6027271450a7a2bc6eec21e337c429e844dbdd88bcb27dd2e925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367684, "uuid": "114f5f83-5886-4750-92c9-c8d33d7d6345", "comment": "Malware payload (Mirai)", "value": "59c82ed47772940ad612412bb809d30b05b2f8cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367684, "uuid": "d2a05a41-b241-4d3b-9408-f5a820acc802", "comment": "Malware payload (Mirai)", "value": "202444b71e0429deca64ce03ffc3af32d09724b08df6b0768ab7be53b1d863c5e3222a4f27ed5f3dcad14dd165abf538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367684, "uuid": "9cbbe0cf-4ec6-42a1-87ea-545e08edc56a", "value": "T1F87302B22166DEA2D5B2C03263477D5DBD328C36037452BEBC7DA72EE486E145C4C94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367684, "uuid": "17c0a718-6852-44ae-8cae-874adf1e91b2", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmm3orf:8zRnwP0bMQ2RijvDZZ1rYGhG13wSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769367684, "uuid": "2f0c61a2-711f-4483-a39e-ac6c03c70bf2", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769367684, "uuid": "edf61c86-8a5b-43c4-acc2-2d57b5416e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367684, "uuid": "9b9a91f8-0784-47c0-b243-c55a6fb77416", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83926c07-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384121, "uuid": "be6a68e9-6f63-4c98-9a59-028c43a73185", "comment": "Malware payload (Mirai)", "value": "a055fbb4927b0cbf257d92918589cdf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384121, "uuid": "41acad1d-465f-45f8-b9bc-f89a11b93dc1", "comment": "Malware payload (Mirai)", "value": "7e00f77027719cb9765deb9277c19d8b40c88b46615260ad93d0afb886823108", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384121, "uuid": "1ace845d-4998-4697-bdec-68580caab06d", "comment": "Malware payload (Mirai)", "value": "92de85daa338d800a6aee870ac066ebb8354f385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384121, "uuid": "6b9858fd-e1c4-46bd-8402-de2d9968b8a6", "comment": "Malware payload (Mirai)", "value": "6e45cabf365b05c03a41b9fa7c63d08426ca4c1f9dd86035a5496150f3164339d00d90b243cf6831667cab4d49bdd877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384121, "uuid": "2fdb7949-043d-4c17-a216-b9afe63f7ab6", "value": "T12693178ABCC5C702C6E060B6FB0F658E375643B8E3E6B1478D196F29634F8970A37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384121, "uuid": "3dd28ed5-a012-4fc4-b9d1-df480439c08f", "value": "1536:fdOiz2q08jcvkV7Uv8+4ByCG0MDsR/Sl2F2PBAjY2NC5beKvBaqDVX71NX:fdLz2v8NxUasC5MgQl2FLj25b9lDVX5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384121, "uuid": "db24d1c2-d6f2-46df-b725-e055262ada81", "value": 95796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384121, "uuid": "0e9f3985-d18d-4c87-a556-54336fc565d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384121, "uuid": "2dc83c36-c960-4a3c-8399-d2ef8590a50b", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d8d422-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769329949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329949, "uuid": "38ea43ea-3b5f-4fbc-a8a1-2eb2b5f452ab", "comment": "Malware payload", "value": "846a9253c6a4f241b210a2ccf630b43f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329949, "uuid": "74e7a9cc-95d9-467d-964c-c0aeab46ac92", "comment": "Malware payload", "value": "7e90d6ba18a3be40de5d4c65e576b21b037f0ecf89bd5d0e7f2f0dee1c2c42f0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329949, "uuid": "fb425352-8b9e-4850-9645-a59c53e189e8", "comment": "Malware payload", "value": "8f2ff2548bf4104133a0e49db40cb3b506c1d607", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329949, "uuid": "8db63630-1da2-493e-ba6c-1f1a1f6495ee", "comment": "Malware payload", "value": "a582df3f692c3d9baf5e85b58817616f7603fe6c6b0d5aa9e8d4f12c2dd4df7627badbb4448e6d282a5f4f12b502b88f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329949, "uuid": "d6bdb961-6650-4858-8af4-6e804efe8903", "value": "T1E0C73331B2767995D61F53BFE0A85FD840307DE1B31BDA6B63783FA589B064260B2903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329949, "uuid": "f1451510-2adb-4655-ae42-7be2852baa78", "value": "1572864:DgelxO5dafIXLv7f9mgv7P/a+wRN/axIV4Jo/IZe:DxgyW7Fmgvu+MNSIVabZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769329949, "uuid": "407d2d57-354c-4d11-875c-3d5e82267000", "value": 57361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769329949, "uuid": "545a7417-99e5-4847-ba95-d51812fba604", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329949, "uuid": "b743fe91-114a-4a42-b4d3-7070553631bd", "value": "PotatoI\u0447nstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d4bd9e-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302362, "uuid": "1478a34b-691f-48e3-ae06-38c98e354be6", "comment": "Malware payload", "value": "5e1b995cae7931602c55c55a103d1569", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302362, "uuid": "754e47f7-a014-448b-bcad-d920f115dad0", "comment": "Malware payload", "value": "7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302362, "uuid": "7270a7cd-1a0a-4f09-84fc-460de8de2276", "comment": "Malware payload", "value": "c91cbbd985999815927ed0a6be5c644efeb6987e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302362, "uuid": "eb689e4a-46f5-4299-a6cb-622a85455347", "comment": "Malware payload", "value": "62143f83b134b7144a24fc13fdf7c775231f215795303c8886966253ba685e6ee3eba9b5912f198d8946aed1edaa2342", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302362, "uuid": "dab82528-3537-4330-af02-9e275c97a2e2", "value": "T18C614DF9BA70A130B2084DECF025D49C7CA358BF11702B351CEA9DB1C3AD96C915667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302362, "uuid": "e693fbb3-1a88-4642-ad79-ec519938ad17", "value": "96:vi3vCBy+k656LGn92YZCBAf7ZV3q4jfDi:vi3K0WZA2r8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302362, "uuid": "acc4386f-443b-4f1f-840a-ec931b2a33e2", "value": 3282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302362, "uuid": "6fa051d3-adce-4f5b-a167-d2d70352619d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302362, "uuid": "5a2695d0-29d1-4791-bd42-decb16df737d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d7e54d-f9f5-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1769349305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349305, "uuid": "12d35f8c-d905-4949-bbc0-2afac712c1cf", "comment": "Malware payload (EternalRocks)", "value": "592e60e7fb8cd3146243e6b5039beb94", "object_relation": "md5", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349305, "uuid": "f68846ed-fd1d-41b6-81f4-f3e96418bee6", "comment": "Malware payload (EternalRocks)", "value": "7f0c6f729fc539e2ad0498af133d98c43843036c381e9d21397370eb6c5795ba", "object_relation": "sha256", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349305, "uuid": "663f59b1-bba2-46c9-b31a-7ed5aa0d3ca8", "comment": "Malware payload (EternalRocks)", "value": "96a5e45336216280051a878287ccd81d156e9b9e", "object_relation": "sha1", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349305, "uuid": "b6ad2de2-a535-46a3-ac3c-1645d33c26a9", "comment": "Malware payload (EternalRocks)", "value": "80556b1112cf679f6807618beed3a53e1280456043ada62a40c30e838263d1e71c22abb45439f22572e766f23bca6b8c", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349305, "uuid": "38dd7eea-a335-41c8-91da-f268dd912409", "value": "T1B4953931EE37C9431681E3F2DD8B94E8DC70A7BE51D263E839DD84B460A9D540398B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349305, "uuid": "33aa1451-a3f2-4207-a753-8ce7edf7d2e3", "value": "12288:F41E7+f54DwfXHkcA4nbXGQo2+dgi+gHZijZwLKly+eK3M65YxOQv:FW4Doq5+iqjkmy1K3M65YxOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769349305, "uuid": "5b137fe0-65a4-4e8f-9759-b9fd037dd394", "value": 1974225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769349305, "uuid": "5c7a1f76-342f-4c67-8dcf-b0de012ac3e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349305, "uuid": "1e36f197-4e02-46d9-b624-b50927a706e6", "value": "dn9b3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38ac0eb-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333547, "uuid": "24a4be12-8a45-420f-b324-1655ed7dd51b", "comment": "Malware payload (Mirai)", "value": "b5027a9a2a90d3dae028d2a3c066231c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333547, "uuid": "75530e26-958f-4de4-83dc-75be3a1dc00a", "comment": "Malware payload (Mirai)", "value": "7ff00b8d828ceec40fe464278c85692f8cd041b883b7d69ceba7cee471c895e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333547, "uuid": "6713d8e1-3298-4533-885a-df4e4cac3a12", "comment": "Malware payload (Mirai)", "value": "f189f44faa502b32abb657b3ca0ac34aa50718b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333547, "uuid": "ff585521-5dc0-4dd4-a4e9-d5fe60493c86", "comment": "Malware payload (Mirai)", "value": "98da47447fa8dce998b7df7c76d25ae3d72637efe140e467880b0ffa4794568f2aa81a2832fb43cf662657f451e92b1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333547, "uuid": "b43d8468-2761-4f10-98c3-ec74068a58ca", "value": "T1EE23194232184F47D1932AF0263F0BE093AEFD5528F5B585B61EEE858631EF61046FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333547, "uuid": "3a9b8ffb-d3a0-40db-aa20-c273d8df4703", "value": "768:X3hZAxK3qjcWCue8FrqsRYr/ZBJYDNdL75o8WyMHoYuS/o3uN:hTqn5e8Fxq3nuS/o+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333547, "uuid": "53c5f08a-fb34-4508-aaf0-b913dbba2312", "value": 49920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333547, "uuid": "4e7a0985-c08a-4a99-90de-d19618543543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333547, "uuid": "4a03d1f1-cbbb-4dcf-962c-2fc698f6c9c3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31b571c-f9b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769319883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319883, "uuid": "904afecf-6e94-4d9a-ba80-9b73132e3a74", "comment": "Malware payload (Mirai)", "value": "43ed842a3910a7942e3f9e08645ddcac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319883, "uuid": "fb249a8f-67dc-4703-b060-447edffff8f4", "comment": "Malware payload (Mirai)", "value": "802a740ad6db8f4edcefc09af6ce110909efe6f2f797d4b76b799aa1e5425de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319883, "uuid": "f990829d-395a-4fa8-8ea0-330ecc978469", "comment": "Malware payload (Mirai)", "value": "2cde44fdd34352281b7b870e73a3bdcd6fca2a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319883, "uuid": "89d74f75-0984-4cdc-8939-b65e81714815", "comment": "Malware payload (Mirai)", "value": "b0c2d129b84cd5a7b6c0978a4d63618915ff4ee050838a76b18f85d2510ea54ba76212c4b6dfd86770b7a6e3c419cbcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319883, "uuid": "49f5d43a-e858-40a4-a3da-223187f14dcb", "value": "T1C563029D917A5221CC72FD76C2A00F2204D395D0AB9D4BC4579C0289AB93E89FE6F17E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319883, "uuid": "44e5cfd9-5616-40d3-b682-125ec890bd01", "value": "1536:pl2MD6ZjqScs8p0KWPkT2fOmfyGdmktnKbQr:pl26PWkTiOUlgMnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769319883, "uuid": "9cd9f4ae-6a0c-431d-b2c6-86d2e444919d", "value": 66828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769319883, "uuid": "69c79b39-3292-4f7c-80c1-2f71123046a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319883, "uuid": "f7fa84f2-4365-434c-a399-faac609c5965", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4868f206-f981-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769299410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299410, "uuid": "88da97bd-af30-48b3-ba15-3ca3d0e4a4f7", "comment": "Malware payload (QuasarRAT)", "value": "5dde819ea19ecf36ff190aceb1b1dfd3", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299410, "uuid": "0c2292a6-37e2-4160-bec8-c7998249588b", "comment": "Malware payload (QuasarRAT)", "value": "81dc1d3eeccab2a4633b180fc5640b674af0209dce23c8414be30c6697d5cf3d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299410, "uuid": "6ae14e43-ca06-4268-9a11-1532f00e0fd7", "comment": "Malware payload (QuasarRAT)", "value": "2debdc1bbd46219cbcd33ae26176f71c3a0cae56", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299410, "uuid": "1bf634e7-056d-4881-8ac2-72d45a9f0cd5", "comment": "Malware payload (QuasarRAT)", "value": "3f912edb5d1ca5021cde9cdf9a6d6ccd9f54241eba7ae0f2e1ea0a84b70b89a555a032f8b020a0ccab5d8e188e4db6d9", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299410, "uuid": "e9ff46c5-c15c-41c9-b0f6-e320469ed03b", "value": "T18CE5591537F85E32E16AD773D5F0501767F0F82AB3A3EB0B219167BA1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299410, "uuid": "f025f8ef-3ff7-4292-b705-e691c45e2a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299410, "uuid": "192feb17-394b-4544-8f0c-b5e50beac5a8", "value": "49152:9vziUE2B8ai8u+PklSYFA3VAqRMqcybp2NIek/WCoGdsTHHB72eh2NT:9vWUE2B8ai8u+PklSYFkVAqRMjybP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769299410, "uuid": "170d0f03-0352-459e-a770-c9fb61bbad84", "value": 3268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769299410, "uuid": "b5cc23c0-b5e1-49e8-871c-2da6cb7e49b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299410, "uuid": "0e8f2345-edfa-48af-8aaf-21b79dd3ef40", "value": "PSSImperiumStrategic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f040ebd1-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354668, "uuid": "56683e6d-b62d-443b-8278-e051dc4f23de", "comment": "Malware payload", "value": "7a8fcb5883e29d17bcaccbee187c4166", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354668, "uuid": "9b5e326a-05dc-4ddb-95d0-e8dd40d97597", "comment": "Malware payload", "value": "8220f8f18c4321c3759b301f42676664c1b693eb567a1d69bdae7d5cadb5efc3", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354668, "uuid": "8325f62e-d4ec-486d-9c66-3c5d28b184a2", "comment": "Malware payload", "value": "a28e0695cb4ebd344ccce12813937cefe2236406", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354668, "uuid": "5d117dce-b1b4-4166-86fe-86938daffa26", "comment": "Malware payload", "value": "eb9a1d1a2f8155304a1876050ccbfcc8ddb9715c0b89c84a488ac47439fc0d576c6b59c9757eead01854f979bed4d8b4", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354668, "uuid": "b6d6a058-7af8-4e1f-b8cd-543e2fb9d205", "value": "T164C02BAD0918C91108C11DC2B05274608CF1E3D07145B06008B970C14F4A95C34F5C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354668, "uuid": "b6ee545a-b484-434a-9970-b115aa1fc25e", "value": "3:Mu6vsUSKQ5QgUmP0qYGRXkZiEDjNVHqKpAtzMFvn:96UUOhUmbYWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354668, "uuid": "ce083087-53fa-4cbc-83ba-25078041d98c", "value": 139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354668, "uuid": "3fe0741d-8e82-4641-bec7-70f6c1b6cd0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354668, "uuid": "2afb15db-2a76-47bc-bc19-6752d6c84ed1", "value": "Y822511248.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615d9ada-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769330806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330806, "uuid": "b02928bc-07e8-4a47-844f-6858dd2babdb", "comment": "Malware payload", "value": "925a6f50a9a96a1ab46f7dd2da91728f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330806, "uuid": "efc4f9a2-5445-424e-80ab-0437d7bd1b36", "comment": "Malware payload", "value": "83e2807a626a92a426210dc39045769e700340678c67e5e39ec39441d9f4cbdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330806, "uuid": "1ce44209-e557-43b1-b3b8-d918a392772b", "comment": "Malware payload", "value": "1360f42ab34e5e4fb54eb7e974962ec0bdd95a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330806, "uuid": "f6a2cb35-6a8a-4cd6-a188-1db4f1db145c", "comment": "Malware payload", "value": "98225aea730f910c48b7bb0f39915f44dafa393a27050bd6f7ff9ff86f665160375efb552a24821b861cc7cc09eca139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330806, "uuid": "d28cfea4-a9f2-4048-804f-a5401a721039", "value": "T1AF53F9D6F4A38B57C4C917B7FA0F8B563B274395E39F3A138B188E34268750D8E25A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330806, "uuid": "27e2f217-dd68-413f-b628-dd058ad22776", "value": "1536:t4+LOuhe7k82x6+/zDE/KrMnqZ9OjFz60C1W2KD8T:9LOuh02xHCKQnqZ9YfMXKgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330806, "uuid": "852b5a3f-115b-4bbb-b7be-ef2faf497aee", "value": 64326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330806, "uuid": "17d80f50-c414-47b7-bcc2-0666487ea7d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330806, "uuid": "97d99b09-7ac9-45e4-ac4f-d71ea1b4e3d1", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2d1c83-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304386, "uuid": "2384eddf-9d83-413a-97cd-f8be42bef5f2", "comment": "Malware payload (Mirai)", "value": "bc0fb7a77a1f160295a2e048a7c4af69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304386, "uuid": "d5cc900f-6172-4bea-a598-7aaafd7a0ae9", "comment": "Malware payload (Mirai)", "value": "855477132b0e716426db7b8aa1ee0a9663f721d5f38efcd08bf55252a3691673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304386, "uuid": "e6aef0f1-8589-48cd-8cd7-2723458159bb", "comment": "Malware payload (Mirai)", "value": "52f103908acd7df79ee1898d5d78864669598791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304386, "uuid": "e2883a6a-dc45-431a-96bd-04848689a261", "comment": "Malware payload (Mirai)", "value": "2f7e50f976e412d1c86a5e8572f8078f2fada32df968d60bb4adf75ee0e0cc79633c09c11cef78f38be4b5df2981e85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304386, "uuid": "a7098f5d-43fe-42d0-bd66-0f31ef74af43", "value": "T157633947A64550FCC198D17843BB7636C863B47D137EB2A63BC8BF1B294AE605F2D40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304386, "uuid": "ce7c5bf3-13b8-4ad5-b4e7-ee36e32e8e10", "value": "1536:GZ9CBJ9BdpojMJ2yFRPMMCajVLzhCi20hZ0j25s0zLmju:pf9BdpAMJ2yFREMj/CiRb0y9Lmju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304386, "uuid": "20d3614d-f405-43c3-9659-bd84594842a2", "value": 67360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304386, "uuid": "5282a216-2666-4f96-b0d1-965202eb04ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304386, "uuid": "9219a158-3d09-4916-b021-beab153a0af3", "value": "cosmic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc04a90-f9d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333939, "uuid": "cb82b63c-7792-402d-9376-87e1e24f065e", "comment": "Malware payload (Mirai)", "value": "1951577effc672e7ae2d5f4c2a123a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333939, "uuid": "cfd18cbc-7ff5-4c1c-9968-8730513c1c97", "comment": "Malware payload (Mirai)", "value": "858cd2dd84548b533e3a3a3a21f43c927746a20ffcf5204e997d7c4f68e86818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333939, "uuid": "4fba0030-04eb-4757-90a6-86ba2528af67", "comment": "Malware payload (Mirai)", "value": "8251ca47251ca0fb9d46a42357f606ad14823211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333939, "uuid": "4ca7779c-b4cc-49c2-900d-1963a60cd7b1", "comment": "Malware payload (Mirai)", "value": "b7704d908b20d0c570e75d5586e5df43aabcab385c61ea99554488a5bc702ef793fb64878a0d951260e2e0b17f96d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333939, "uuid": "a32c421c-d5fd-4d37-8e6f-8b7bec60fbf8", "value": "T18FF45C06BF405FEBC0AFCD30492EC35715E9E9C796D1662A71BC8B9CBA5D21A0BD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333939, "uuid": "ca0612a0-d619-41fa-acef-f8d0bc526ba8", "value": "12288:+ONblOWYtLHtMphnfvin8DjRiH52ApzQ555jLleI56zkZGjclY46HhFA6XtF/zSI:etrGXtUzvzJV6F2dEko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333939, "uuid": "970824d9-427d-459e-a65c-f447f25937a4", "value": 749576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333939, "uuid": "7e41cba0-a01b-4c5c-aeca-54fcb9402fb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333939, "uuid": "b8ca7ba2-a34a-45d2-a427-d8966a261e19", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857a1342-fa03-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769355347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769355347, "uuid": "b3717789-5fdc-4c85-a23c-4b4ef3f9a213", "comment": "Malware payload (Socks5Systemz)", "value": "113687e547a5f3486c45f2e6609f3e6d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769355347, "uuid": "866ea8a0-51ff-4b7f-82c9-6ca47a7a0dee", "comment": "Malware payload (Socks5Systemz)", "value": "86fc8ba7b690df0debaf2ad1a4ac923f2e551aec3c12ac2fabd577c5bfc24f0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769355347, "uuid": "4a178b8e-d337-47a2-9a9a-0a52c69e3ab3", "comment": "Malware payload (Socks5Systemz)", "value": "b76d7149052ab6d40351d7cc4a9024b541d0b582", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769355347, "uuid": "a88e31ba-d7c9-4922-abab-ad2dec2727c7", "comment": "Malware payload (Socks5Systemz)", "value": "e06be8b2d99e5d6abd05401773343c74b2e65c7a48fe4d3959b2249990b328b1e3dbd8fa2529d7b2a5d5cfc7c4f4ca60", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769355347, "uuid": "142bb317-4a48-426f-bbe7-9d77dbb3ff3f", "value": "T145F533820CCB593EF881D7342E375946903B2C4A4D3D62B03DAE0BCC695F75D7A66B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769355347, "uuid": "ee08af00-1be4-4c02-8a20-01aec55118d5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769355347, "uuid": "164ed4b4-98eb-4976-b6ef-cc08548f2075", "value": "98304:M5WcNtBSW5lY7YXr4i04qepvyb7FoAX4tN:yWcNtYelY7EcOqbRoAItN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769355347, "uuid": "e4ccf5c5-599c-4087-9637-7f8be588d721", "value": 3451259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769355347, "uuid": "68024ece-85e6-494d-9b2b-9f0b38a822a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769355347, "uuid": "762ae42b-f08b-4deb-b02e-dd168beb8c3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63157906-f9d9-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1769337251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337251, "uuid": "9d8fc87c-e5e7-460a-88d0-a46b08653976", "comment": "Malware payload (RedLineStealer)", "value": "3bc900d370b1c515dcbe1bfcedb1d8f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337251, "uuid": "89d811f2-cbe5-4435-ae2a-30ffe9b495aa", "comment": "Malware payload (RedLineStealer)", "value": "870e41eb597ca0cfa7bf5dc29166e4383aa9f4e973912364e13735a94fce8a44", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337251, "uuid": "8de72d6d-8bb1-46c2-b227-51cabc2525a1", "comment": "Malware payload (RedLineStealer)", "value": "5f44336e48f63d985bf83b95761c1cbfa22519ac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769337251, "uuid": "27de7cb1-6a77-4527-a7b0-e51022c1581f", "comment": "Malware payload (RedLineStealer)", "value": "7f142134a6c4d3ca1227eb3681b7b41fef8c4a587a5cb3923ee2c37defbc047d5ec02af343dd78f19eaec3e3be39d389", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337251, "uuid": "ce077e0a-d281-44a3-b762-49ae519d2c61", "value": "T164248E21B9928433D5AB097498F9DF79893EFC510F7169D763840FBE89206C1AF34B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337251, "uuid": "57df43e4-9688-40b6-a241-bd65a1277193", "value": "59f37c13d2cae7cc547b602d07aa7033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337251, "uuid": "ec9908b9-60fe-4a12-b7a9-f16ff4266f24", "value": "3072:7WrSZbkCItYBenSORiJSU18U6aSTBY6SfCr4KRa8hfHmu/RgaaAJXxtu+8l:7WokCItO6iJ5PI2b0ta8RdJXDuJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769337251, "uuid": "b4b7ad84-7e83-4339-a321-783f102ce577", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769337251, "uuid": "68e9d76a-03ba-49cf-834d-61ef1f3f1d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769337251, "uuid": "efa52566-0eb2-4409-bf28-b55cff7b30f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da32d8b9-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304379, "uuid": "796d8881-0e9a-4084-ac22-67f31db7f1a4", "comment": "Malware payload (Mirai)", "value": "5140a05fa62ffe31444a5cb9befe5b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304379, "uuid": "ef6c9b17-c7c2-467f-bff3-c41d9813429a", "comment": "Malware payload (Mirai)", "value": "882e8f68394ceddaaf694139513559f768cdc16deedab2ccc041465f55116709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304379, "uuid": "bbddfa80-d462-4ec1-bc79-909193cf92ba", "comment": "Malware payload (Mirai)", "value": "48146e35cfe4359002ca44d8f1e9f4d9c588430b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304379, "uuid": "433a20f8-354e-4346-9dd4-73f74cfdc106", "comment": "Malware payload (Mirai)", "value": "451dccff76eb3462d1ce0c16319e52214895159baba5b70112b9213f6d15ab2c134f0dde04fb83f0e2c2e45870c01257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304379, "uuid": "587e51a4-3ff2-419b-82e0-cf68dc528e92", "value": "T17A83A54D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304379, "uuid": "db5b1e47-4e22-4c46-9a16-8d63b46c5690", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+6:N0bY7lmZH0iL5iNl5GKjVXz36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304379, "uuid": "669049d1-0850-407d-9152-6d5abc6997f1", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304379, "uuid": "6b0a126f-144f-4b54-93dd-dbcf2dea9440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304379, "uuid": "aeae8592-6a93-42df-8e89-8e3b568d9a53", "value": "cosmic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7514edbf-fa49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769385385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385385, "uuid": "b78acc22-3ca0-435f-a3a1-2700ed5c6aac", "comment": "Malware payload (Mirai)", "value": "5a8d11e8037720fc236f3e23b24234ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385385, "uuid": "7547d370-7d83-4b25-8be9-1d9c1d6d19cf", "comment": "Malware payload (Mirai)", "value": "88e63dfeca5efe7db364bce1b8b5b75701e7ffb2deba8f6fca954894cc98a91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385385, "uuid": "7bf8549c-aeec-45c5-93b1-30356c267a08", "comment": "Malware payload (Mirai)", "value": "7d72dcf095f2ff24e7c2d127e00082a6021f89df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769385385, "uuid": "7c43e433-c233-428e-a92b-48cc0e8caaf3", "comment": "Malware payload (Mirai)", "value": "43e8bf3b3e0a83112df2c6bd6ae9cef94aba53c0643425ce882b1cb6604daf3978ef01c9224c1123f4e79337e0d50d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385385, "uuid": "1f9854d4-4e48-41db-8403-680ffbbfcfb1", "value": "T1B6933AA2B410DC7EF45BE7F780570A16B221A3E44E426F27B627BD13EE2E1742852D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385385, "uuid": "b6bae39e-5a4e-4105-a703-6a83c4606c30", "value": "1536:OhzzDqIJR0e+6+6ngAJuWgfFflS+emyuWmkWWOYPZeX1Fp48rpz:OhzzDq65e6ngmuWkzEFJMYYX1FDpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769385385, "uuid": "ba250e4a-0500-4807-8d8a-8b27de656ebf", "value": 92596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769385385, "uuid": "823330ea-ff51-4363-86e1-4241b8257697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769385385, "uuid": "c60a0343-fa9c-4146-9e1d-f7574d00383c", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2f3020-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304359, "uuid": "24a788a8-bfd7-4a06-9810-60ad8f26a870", "comment": "Malware payload (Mirai)", "value": "743308107ab21f0095d6d56fa0e61c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304359, "uuid": "9c82cc4e-3eb9-442a-be14-89f001c8b4a5", "comment": "Malware payload (Mirai)", "value": "89bfe8dd59bd141f8ab28958806c2e30503af4d740a7c2de139b516d4bdc54ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304359, "uuid": "cb57e817-b05d-4e6b-a099-ffca87c6a342", "comment": "Malware payload (Mirai)", "value": "2732d595d2ff2ef1d46a7ffaa3ec6fc8b158002a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304359, "uuid": "651ed6d8-d7c3-4b83-a3f6-a88a67c9fa96", "comment": "Malware payload (Mirai)", "value": "7203fe1881e40e9459f9d37bec3620d32c2e2f172c81428727963cb87130f879b0d224253e92d3d846d260c6a01cd39a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304359, "uuid": "885b2e1c-f120-4433-a7c5-74ff5df25f51", "value": "T17AD2E1B91B0A4ADADEAEC8FAC3E413A016650F129903FC4A74ACD7039B575D0D547FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304359, "uuid": "846f793b-bc52-448b-b9b6-067d813c5c71", "value": "768:/xMWBhAHuLegF1aF4NscfOl8liVrJgGlzDpbuR1JP:/xdBGuLea19acfjliPVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304359, "uuid": "3c952001-e6a0-4376-8229-e8e1d8ad68cc", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304359, "uuid": "28d717b9-a357-434b-874d-b464b1a14c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304359, "uuid": "ea0fd9c4-0c5c-4b73-8a12-e373793bdc29", "value": "cosmic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926e0837-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383286, "uuid": "1c266a3a-5a2d-472d-ad74-f3e917502ba9", "comment": "Malware payload (Mirai)", "value": "ed5e2cf846f46698fbdb453d5dce14f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383286, "uuid": "ecf74abd-17b6-42e0-8fe7-945ecdd88ca5", "comment": "Malware payload (Mirai)", "value": "89d0c7f66ee96d3d02258a2369e482376291517e3d383a3fb2364ec8abbca6af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383286, "uuid": "44be2461-0b6f-4907-93dd-e6ff32a6916a", "comment": "Malware payload (Mirai)", "value": "a82cd1f1d8b1fa88fa281a38e46b85dc36a6d3c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383286, "uuid": "20bcc65b-615c-40c1-a2de-7950536062e0", "comment": "Malware payload (Mirai)", "value": "caa823458c67c2cc2f63d8467af2da3f79d7a4bb53ff4cfe022342cbc5a841a439d5e78cfd4ac1b9818dd3e0dfd34918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383286, "uuid": "ce31cfc9-9275-40c7-b1e2-d6566bf807bd", "value": "T10F731917BC829B11D6C512BAFA0E518E33135B7CE3DE72129D14AB2077C796B0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383286, "uuid": "1f12bd7f-bc69-4ac5-991b-d6be991ccf28", "value": "1536:JWnM3CyKw+6MOR/jPqgN/dJBakfxbkjbswPJIi/J3s9Ng65GYex:n7Kw5N/jCgtdJBa2SNJc7g6QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383286, "uuid": "8af9f9e8-a42b-4006-a11f-2c47236913c0", "value": 73872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383286, "uuid": "52e2102f-658e-41b0-bd68-e9d194b57fd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383286, "uuid": "61e205ae-6904-425a-92d4-9d4f144d09b8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b0a266-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362131, "uuid": "675f6cc6-3fd1-4f2e-8454-174b69e4d7bc", "comment": "Malware payload (Mirai)", "value": "726ff15ac7c656e57315b5d674767c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362131, "uuid": "c4c64779-78d7-4b7b-9f8a-32b4f0087d5e", "comment": "Malware payload (Mirai)", "value": "8a18fc972cb6666a8fba239580e50af73fa85971b2031e1e27d8aa3d034713a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362131, "uuid": "1ff825e4-71dc-470b-ba0a-2af549c625a3", "comment": "Malware payload (Mirai)", "value": "81f4bffeee5454c37986e736a5a63755fac0a418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362131, "uuid": "573c3c95-d519-4cb8-9a20-aa5f06671a0c", "comment": "Malware payload (Mirai)", "value": "275468afd3ef9705182af92ccf8a8c9bc46c562a25f4c2e4be8431d503ed8a6a6ac40be37f5492ca3a193fe5838b6871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362131, "uuid": "df76df81-6fba-49d2-933f-5f4d5a22c873", "value": "T1036302CB6EB03F26C0DCA1B2703415DADC3ADD8AE69386DC87E1A7960735532148CB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362131, "uuid": "4df28707-c147-44f0-b31c-19bfc33561f5", "value": "1536:yaxZLmYKVDNSl2y08yumeJyGYVmIMGsSJNiqNz:yaxZLmYKX+t08jmeJhYTLYqNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362131, "uuid": "88cb328c-14bc-4328-9975-a3bef9507536", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362131, "uuid": "95ab8c89-ee06-41c7-8634-989562785766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362131, "uuid": "0559fded-05f4-4326-a4b4-95a3c2b28570", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74ca370-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304375, "uuid": "07466030-03c1-4cd1-a19c-3cf3024ea65b", "comment": "Malware payload (Mirai)", "value": "3c22d767e8178cca6832497e1a6f0835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304375, "uuid": "ef7d6571-5bd7-498f-859e-9fccf13b3322", "comment": "Malware payload (Mirai)", "value": "8a49c863e769f34c914267d8d3d2dfc10aa3a144c94107bd8c9213acfc5e7e42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304375, "uuid": "4e4befb7-3eb5-43df-9308-32e196ab96ef", "comment": "Malware payload (Mirai)", "value": "af1ba5303f91cdcf4edaad8273372e00027a0f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304375, "uuid": "9323dad1-e6e2-446b-9060-543c5fed2360", "comment": "Malware payload (Mirai)", "value": "d9d6fbfd4b80cb540b5b5633d361bebce7fad1147fd79875d26a29e8aea16d7aa66c07e919c8c4ea9654df0c5345153f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304375, "uuid": "8a4b783e-4f1e-43fa-80c4-381a0b6fb81b", "value": "T19E83D60ABB604EF7ECABDC3745EA1706209D592A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304375, "uuid": "3868e078-9012-4ddf-92a6-9b7d3038eaff", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304375, "uuid": "60e56280-a289-445c-8a58-b907c9779f8d", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304375, "uuid": "9f65d464-04bd-4cb3-94a6-656ffadac527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304375, "uuid": "3b67047c-9e50-4a0c-8ac4-0dd8ec9be1aa", "value": "cosmic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fd3965-f981-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769299328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299328, "uuid": "07ef1baa-ea95-43b0-93c9-d924a4689aa9", "comment": "Malware payload (Mirai)", "value": "9c9b50a18944c3066d9097d865f5a55f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299328, "uuid": "da179f5c-22a3-45dc-a3b7-b5d0b1064fc4", "comment": "Malware payload (Mirai)", "value": "8a89ea54274f8fece7cea00ab78ef331cd570b74a7f950f34107417438fe59ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299328, "uuid": "26f1de0d-fdbf-4fe6-be0e-2054b4794063", "comment": "Malware payload (Mirai)", "value": "952447834cbb78b13608a824726ffda5d1b2f727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299328, "uuid": "6151cfcf-d9e6-4e10-b404-f96f7b314618", "comment": "Malware payload (Mirai)", "value": "0c507d3867df530f8c5f0bfd8877a65ba4c4a3e268f10d2a56e821b79d0f110eabecb8b50385da8ab41df36b810cd307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299328, "uuid": "8c437436-bbe7-4e4d-9d07-b0a91db42802", "value": "T18393298ABCC5C702C5E061B2FF1F559E371643A8E3E6B107CD19AF29674B89B0A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299328, "uuid": "a4fa452e-2225-4df1-b8ad-21d0cbc9ce4b", "value": "1536:PdyXZWmAyQf85m8QQxzU4MBAua5eg4vI92DB5YY0Jw5VeRrqOZ5X3g:PsJWnyJpQ4dOAL5EvI9CYK5VirqK5X3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769299328, "uuid": "9b1f3053-6499-43f6-92e2-d05a42e3d4ce", "value": 91888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769299328, "uuid": "bcc83346-bcc7-4c37-a8e0-751bd3bce75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299328, "uuid": "dbb4cc1b-b992-4e18-bfe0-c1d8023b8e8b", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8300a7-f9f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348994, "uuid": "cc98112e-38f3-4ecf-9da5-ecd5d58758bc", "comment": "Malware payload", "value": "f6b9f821b7b167fe3a644e5152a8ea36", "object_relation": "md5", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348994, "uuid": "c00afbac-e2df-4e84-a92e-f53ea9b5caa6", "comment": "Malware payload", "value": "8ab95f1605b4d611d5abbd9d86dd24c932f5d3aff16724a3e44a720d5f8f22c8", "object_relation": "sha256", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348994, "uuid": "b9cc866f-ff51-4740-b115-cf0ca5623cc4", "comment": "Malware payload", "value": "d1c788c0279abcc339fdcb5269a9e1ad0eb5b52e", "object_relation": "sha1", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348994, "uuid": "7b83afa3-d204-44c8-ab2e-b044902e8eda", "comment": "Malware payload", "value": "fb29dbf5f03f685e3a1c3b12cee8276cd844e530b2ba1be3b1490eb8863e7a1b00bdbbb3ce84f90d4e9937a7bb58c93b", "object_relation": "sha3-384", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348994, "uuid": "4c9a6e4b-1e96-481b-bc8d-03b812d0a519", "value": "T10B863322597E4F20EA7FF2301521EE1FB25E8345B2C078AF4B1E81816D535F93B6E51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348994, "uuid": "a1594cc4-55e6-4a66-ae90-54677eabd0ee", "value": "196608:1+y4iiRW8zWuBL9n0VeMsxdbjgOXHEEALBEN5sjR3:1+JzWS50VZadbjg4Q9I5iR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348994, "uuid": "1a7d845d-5e7d-40ca-b256-693b70c2abd7", "value": 8192085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348994, "uuid": "6ee2832b-9ddb-421e-a63f-023c4257b3a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348994, "uuid": "02c95d2c-4d82-43f4-b0fe-f0dc1c00f2a5", "value": "d2ifx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9796ae1c-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383725, "uuid": "db8d0693-e1e9-4f3c-9a51-a0579c445087", "comment": "Malware payload (Mirai)", "value": "644972119f0d6f3c10c1ca4b9583559f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383725, "uuid": "1a92af2a-f8fd-4d60-9109-8ddc54f0def3", "comment": "Malware payload (Mirai)", "value": "8bd7aabf5158834584681533bc069a31dd661b3582686823c51c2b2f6a3266e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383725, "uuid": "257a2acb-d29c-4fb7-a544-bcf2f998de1d", "comment": "Malware payload (Mirai)", "value": "436224945ee9a1ca412e25233d52c74e4f8d3e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383725, "uuid": "d6ffd7fc-05b2-4906-ae36-b320c4647968", "comment": "Malware payload (Mirai)", "value": "cf5515d1851f5f687243ccea971e13550ef34e2e4a746d66f46a6a11f25ef8080ff4871ed6d7b4ab84644606b28b7c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383725, "uuid": "92ab1ba6-edaf-4cc6-bab6-8aa448840077", "value": "T1E1F30A55F8814F16C1D111BAFE1D128E37231BF8E2DE72129D205F707B8A9AB0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383725, "uuid": "2baabf31-d1d3-47a1-9f0a-75e453bd6ce4", "value": "3072:hQP9C2p31Stq2m/+YbX6Ql7U54+G5SPZxaw/p5prc:qP9C2p31Stq2m/jXs54PSPZxaw9rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383725, "uuid": "b9e13ee2-82e5-4758-b5eb-615f196b23e6", "value": 157788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383725, "uuid": "34c31406-c29b-4d43-aa05-8876da3f8fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383725, "uuid": "141e81d6-c7aa-4df3-8466-82c8ae3235f4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9224956-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383432, "uuid": "ea42f15b-5ce4-42bf-ab79-0cfc1178922a", "comment": "Malware payload (Mirai)", "value": "69bfcc2161546693f6511633f270432a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383432, "uuid": "124bdf9f-3943-40e0-b504-3966142a2189", "comment": "Malware payload (Mirai)", "value": "8bdf5cba9395c0f460f6e5cc3ba3d0f2850dbc64f9e648c0aa0daa4ade359756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383432, "uuid": "0de8f8ca-6699-4744-962d-cc0faf09451b", "comment": "Malware payload (Mirai)", "value": "3d09a2eaaae5e18e053c171c39de34f38acdedde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383432, "uuid": "76a038a9-5f3f-4beb-bf35-425076dea968", "comment": "Malware payload (Mirai)", "value": "b625445292a70f7ab38b43714f874e64c9aed71d5ff0c7df59da199d167d5975b9a7c1c1865aeabce43a723f66c5e408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383432, "uuid": "f90ccdc1-84ba-4e26-9b0e-c073fa743f3f", "value": "T171435C42F3180983E0675DF43E3B2BE0939EA5D111F5F245760FAB4A91B2E325542EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383432, "uuid": "793a27ae-cc4f-4b04-9f84-99a4258366c9", "value": "1536:TaIkRtSNIBtXrXAR4+z2LFeELgMLqNg4orZX2:TaIkRttbXACFes9X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383432, "uuid": "bb7cf0f3-e8e6-4528-b74d-45d67ddd5d3c", "value": 58860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383432, "uuid": "df8e1d78-2958-4c19-ad1f-255f4c90c271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383432, "uuid": "72869bb5-3cf0-476d-889d-75f499f923f4", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f255e2-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383700, "uuid": "28875d33-6ec3-4b1d-98f0-5c876ceefa4f", "comment": "Malware payload (Mirai)", "value": "437f3eafebfdac2a074df103429f7cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383700, "uuid": "69966a25-1691-47cc-b237-924d62d9c93d", "comment": "Malware payload (Mirai)", "value": "8c966c653d7afed5b9ce117bcce6c0e413b58840e2b1ae9a7be2392e2387d341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383700, "uuid": "f6acc963-fc93-48d6-8c4e-5f175cba0ebe", "comment": "Malware payload (Mirai)", "value": "c416447bdd7dc643570e5bf3ec3d2ef89b67ff99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383700, "uuid": "dd3fdb1c-c87a-434e-8c0a-1729c7e507fb", "comment": "Malware payload (Mirai)", "value": "46b626bf32ebc01ffc3dcd1b7fea0fd774e8215a751e9d6657eaf287869599c3c874758df5eaddc984fefe6d33eab464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383700, "uuid": "47bb988c-dd11-43bc-99b0-93e68ec14510", "value": "T1CDB30889BC819B11D5D536BAFE0E618933138F78E3FA7113DE185B2A538E86B0B37505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383700, "uuid": "e12f1a90-e7c3-4cf2-89a4-3dbe33fc47a2", "value": "3072:EuiWsztq/6zEUrfzE8eqONj4AFrrSFd0dbdsDIKSX:Z/k/ENj4AFrr/dbdsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383700, "uuid": "1df1ab99-be5d-41b3-946d-5ffb0af656c9", "value": 108064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383700, "uuid": "1c664452-3898-4e46-9046-60417c1c10ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383700, "uuid": "5946d1b8-6d0b-4b52-83bd-74ceb5b73c85", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51644c87-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362132, "uuid": "2a27a6ab-07a1-4025-afb3-1ccbc338b73e", "comment": "Malware payload (Mirai)", "value": "395fbb2143ca01220275a5c62f1f80fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362132, "uuid": "a0c91a71-651f-4020-887b-b84b6b38f6f0", "comment": "Malware payload (Mirai)", "value": "8d265aa4f3d3351978f2bbbb70f955761ce6bc316b021ab8af164058f523cbd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362132, "uuid": "4765316c-d6e8-4998-9d9c-acdc0ee4e078", "comment": "Malware payload (Mirai)", "value": "919ed77f395c827694802503848a9219d27d1d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362132, "uuid": "b8c4dfcd-b951-4426-8ece-312a35c43199", "comment": "Malware payload (Mirai)", "value": "d2be463b5ff5bd89d526d08c00e73b9b6fb50fdd2b5187b667c7029ce339bd5b686bbdfff8de93896d457d8535a991d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362132, "uuid": "c77d628f-7efa-4380-ab9d-429059b1e778", "value": "T11704392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362132, "uuid": "ce4b0d2e-ad67-4dfa-81c5-f95148b33e71", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wZUXS:7eJpJUVD1A8n0YNgEJi5a6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362132, "uuid": "4363d840-8b1f-40da-b729-abd14f00f54a", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362132, "uuid": "12348ce2-82c9-4531-8948-550bf6ca1879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362132, "uuid": "0c6d30ef-9176-427f-a057-0e5464b39442", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993032f8-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302552, "uuid": "18ee219c-1beb-40e6-a0bd-fc2133f9c651", "comment": "Malware payload (Mirai)", "value": "c61c31eb374bd40dcbf1856298087c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302552, "uuid": "7d81f04c-dd0d-473c-bf86-b46042bd15f5", "comment": "Malware payload (Mirai)", "value": "8da4805d9fbcf4ce0edc0a8d9662cf9c821956154e3c443fcec4bb8705ebdecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302552, "uuid": "cda2dfdd-7781-4b8d-8e2b-a6dde71af059", "comment": "Malware payload (Mirai)", "value": "4cfe0f8bd36a262a1400a51a23bea3cc221f9fa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302552, "uuid": "ebc5f016-fc69-4340-baa8-66e2c1511c79", "comment": "Malware payload (Mirai)", "value": "23dc91d11647f378b4a5897eabc4acbaa8f6c9ed7c53ce2ad50d18c48fe3905731abfd422c2700e7bfc384c8df5ffba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302552, "uuid": "ce3764c1-2828-4e51-b70c-1837196ba5d4", "value": "T12DE32A46FA418B13C5D51777BA9F024A3322DB9493DB730699285FF43F86A5F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302552, "uuid": "afd03032-3871-4d22-8268-d718cffbb76d", "value": "3072:qeM9qLxXUL0HjayVJX7996tUhSXRxf/hm8nnXze4M/9Uk/AP:/M9qLxXUL0HjaCQUhSXRN/LnXz5M/9Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302552, "uuid": "6cc26719-0737-4b3e-bad7-0f08ed164726", "value": 144580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302552, "uuid": "576933b5-22f4-4469-9905-3ed59ba99b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302552, "uuid": "22f5a53c-f8be-434f-b7e6-83a633561f21", "value": "SecuriteInfo.com.Linux.Mirai.9788.7218.10094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2817d17f-f9f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348319, "uuid": "7cb1117a-4284-4613-aa12-31ee63ce50cd", "comment": "Malware payload", "value": "8083be20d9e953019c3a6c5fb43367f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348319, "uuid": "9903b72f-2ce2-4ba8-8535-fb37601beab1", "comment": "Malware payload", "value": "8db11ab1c615abb77afce380b8e8a61e6b473653abc080b920cbfb6874bed725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348319, "uuid": "bfdd1dfd-a4d4-4724-a799-c9596357ae58", "comment": "Malware payload", "value": "bbc5674e203a2b12f398324cf45eacadba37da87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348319, "uuid": "4e6875b8-1303-4989-9de9-758ca1c381cf", "comment": "Malware payload", "value": "e45b731f4e74beb7815070ca3940460877544dfa75e6be182f42463ed9e6115a4115a3cc53f03b96cf1c38d7123784b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348319, "uuid": "0e48ebbf-55ff-4abe-b7a5-679af8e757f9", "value": "T151647BA8BE4E3C4363C7F36DEF8657A1303B35E8E76691B67901062DC5D6EC8CAA1510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348319, "uuid": "b48da15a-1c83-442e-998a-76f46e0ceac9", "value": "6144:mK/G0aXT0fThEcm/IHh26tMtBN5BPjH6XD/eJNYNe:N/XiT0NEZIqVfjHmD/aNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348319, "uuid": "d56bc8d1-a50e-44a8-992f-b0f6d18b8ade", "value": 312503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348319, "uuid": "0bd10a52-f0dc-47d2-91af-619fca93175d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348319, "uuid": "3be59e17-50f4-436f-97a2-5a5e8774d09a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ea64d-fa20-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769367693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367693, "uuid": "edd0789e-2854-4c28-8e12-e6769ce6fe7f", "comment": "Malware payload (Mirai)", "value": "55a919a5b4b3b1d087d2635b2afc179b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367693, "uuid": "b92d1e8b-6dcc-45ae-b133-7e3755ec0e3e", "comment": "Malware payload (Mirai)", "value": "9095e7035f471cb32a6a5c3cf8260e0229c0a4d358b65670680ddfaf789c9e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367693, "uuid": "8c539063-7d8a-4f39-9271-6d36c1b993a1", "comment": "Malware payload (Mirai)", "value": "0a6be09e57f54f87e0da09e999413b449dbcf11b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769367693, "uuid": "323bff1e-a222-42a9-896e-d2c151a32a8d", "comment": "Malware payload (Mirai)", "value": "19a9bc3fefdb7573b15100ec22f440a2ab8fdc672cc47b207499931b11452dce552331dba9819b140a9d4f8572191e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367693, "uuid": "492146c8-f8d7-4bbe-8045-18155942f47b", "value": "T1CDF33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367693, "uuid": "e21701a1-5530-4bb6-907b-2dadb22b94f2", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHLfam:9FJMgWPZr8IaCWReS1WpPeU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769367693, "uuid": "731987cf-14c5-44ca-af6a-06b891dce145", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769367693, "uuid": "82477d99-1567-4fce-b00f-40671feca305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769367693, "uuid": "10d04c6b-6928-4bf3-ada8-f586fdda044d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad876b90-f9d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333940, "uuid": "f6aa0d1e-1fbb-4608-aa6d-497fedcd9c66", "comment": "Malware payload (Mirai)", "value": "f14cb88f04ce424cdef88e5d6bade43b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333940, "uuid": "499ec844-a775-462c-8b4e-796a78145012", "comment": "Malware payload (Mirai)", "value": "934d98054705bde5dd5922a2601852190b253a8ab754fc4c258d9a9a8b22ebcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333940, "uuid": "e11cc042-4047-4a78-aae4-10aed4425cb7", "comment": "Malware payload (Mirai)", "value": "a012eaaf7e3878cb5a4d4c72f5c6f1cbfe04253b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333940, "uuid": "41978b23-5f16-4883-9345-c8b18c92571b", "comment": "Malware payload (Mirai)", "value": "53f54ba0c72f24e8b677dfc12a38a962e316bd4a12febf8df600a5b7287e230c2faf587d1b3610fb3ad3c130d8e7281e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333940, "uuid": "bf4cbdab-8e06-4fbb-b829-57e4e0a16091", "value": "T1A9D43946F8809F62C5D12676F75F8268732347B9D3EBB20699184B343BD792F0B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333940, "uuid": "1f0514e5-ad14-4017-9e65-9123a800ba98", "value": "12288:5sowNMwh2laFVgFVBBOa7J1TZbDUX7aVu8prPEH+FiXESJAQ:PwNWlGV8V2a7XTZxr/Fi0SJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333940, "uuid": "2596e128-97ee-473d-b1d1-1494ea99beaf", "value": 649636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333940, "uuid": "b285a44d-4d1d-490a-a5ed-8044ecd0f2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333940, "uuid": "39c6d4d4-c75c-47a5-b7b1-1c8687e8ed69", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9347e-fa02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354709, "uuid": "5227b31b-c4be-41bb-aa4e-3b48d6fcb3ad", "comment": "Malware payload", "value": "d40c5974a3917d170385f0eca4a62a40", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354709, "uuid": "dda9089d-91da-471b-89cb-e1fa9a8d963b", "comment": "Malware payload", "value": "9399b196de709311cfad587e2f88c770375c3fea98dbdc3c7e4b92550bbe4291", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354709, "uuid": "94f058d7-a0e8-4518-8270-54dd304160a0", "comment": "Malware payload", "value": "e70c76dc4aafdd77c96740dd9f84de2eae1856c3", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354709, "uuid": "0c8537b7-163b-40c9-a813-ede9afa58e13", "comment": "Malware payload", "value": "cd578f6acfb65da70a6ccc16fa6e0596d4ea02037fa1e51ec699a0bc1d9471aefaf3c97b4167ae5e5858e39b8fd181ce", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354709, "uuid": "32b2fd81-b845-49a2-ba59-e30820c87e79", "value": "T1C6C080FD4915845191CECD6FF02254105CB6F1F0715BBD728C9D60410E069F43097C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354709, "uuid": "5690453f-fa0b-4490-876c-de5cd060ff44", "value": "3:Fvsa3LWeSnhkFK3dHZBFDhLGOtjve5CRViEDjNVHyoQ2ofeTYUWAJ5tzMFvn:FUNFhLd5zDdGQLbAEHN4v2o2TFJ5tz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354709, "uuid": "8b4b658f-6002-4cdd-9dde-961e1a616e4a", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354709, "uuid": "d0d9027b-aab4-4125-8e95-fa7eeeffdad5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354709, "uuid": "3a9355cf-acfc-4a23-b49a-1aa9b2a5c6cc", "value": "Y896927738.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b37480-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344738, "uuid": "d53f607a-ff50-4937-b5ea-5954dcf3ecb5", "comment": "Malware payload (Mirai)", "value": "f82788807e3acaddc84a4e43f3315644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344738, "uuid": "fded297b-96ea-441a-8332-ee1eb620a1d5", "comment": "Malware payload (Mirai)", "value": "93b9307448b4b74889840101b77336a5153e5f07c13d368445f29a881079bd40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344738, "uuid": "d9768832-456f-48eb-859f-cb17339b476e", "comment": "Malware payload (Mirai)", "value": "a70369b049e3b89dd01a36041a45d9540a01cc19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344738, "uuid": "6163151b-1c8b-4303-bf9f-2aea548f6480", "comment": "Malware payload (Mirai)", "value": "74617a0b8bd68c95cd63f141f6e423690d312f34a772d3ac56ee6bbdf1f818e482049892fe396c9f6a899c7eb0e2f7e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344738, "uuid": "2e42720f-ee2c-4b4d-ae28-7e1760f89b7f", "value": "T19C343B45EA418A13C4D217BAF5AF414A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344738, "uuid": "bc1ffe20-7edf-4d40-a6fa-adfd91ecadbd", "value": "6144:NYCHHItSn9azauKacEK1dAnJd7c/f9ihM/9lAU:NzkS9azauKacE62JOQG//J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344738, "uuid": "4a8693ea-09f7-46bd-a784-06aa776631dd", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344738, "uuid": "03e89c68-be06-4398-907f-1139bae1824e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344738, "uuid": "64a2b09b-5eba-48fb-801a-4cd150ab20aa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c4f903-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354655, "uuid": "42a5e222-cabd-417d-a8b1-e1d7d2f4e77c", "comment": "Malware payload", "value": "30b7be6764ff3c50e747b24b80948d3e", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354655, "uuid": "9210c3b0-9540-4926-93dc-7fcd13720353", "comment": "Malware payload", "value": "948bff70fd6489fed0b32f7fe71f4e06e00c734033ccf43beb03fbe32e9a8aa0", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354655, "uuid": "d125968f-3a19-4be6-8f81-601a10c43ea7", "comment": "Malware payload", "value": "86962b419835f7e3091d6d3c72b79ef1daaf5223", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354655, "uuid": "506d248a-e1a8-4831-bb57-b80beaaae894", "comment": "Malware payload", "value": "c7ae43ad32e1b1f6aed0ce8cd5f15baec94c5ec23cca0b7dfb28a93526e6505ffd99f8e195dcf6c803fbfbafce45612f", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354655, "uuid": "9bb028ba-7d99-4b3b-94b7-fd5b664bff00", "value": "T14BC080ED4915B11150C9C49FF03250104C75F1F0615B7D338C9D64810E525B51492C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354655, "uuid": "682dda5b-2437-4a8e-ae33-23f6978c6f2a", "value": "3:Fvsa3LWeRYdnGYyeCNRhLGOtjve5CRViEDjNVHyoQ2ofeTYUWAJ5tzMFvn:FUNOwGTNNRdGQLbAEHN4v2o2TFJ5tz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354655, "uuid": "342dda25-2671-4fb0-8347-545586d9646e", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354655, "uuid": "e53019f7-45a3-4d4c-a52c-de66f09e5c1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354655, "uuid": "5016c27d-f391-4fb1-846a-962a27747902", "value": "Y780449991.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5da9ec-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362124, "uuid": "589a616e-dda5-4e4f-af89-3aebb6536574", "comment": "Malware payload (Mirai)", "value": "a3bf3351eb08fb1d6bd4cf935f2ecbcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362124, "uuid": "2b442d57-1015-481f-879b-c54e964ca1d0", "comment": "Malware payload (Mirai)", "value": "9632cf1e1dff268dd2cadacac1e5ee75e307dadb770d16a2ec070d5716a303ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362124, "uuid": "5cc0a27a-a66e-40ec-babc-46866fcc5212", "comment": "Malware payload (Mirai)", "value": "8744514525abc62ded492447b4fb0a463a879075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362124, "uuid": "8ec7203d-9b86-437e-ab46-92bf49e79e4a", "comment": "Malware payload (Mirai)", "value": "219496068f5ca2b7c50c434d713b1233450093f6b122456dede8bcd0392e2cf7d602c87e914be11eab67fb72b9f2b513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362124, "uuid": "989b8f8b-3473-4305-91ca-393f36926cbc", "value": "T121B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362124, "uuid": "38966ad5-89dd-4c8a-bc35-a94e16699f1d", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzL8rSR:t3SrlGWnKTU83AQB5A5Liy36f3USR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362124, "uuid": "8e731f43-bab3-4d31-ac9e-76ceca1d859a", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362124, "uuid": "07a0ee80-212e-4e0c-8d25-582eec4f5551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362124, "uuid": "dd812908-056b-4b7a-95ec-4f1c034d5923", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2438d8-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331095, "uuid": "23bf6b7c-158a-4845-b411-76ed5d5da2c8", "comment": "Malware payload", "value": "4088537033ea016a908069784b883f21", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331095, "uuid": "e594daf8-caec-4221-814a-771f00e41de7", "comment": "Malware payload", "value": "975b706479e7f3cab2987c08950f6012a4c7561efc4b4b12a2c3726e732b8c68", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331095, "uuid": "3ad5a1f5-3906-4a8a-a559-f059a62c853c", "comment": "Malware payload", "value": "e3065e9205ffd1f11bc6d98739a00eaa6b71fab7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331095, "uuid": "54a2461a-fe9d-4613-933d-166e1d372646", "comment": "Malware payload", "value": "22b42c9703dcf756aa2fc739b1fa8e47e74fb7cdaadfe6bc595e08ff792930ad4a0089bc83fbf744fc65998456edbaf4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331095, "uuid": "0180a7b2-e3db-41d8-9385-f9ef1588228f", "value": "T191F73330B27768E5E62F63BFA0A86FC481307DE1B31BD56B63787BA5897054660B1C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331095, "uuid": "4891f598-9313-4c6f-a01f-e23fcf5d43b0", "value": "1572864:Dxyzop3xA9HoS9coQcqTv9AIkX9JTB7wScm6S3VTnXM2ZdW8L2j50:VOoDsx9/hqTv9ARTTyMT82Zdqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331095, "uuid": "43f9a3e6-ddf4-4f89-9501-fbdc3b160a67", "value": 77106688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331095, "uuid": "3679178c-d737-485d-85c7-9fac3bf48150", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331095, "uuid": "67a3895f-ece0-432e-892d-9eefc964b1f0", "value": "aQgXwHuorongSysDiagPro.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc3d88f-fa2a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769372246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372246, "uuid": "22f2ffd9-0c4f-47ac-a1c8-313d5d6328a0", "comment": "Malware payload", "value": "1e7d4c0c67a123f3269310bc546bd1c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372246, "uuid": "0880ab87-99b8-4f63-a984-9720953f5104", "comment": "Malware payload", "value": "982995b4185a3d74ce13803918a1f7a7714006e78a77992f3dd88fe259fb66cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372246, "uuid": "53d62f6f-a829-4b25-9867-6a7b633da3b2", "comment": "Malware payload", "value": "0cb7f1372f009b0c1376e605e615f3d1d3bcc6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372246, "uuid": "ca19d49b-a378-4d04-81c0-6967c63d61cc", "comment": "Malware payload", "value": "2e7f2bcd8c646036deb39730f9edbcc5b7d5c10457a0d7aa14b630ebad2bf37d3f15f6eb7aa81af3bc779e541c8c9df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372246, "uuid": "66c6dbbd-edc6-405c-bfed-cdd157ea9556", "value": "T1F403F2E0C35CF318FBCB867B57F91C80EE531EA8354E94492A539842E45DCB981653C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372246, "uuid": "8555373b-4f04-4667-8d30-4d8ee823704d", "value": "768:FWFFVHO0nbMeuElmgWpuxXSx11lpBXtEBO4KzoAv+W2HgvrGuWA1Q7s1T2So:FWFDOUbMeuEUduRW1NBXyBO4Oo4+WRGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769372246, "uuid": "fe794023-f77e-4191-873f-4122fef204fd", "value": 38866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769372246, "uuid": "ccecb7de-78e3-4335-879c-ab7df8838363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372246, "uuid": "2eab055a-dc37-4d18-a2ea-9d5f88edddb4", "value": "SecuriteInfo.com.ELF.Agent-BQZ.99964767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a8f06a-f987-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301870, "uuid": "b41a7e01-7bd8-4d44-9b48-6b761f6b3484", "comment": "Malware payload (Mirai)", "value": "ba0b0a70c90b12cae252cd2a174ee545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301870, "uuid": "b869b754-860d-4597-9f02-74f8536b4883", "comment": "Malware payload (Mirai)", "value": "9893a96ddc6807bcc1a80b9c9e423caa7caae5091aefa645684f11cba05a1a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301870, "uuid": "1edcc626-2b4e-49af-81a1-2ec61e97664b", "comment": "Malware payload (Mirai)", "value": "19b49cdcefaf776d7299cafa506fbc41f99a1206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301870, "uuid": "6c488a01-0435-4af1-bafb-31bb8c28b094", "comment": "Malware payload (Mirai)", "value": "a27bd7eb29d3be6370ca7dc29bdbcaa2dbc919de998f1b213af49224e66f8840d32a543bed79820ef2c5665a93ab3b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301870, "uuid": "d71f4951-3f1a-4ef6-8f0d-0425be186f9b", "value": "T12134951F6F268F6EF769867047B38D20A75837DB26E1C680E16CD6111E602CD641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301870, "uuid": "82f87df4-4f19-4f23-b345-f7d1ab6b88c5", "value": "3072:t2qTWcR85v2q1MO9l9yq9ISudlaJjndFE4Tc3GOPkD87SbCC0Yc7s:t2qTb8oqZvhNudIxndFUFPT7jC0/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301870, "uuid": "13481eed-ef11-4f9e-af31-e193851a8de5", "value": 231816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301870, "uuid": "03ecff54-2334-4dfd-90f1-85556799b53d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301870, "uuid": "f53abde6-d4f4-4b49-8d56-6c9cef2c5eda", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65cf4e3-f9d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769334867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334867, "uuid": "8803b693-7767-431f-9401-b2730df7fb1b", "comment": "Malware payload (Mirai)", "value": "cfba5c3536fd6c680bd6f8b2de16a3bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334867, "uuid": "a26d9e31-61bf-4ed9-907d-2531c650fb89", "comment": "Malware payload (Mirai)", "value": "999d56f6af03e12d76a1b270a83c190d65f4b7f7b0de9b3106421ec1d2eb8f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334867, "uuid": "30178a0c-bf3d-43a5-8170-8f9d9c3e3bde", "comment": "Malware payload (Mirai)", "value": "ac7961cc65285f199aefc7c41aa762992e7e04d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334867, "uuid": "a9ae60a2-1db8-44cd-9280-fe35eab06867", "comment": "Malware payload (Mirai)", "value": "5e385edf0955f6dbaa24605b64928bf1d561c304977e5cbb5f29d41caad7e72905965a8eab95c01ad795b805d0b1b29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334867, "uuid": "88a19a59-014d-4a82-9125-4595866c406a", "value": "T151E33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334867, "uuid": "28589b50-1bfc-4f7c-9c48-d951bbfb4785", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVW2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7WgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769334867, "uuid": "95725ed1-df99-4af1-aa9a-22d0c890f004", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769334867, "uuid": "28c52724-0281-40f2-b405-178775283145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334867, "uuid": "f7df8f25-e469-4ee0-bc45-0d57756bd18e", "value": "cosmic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de78d942-fa2a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769372247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372247, "uuid": "d9ba601e-0b8e-465b-92f2-cd2189aaaa3a", "comment": "Malware payload (Mirai)", "value": "cfb296d5c26abe631ea55e7cae97787b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372247, "uuid": "56b653be-22f0-47e9-a7e2-03ca3b7c0307", "comment": "Malware payload (Mirai)", "value": "99e85e600be92a10feec3683f0ccb57e0709f9ecbffb4ace6b3d9f365752e7a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372247, "uuid": "9a4f5313-2c58-40c5-9e0d-aca58b5f86c8", "comment": "Malware payload (Mirai)", "value": "f6050cfdae33430bbb7908ea862883fc4f4e82d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372247, "uuid": "ab3bf101-b17d-4af2-b458-6201d0f77d17", "comment": "Malware payload (Mirai)", "value": "2bfea686dd42cff6f9f45dbc422357953e58af18e21034d79530421addfc7c0db9bcfd9f03e86f7e2e94645136a03162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372247, "uuid": "b5343131-c726-4670-aa3f-1f2002b3bfe7", "value": "T19D62D04FBA5B2ED2DC86053500ABCB25CFAAD1C3878B950443B6D2041FEA5732D9053F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372247, "uuid": "46244bdf-5407-476e-a069-f4dde92c4ac3", "value": "384:gNTRz/NQUlauPLxtMiMaotAs2d7Z02ytToiL/VJ:WHaci/tqm2ytTB9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769372247, "uuid": "68e11b89-bf3b-406c-9064-6ceb4cde9956", "value": 15698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769372247, "uuid": "7ea6648c-1e8a-48ab-93c6-15ceca0ae0f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372247, "uuid": "e99b2700-f597-460d-ae59-f58d247931d1", "value": "SecuriteInfo.com.ELF.Mirai-GH.89943333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972a6722-fa37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769377711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769377711, "uuid": "b4b11e04-9502-4db0-a457-9198c9094445", "comment": "Malware payload (Mirai)", "value": "c5b3945546e8afdd802d3319e12d5965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769377711, "uuid": "4445b328-2f48-446f-99e5-edfa8e2c3eb0", "comment": "Malware payload (Mirai)", "value": "9ae60e993b5915b716b8685a04821d55ba1d16b4727c1644fe83a0c97a833ade", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769377711, "uuid": "60f54c50-fc8c-4ed1-8b13-e182c753e981", "comment": "Malware payload (Mirai)", "value": "804f3e71ffbd6634c7a6fec011b31695bf462636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769377711, "uuid": "5ed25c0f-cb90-438c-bda1-38f3a7e064db", "comment": "Malware payload (Mirai)", "value": "8cbe78ceeabb6794411247da943144f5fb84396476e541bda5fd95532540902d6ea45284fb8013d8b1780ead6afa0f28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769377711, "uuid": "2042540f-6e30-48c1-afe7-d76a664cab14", "value": "T16A939E11CC74AE9CF07B2E7050B9D9FB4313A585A81B6CB73C478326015BA88F5A6BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769377711, "uuid": "7fe2848b-51ed-40b0-9c0c-f7eb203da5f2", "value": "1536:Kq4z0ZQfEF+bBxDnvgEY9K3OSq0Qy1oYHhxUC0SPmrUX:KqI0C4+bBxjvgn98Oj6hxUlWJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769377711, "uuid": "cae6055f-5593-448f-a5de-4c0bc5fc30cd", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769377711, "uuid": "42f11513-a103-4576-8d8f-1474199f1a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769377711, "uuid": "5c19535a-7a94-4b57-9a9b-53f4bfe5c99b", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88848538-fa31-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769375109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375109, "uuid": "854842e7-577f-4620-8467-78d62339a1d4", "comment": "Malware payload (ValleyRAT)", "value": "97e2e03d1c0bd6adf254abffe3146f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375109, "uuid": "e1020d73-36c1-44ed-8e54-474645558901", "comment": "Malware payload (ValleyRAT)", "value": "9b6c535f8f3bd6dfc649de5c8febb37d48f72ab86e36e2d5d6a035413f5a2e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375109, "uuid": "b4e831f1-a622-4564-833b-edecf42609c3", "comment": "Malware payload (ValleyRAT)", "value": "d3744e977846e8fc4b02837397f564bc70b61282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769375109, "uuid": "e2309477-bc3f-4813-b37e-12f295af8390", "comment": "Malware payload (ValleyRAT)", "value": "a5755cee942d079e1c46ff744cedf35696eae235561ff4e02b4355fdacca5666cacbce88e8756b24acc421bb5b66dc7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375109, "uuid": "1c321990-35db-488f-b6fe-af42649bcf5a", "value": "T18D54DF17D36224F9C448D27941A686B3DB62B8301177EAAF4F74CE32BFB78505F2A125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375109, "uuid": "c4e565d7-0370-4e3d-b3ae-8d1834c5beda", "value": "c177b9b32c0cd67c8ca3b3950cc052ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375109, "uuid": "c461851c-6c80-497c-bb04-f67f43c39d63", "value": "6144:IDJ4XAXrgLdomKP2IrXSdDZPnfd7zMUOwLdmS2MRzM11RZL/R0fuTJko7:yprgLfIrW5nF7gGmS2wzM11PLp4UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769375109, "uuid": "81298df1-f790-436a-aecf-5997c7aa5682", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769375109, "uuid": "ba1e7fe8-42a6-4bca-8a08-5aae7ab433f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769375109, "uuid": "5a398769-7799-4925-804d-550ae0d2c2c6", "value": "9b6c535f8f3bd6dfc649de5c8febb37d48f72ab86e36e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f97747f-f9e4-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1769341889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769341889, "uuid": "6ce9e51b-b6c0-4657-b725-0622d1eb6af0", "comment": "Malware payload (HijackLoader)", "value": "d99ad7cb319bbed1ede0b75bd82324be", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769341889, "uuid": "95f2eebc-c1c8-4baf-99f5-0101a66f3b76", "comment": "Malware payload (HijackLoader)", "value": "9c43cb90796f6336ee5a50e316f11d79ba1798ade41e5ffffb3a8fe38bb81830", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769341889, "uuid": "4739531d-8d61-4a0a-abc6-f6508b540ceb", "comment": "Malware payload (HijackLoader)", "value": "e73de01bce6e1ec8c675e9ae048c6922acce3c8f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769341889, "uuid": "f559afe9-5ee7-400d-b389-c90231c11f15", "comment": "Malware payload (HijackLoader)", "value": "098e25bec177a3c64af8030b3766550fb44a85809ab399077220a197c487f180cf3b7193bdf6844e9a1585e58589a976", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769341889, "uuid": "80628329-03fe-4c77-b35b-924862cfc978", "value": "T1AE263352738B0DB5E1B2AE3464B6C0007D07382C2AF5A01B3D36E99D67799520EF6B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769341889, "uuid": "99162f96-77ea-485f-a7c9-b53c082d82f3", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769341889, "uuid": "6f0a79c1-b9c3-403d-8a8c-13d74f0dbf2d", "value": "98304:BgKbC2w17jp9uPvv5AgtDrrNXqbyZUxXvqhhejQrkpsc4d:BJbCt1HDu3W6gWZUYeFyfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769341889, "uuid": "ee17881c-89d7-47d1-b182-bfa181e911ea", "value": 4766807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769341889, "uuid": "86c43be6-71be-47ef-83ba-ecdad997a06b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769341889, "uuid": "53c90b0e-8ffa-427a-bfdd-36d7bc7e8752", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f65674-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333358, "uuid": "69a7e3c9-19dc-4fb1-9b52-345ebfecf327", "comment": "Malware payload (Mirai)", "value": "0548a04dbebfbc1516895fbcc9a4a37f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333358, "uuid": "0dc7857e-ce20-4872-9f3c-7ace62084587", "comment": "Malware payload (Mirai)", "value": "9ca6b8879fdf58ca3a638bd1b7d28451e49dc72f76124b84b679a10442c3c217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333358, "uuid": "f94d63ea-04a6-42b5-801f-d61aced60a7d", "comment": "Malware payload (Mirai)", "value": "b0103c5c602d3ccdbd5f79315d1dea5cc7b07b49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333358, "uuid": "d57899b7-d35b-401f-b655-32917c784e45", "comment": "Malware payload (Mirai)", "value": "8f5682bfae75e907d87931c879bad137efd21d0f6e1191823a0c8c35655b000019180e076409b01dd3064341ad5d9632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333358, "uuid": "d73f357d-cfd1-4642-b3cf-72d386907c6a", "value": "T1C4333B22BA361F17C0D5B0BA22F34724B6A1BA1E2974C66D7D721ECEFF106C065476B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333358, "uuid": "c092c7a0-8d27-4499-9262-1df229adb421", "value": "768:ruwot7FEq9/4EPwGb+izp/sjczd8nIfcgGClO+oFhCZ:6w67KS/4EPJ+iBsjCd2CloXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333358, "uuid": "7681aa30-2f1e-4dc2-9257-7c7d239fb0f8", "value": 53648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333358, "uuid": "c50c6277-493c-49c9-9636-6929befbbd1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333358, "uuid": "b457392f-362a-4c53-a2f0-9373e2eebde6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d548adda-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384258, "uuid": "dfe100d0-e06d-494a-8b6f-02e028e7bfb7", "comment": "Malware payload (Mirai)", "value": "f93323504681b58930d71eeffb07c795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384258, "uuid": "fdda254e-3dfb-469f-8c81-739694e5e5a0", "comment": "Malware payload (Mirai)", "value": "9ca7eaf7a185704e633ee776bd789d5c8a81446027d0424bb19b0fbf8e77406a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384258, "uuid": "8905b4e4-0101-40e5-bb13-8af3e4e996ca", "comment": "Malware payload (Mirai)", "value": "ff552eaf120b4a55facec11e06cdf5a59447d2f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384258, "uuid": "aaa66b08-9aca-4f73-97f7-28e24fa7c638", "comment": "Malware payload (Mirai)", "value": "cf90133c64e1d0332b08f7522b95929993f1e2949649479a1ee4c3178cd2652d314cfa27728364f29624102b57f1216f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384258, "uuid": "88c7a9f0-c375-469b-ac09-b80b9998ba11", "value": "T105835B819242E8F0ED090175713BF337A632DDB801B8FDF7F3655576582AAA0B28674E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384258, "uuid": "6b8a7277-d3d2-4c16-ad81-7728e87affd2", "value": "1536:eN057uXY27SgWJS98WB26AS41jU2sws7f3F39VfKEEXCD6rMYwmTXcblNF6yjA:eN6UzWNS9/3wjcwCf1fVYrMYwwMRro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384258, "uuid": "c628053d-b0ea-4f73-977a-0d6971dae20f", "value": 83124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384258, "uuid": "cbc39fb5-aa36-4ffc-8830-2cf3bdecb9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384258, "uuid": "9a4fd6c1-8c8d-4138-ae4a-64b329d0b0df", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8724626-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361983, "uuid": "a32e13f0-49a6-46e6-bed1-8c428a2ab960", "comment": "Malware payload (Mirai)", "value": "ac496c4fd7f92f874719a9bffd96a817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361983, "uuid": "c2e20b83-f554-449d-8ebd-1edd4f69c070", "comment": "Malware payload (Mirai)", "value": "9cfc223d34a6155fc5e0730128803e01aad85d6b242f2cb89a393abe1dc852be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361983, "uuid": "79eef854-2405-477e-9175-7623883b79ba", "comment": "Malware payload (Mirai)", "value": "6b0b1d12e2e81f1a7f6790be016811a2bbb05630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361983, "uuid": "08c6c62d-3d16-4265-a7ca-2733ebf4f92d", "comment": "Malware payload (Mirai)", "value": "11c744a7cf1be79d681f840b5d0f20ad8914e30e67691c736b2d78920a604545b01d64615c60272e8dba07b32b48a348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361983, "uuid": "5b7eeb7e-731d-40f6-b182-a8d802e76828", "value": "T168933AA6B410DD7EF85BE7B780470A46B120A3E44E427F377667BE23DE6E0642852D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361983, "uuid": "c41eb7ab-a581-48f5-97d4-3642e736b952", "value": "1536:9bYL+prMHhe7hahoJCyFco9gmLIe+ma+y4ZrWkVNtwq//OqZAeTmyT8rxON:we7hajwl9gQPPpZKq9TmywAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361983, "uuid": "80aa107e-07b2-4ab7-9bbd-c308aae16164", "value": 90268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361983, "uuid": "4ffd63be-652d-4199-afb2-6b3f7308bf8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361983, "uuid": "14d89243-0789-4f62-a1ee-7a8c1ea38d6e", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2bf993-fa48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384836, "uuid": "8fd0f623-d74f-4c0c-b165-3e53e3f403cd", "comment": "Malware payload (Mirai)", "value": "b95f4f58fc205161f074576cd9a54286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384836, "uuid": "ada1cf91-a515-4f8b-b798-8f90d05dbb06", "comment": "Malware payload (Mirai)", "value": "9d2d570444ed159fe100228afbb3adeb12ebf28255d592ce8f1e0ccdeca6af0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384836, "uuid": "b1e2248c-e040-45ec-ab7e-c4b78d3577df", "comment": "Malware payload (Mirai)", "value": "866f7215dea4a44b527824a38a92009ef9487ec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384836, "uuid": "e17d13d7-0d41-471a-bdb0-d1be051422a6", "comment": "Malware payload (Mirai)", "value": "8dd71174fa3468b7c060a6c5358f28d26d4830d226f0573e9ded82fd4a29997bb724eed2f978e82a710e339c686cd56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384836, "uuid": "a1af7fa5-cede-4232-a79e-6b1ef9826e52", "value": "T17FA31BD6BC858B11D5C165BAFE0E518D33134BB8E3FA7213CE185B2E574B86B0A3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384836, "uuid": "9a9021a8-a0d2-4b5a-bc66-18e86df9eea3", "value": "3072:9alKXZLqtNmIEQxfhiKD/cvpHeOHHqrVE9P31cIbX:wtNRaKD/cxfqrVwPlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384836, "uuid": "de7a99be-4561-4728-bd2b-805491bba8fd", "value": 103804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384836, "uuid": "2cfc0db4-b5ca-4e1e-8e64-01acfab36654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384836, "uuid": "c47a1e97-4fa7-4884-9320-f397be93eab7", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f48b6a-f981-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769299329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299329, "uuid": "1543b52a-8359-4d3c-8c1b-a26b77d914a4", "comment": "Malware payload (Mirai)", "value": "2c5c89d5c51dccfb84c6eb3d99b05841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299329, "uuid": "c412db3f-75bb-4b3d-9a42-b1e47c08d3e6", "comment": "Malware payload (Mirai)", "value": "9e8b9ade3a80abdb7033dbdd1127ae712eb586e0e3d4e2f907a416a2572574e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299329, "uuid": "f52176b2-04b8-4742-aa8e-95b0c0ddd029", "comment": "Malware payload (Mirai)", "value": "049a704f4f2c547e574becfb34f637ca1cc6222f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299329, "uuid": "f1b34586-311b-4171-bccd-8f41cc8f1f26", "comment": "Malware payload (Mirai)", "value": "0a6a6e837745ccfb7488898fc5883a42f95e6cee9a3bd3dbe6725cfb5a9ac9538d8beb47a98e474abee3fab2765c9d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299329, "uuid": "498badb1-0600-4857-931f-49b8dc4d9fc7", "value": "T10C834A0173650447F3A74EF1282F6BF093AED6A221E0B685694FDB0F8175A321586FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299329, "uuid": "1ff9c81e-c589-41af-890a-d7878d300904", "value": "1536:YKf5HPO/EV7JMmkrLYIHiv23YyLFEutnAmbt144ZwqDqnCXv:XO/8KeGqQn7bZzXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769299329, "uuid": "370e6804-a18c-4a40-8915-cc6692794bc6", "value": 87532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769299329, "uuid": "a50f29ee-d8fa-471d-af1b-d54f73274e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299329, "uuid": "2d2450c5-bab8-49ae-ba60-75ff79a07b65", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a813a5d-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1769304246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304246, "uuid": "df09bbf6-0378-44f6-9c8c-a180a0ab07b5", "comment": "Malware payload (NanoCore)", "value": "2fc40bccc9e445910bc678cc91008639", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304246, "uuid": "4b3b9b1c-81ee-4cbf-bb07-4d569cb89104", "comment": "Malware payload (NanoCore)", "value": "a013d70550b1afcc5d037878a40cd174bd8ad2ce5fda85b4c2d9afc169262e13", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304246, "uuid": "da48b1d7-561c-4c4f-a988-5ee889805b56", "comment": "Malware payload (NanoCore)", "value": "0ae9baec41082aec847c7add174aadbe7c87ef9a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304246, "uuid": "5e319b4a-ff92-4b46-bd59-d128a2832426", "comment": "Malware payload (NanoCore)", "value": "061d3476d640a38e76a3506314aafe40847328798e9515cf9557313380f735de0811a080b6ee7ce4403df241614af620", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304246, "uuid": "1123fd8e-9cf9-4d0c-8164-ff8310f28018", "value": "T1E6C402997BB9562FD2DE86B9A0121222437DC2F3ADD3F3EE5CD055625B222D50B070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304246, "uuid": "5bd0990e-2d17-420a-a07d-bb505a73cd4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304246, "uuid": "037ac5df-fab7-408f-8df3-a352de5df5ea", "value": "12288:JLV6Btpmk4aCwoCWPg/W8fwImUJ+3sHWVYvdBRXNwOriGq9g3:xApfZVWPgeW/mu+cHWGTRXNoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304246, "uuid": "76e249a1-fd92-48b3-9cdf-719061600f5a", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304246, "uuid": "a452c8bb-6653-4a12-b033-0a485ff9760b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304246, "uuid": "6790c6ba-9931-4ece-bd8f-5604bea08109", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47820628-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362974, "uuid": "63f81bfb-3c8f-4732-adc1-75e5ca234137", "comment": "Malware payload (Mirai)", "value": "6dc724b7fd6fb7fa63b86600b3bd61de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362974, "uuid": "b9f256f9-e0e5-43aa-8499-6a2a113cfc2d", "comment": "Malware payload (Mirai)", "value": "a01eda33ef7a4c54ca8f673bf8ccef6470305bbc29b937e3f3e9d7eaf2e4f66c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362974, "uuid": "cd63022b-5de0-4ff3-85bf-6c2a074eaa30", "comment": "Malware payload (Mirai)", "value": "c8c4ccac413037f87a946aa12cf21664393bf04c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362974, "uuid": "7c613f64-ce9f-4df9-a971-58f3572809ee", "comment": "Malware payload (Mirai)", "value": "473524e647f8edc16462e90df17fdf97acc2f4d57e3a0f029ef363dc9ffcd19df4f6e37a7fd3bf9f1a7598f9cb23d6a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362974, "uuid": "e33f99d4-d129-418f-9711-fa2621487405", "value": "T135145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362974, "uuid": "e519f35b-ac9a-46f4-bd74-57dcf1b40d21", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXXUaN:HZ15BTYCrYq1QDY604", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362974, "uuid": "f29ffc4f-9f9d-4f5c-a33a-9aeb446f975c", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362974, "uuid": "0efdb4c4-a244-4222-9516-1f0345ada0b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362974, "uuid": "30b8237f-0d19-4429-bcb6-bee32bfcd40d", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067cf481-fa0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769358570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358570, "uuid": "30134457-286e-4a77-b3cb-824d4f190676", "comment": "Malware payload (Mirai)", "value": "056068240c20b7779de17fbc8cbd5172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358570, "uuid": "c4208900-2965-4efb-b331-ab7ae844f065", "comment": "Malware payload (Mirai)", "value": "a0e80064594963754f22d9fec3802c3aada9d167737a9c31873bb70de2146974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358570, "uuid": "ed81cfc6-bacf-45ca-aa5a-94f14cb87494", "comment": "Malware payload (Mirai)", "value": "7a75b4c75c247d04abf0e106f5d3399ad87fd88e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769358570, "uuid": "ab4fd9c4-02b5-4c1d-9c51-539e719a5ffd", "comment": "Malware payload (Mirai)", "value": "f464386edf4de6159d2aed94fa90c075e71c41231da345fc301110b404c021a731864e183d6b6551fb64327721ce8735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358570, "uuid": "ba0e6a47-87eb-4e92-9279-b2986b27e648", "value": "T148148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358570, "uuid": "9f43c2f8-9481-47ed-922c-66cdd868d363", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxI:bOVfbEdxm4iubG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769358570, "uuid": "bef344dc-8a25-4115-8b5b-659a8ec35a98", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769358570, "uuid": "620604df-2bbc-484b-894c-9df17e2ff18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769358570, "uuid": "1456261e-3495-49ea-ae65-d21895d738d9", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a864bf2-fa08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769357316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357316, "uuid": "71f24446-2015-45ff-ac62-68f23f43e7ec", "comment": "Malware payload", "value": "53c64a9d1b6a2f6f871830424454ba0c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357316, "uuid": "08727198-4016-4b43-aa29-714b7e50152a", "comment": "Malware payload", "value": "a539471a5811cdbd9f80e7d09804ae8b2f9986798a7c0f3b0d00addba087cac1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357316, "uuid": "9e26ede0-1815-452f-897d-4f6294d6ad05", "comment": "Malware payload", "value": "178d4ae72585ed7b9756a6f86f1b2911a5d441ac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357316, "uuid": "c392e57d-ca3b-4885-aa73-56b94f8b2e65", "comment": "Malware payload", "value": "d53a34b00d1e30c09e8c863cb0c786584e4d01f44643b71b80c59271a7b9de01751e07de1371e57f8454e4832f086d97", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357316, "uuid": "375832be-e68f-40af-96cb-88e9f7da33e3", "value": "T14EE2E52AD554AFF0CB2F61B2AC97284641904325A674390E75CE9ADC2F34364CF991EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357316, "uuid": "a6d54b23-d952-4c83-bb29-d3bd0311ed03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357316, "uuid": "7acc5bfb-4da3-4185-8682-c5472a1b62fa", "value": "768:AA5Igz9dwe/Y5Plx58cqPqjM6RF2UHG58KR9W:NuOdwe/Y5D2cqPF4A5BR9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769357316, "uuid": "4fbd2459-5c70-4459-995a-3203f19112b2", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769357316, "uuid": "7f8ac94d-4363-46f7-9743-b2e057847466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357316, "uuid": "af62b7f6-85ff-40eb-aced-d338f328f9a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4fc657-fa1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769365799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365799, "uuid": "1688d0f1-b0d6-4c7d-b471-4650846daabb", "comment": "Malware payload (Mirai)", "value": "2da793416b431082e0f045d2c2be3734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365799, "uuid": "26c8f3d3-8a1c-4d78-bcc7-a1997778a44d", "comment": "Malware payload (Mirai)", "value": "a56233c6ddb7fa71a21f0937459da91d7329c8deaa8ab0217bd2cb87feb4d68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365799, "uuid": "6124ddbc-b9c4-4454-a2f9-6a44e2c309f4", "comment": "Malware payload (Mirai)", "value": "dc40b76193e9f22542a4e21c9e145188cb823917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365799, "uuid": "dcbf8c9d-7cb2-4d7d-8052-70464cbcea08", "comment": "Malware payload (Mirai)", "value": "5994a2ef6233abfa6383d016b2bf06827eab224d1c4d0499774c8f67971da4e618ec3d0fdb7ab0a5e9364e0c6b41c08f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365799, "uuid": "6eff028a-39dd-4fef-a66a-3ab47c50e85c", "value": "T16D431893F804EDBEF80DEB7788970A06B170E3A509530B76A7637957FD761940832E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365799, "uuid": "56b2fd4c-d3f4-422c-875d-505f17012849", "value": "768:u2wzx4rqn8BMzRsfrm+Zy0urOfb9HvdnVySTeBTgNDe+8GbYjiK3o8eTZeONZh:uXcyNsi++OxPdnXTedgBe+/b58o7NZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769365799, "uuid": "c7f5bc3f-c32b-4a21-a6d9-aff3ea67d6e5", "value": 58236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769365799, "uuid": "3a2a6340-12e7-46f3-acdf-b5945e28c975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365799, "uuid": "4b0e75e8-1ecc-499c-b177-a728019ffa8c", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b485a-fa1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769365222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365222, "uuid": "cf7d476c-d137-4b01-898c-6cab361c02bd", "comment": "Malware payload (Mirai)", "value": "e58275d2aab15c5e2e20e41ec14f5a14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365222, "uuid": "d392561b-d75e-4a42-9d75-e1e053e57d64", "comment": "Malware payload (Mirai)", "value": "a639395591d7b68b6d6b85a454a4fef8c1c5a7dc0442cc13bbb8137601d07ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365222, "uuid": "d3f703eb-bf95-4a38-b976-f7ee9b964607", "comment": "Malware payload (Mirai)", "value": "25e275005ed31076de32eff5ea0999c6d1a12e46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365222, "uuid": "2e517e1d-1e77-47f1-9b30-3e30ca4643d7", "comment": "Malware payload (Mirai)", "value": "6755925f56f364898ea1c70f5df135901f7e9491a56390db4466c406078593f780c5c409acd1c89bea7c3312fd3e2f80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365222, "uuid": "a422ea01-3255-4c0a-8c19-bf2bc35537e1", "value": "T15D933AA6B410DD7EF85BE7B780470A46B120A3E44E427F377667BE23DE6E0642852D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365222, "uuid": "b88f3dcd-a59b-4605-8102-edef5ec1b20f", "value": "1536:9bYL+prMHhe7hahoJCyFco9gmLIe+mP+/4ZrWkVNtwq//OqZAeTmyT8rxON:we7hajwl9gQSgpZKq9TmywAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769365222, "uuid": "7a0b1e93-aad9-49f2-8466-0d87ab4cf849", "value": 90268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769365222, "uuid": "aade7075-a3ce-42be-8f6f-c764db14c97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365222, "uuid": "5629d026-4185-4978-b847-d4e21eea86c0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc0d6cd-f9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769324006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769324006, "uuid": "e44c1aa1-2254-40b2-9bc3-9b948f373970", "comment": "Malware payload (Mirai)", "value": "3d441b654a25bdb908072e76d66fcb51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769324006, "uuid": "01cd3b0e-2339-49da-b3d9-fd7c7954450e", "comment": "Malware payload (Mirai)", "value": "a649f1fa3ca16f22967979d1593726575948ef7598fe66fa31ef469029f7c005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769324006, "uuid": "0614f632-494d-4f39-b682-f437c5a240e2", "comment": "Malware payload (Mirai)", "value": "85474c4ba5a55146a7f4419d8501f7bd7aecdb56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769324006, "uuid": "83ff34bd-14b8-4592-b99b-3fd3919a005b", "comment": "Malware payload (Mirai)", "value": "c3d9ac25422b5765805067d0b24cd1cff6ecc5ecb03e74b4e407abdd6519992e472d294580dcf8489874cf9fc10dbb9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769324006, "uuid": "a94da1a2-ac4d-41f8-9f73-4cbc522c91ff", "value": "T14304F642BD419F13C5E232F6FBAE428D37156B69D2EB71069D21BF503B868DB0E36241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769324006, "uuid": "b4dc8f9e-9f52-46a4-9e74-9e37e9f55a39", "value": "3072:WMa90hF0jgatzUUR1/7zwRp4HVGLreaVlWGB/K2E4SR6qiKnVYbEozpHH:WMHFcqea1i2E4SRXiKVmEo1HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769324006, "uuid": "1f845e39-95ec-45f6-9cc0-f8c555dd3062", "value": 179700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769324006, "uuid": "96920056-193a-4afa-a0ef-f55048daeeab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769324006, "uuid": "faee68a9-494d-4673-868a-db9844e297dc", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38a76d4-f9f0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769347345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347345, "uuid": "0d6b55fd-068e-4aa6-8052-0ef159715b8d", "comment": "Malware payload", "value": "3027307efb981c6aa2d9195f0b2c8316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347345, "uuid": "34fa6618-e897-4088-bd30-7021d2968eb3", "comment": "Malware payload", "value": "a667e34c25f5a6d06ad626e2bc376845e7ecfb2e39641572be3939a7f23ca104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347345, "uuid": "dc373a8f-feb3-421f-b99c-672d94337652", "comment": "Malware payload", "value": "c5c995ce9f277f5c9fbf332a1d6817b58fd098b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347345, "uuid": "fe92de37-d0bc-42aa-93da-76bc00133b91", "comment": "Malware payload", "value": "8ffe1db7ddafad4aeead7ffed5b0d3d2b96172c013a9484e018739d4edaa8d984aea54736e5f5300e7e486518dbf52d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347345, "uuid": "aa9a4a76-2db0-470f-ad78-290cd80ff0dc", "value": "T190E633B90E5A1526EC8F03B16AB1F13547425FDAD4A0821FD18EA48FB95EF3FAD805D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347345, "uuid": "f35c4c6e-4b3a-4728-abd2-8dd29cd01fdc", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347345, "uuid": "48ab7bf7-7104-4d41-9704-5c79a26aab6b", "value": "393216:xgoJQMYFp0UQxMXkVuwqZfR6Zk9TtunwyCduE:qs+n90MXuFaRLTtusEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769347345, "uuid": "d32fe652-076e-4934-8b60-87e803476139", "value": 15022080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769347345, "uuid": "2829a874-5336-4dac-84db-079af89746e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347345, "uuid": "ebfd0f50-5bc7-435c-a541-03c5c21bca4c", "value": "Installer_v5002_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e6affc-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354566, "uuid": "e38f8f07-b0be-452d-bcac-118c71cd9f44", "comment": "Malware payload", "value": "82cc94527e0d93a97cd801ac507baca0", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354566, "uuid": "067d56b7-06a0-4d49-a388-de3a094891a0", "comment": "Malware payload", "value": "a6aa89bfcac26a358c86d204df02b35b7c371457428ae9265f6962600e74090d", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354566, "uuid": "41c18e0c-9e89-46e0-a35c-6752f23a0014", "comment": "Malware payload", "value": "8dc747fcf7fa6804b7c49c15fb8aac0c88dd257d", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354566, "uuid": "f08268f3-0459-4359-a492-e6327eff2acd", "comment": "Malware payload", "value": "b26dbd34d096bc285bf0a24b1da9ee05409875795476cf52817df76108c6c9a50c0ab6783abb58117002331a9c4322b9", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354566, "uuid": "cf3fc37e-71d6-4f7e-afcf-7ede1ab283d7", "value": "T19D157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354566, "uuid": "0f5b555c-3938-4ee2-a1d1-d2b909f383e4", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354566, "uuid": "41f4ae82-15a7-4a77-81dd-851df0def4df", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6TG:d/QMnl5YL7WzZyQRdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354566, "uuid": "f2adf661-60e2-4e95-a12b-7b577b78a4b6", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354566, "uuid": "52542062-5c62-445a-b69a-c6765ba3b113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354566, "uuid": "8d08ce36-0da2-48e4-966e-a53dbcf22859", "value": "Y472615366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a03486d-fa17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363784, "uuid": "b001f6ff-cf1a-4262-b5dc-0938f6e11853", "comment": "Malware payload (Mirai)", "value": "06d9d4b6915070a7e486c9cb8967c1f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363784, "uuid": "fe745949-5604-477f-982d-c3bd12b38c13", "comment": "Malware payload (Mirai)", "value": "a7444918fd3b227e7bd8884699188769c29d9eb5ac92ced5c87482c8901c71ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363784, "uuid": "41f5bd30-487d-4f25-94b8-a487f724e26c", "comment": "Malware payload (Mirai)", "value": "d82e68f96e266ea3d8b8b0cfa08e780efb5b10f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363784, "uuid": "02ebcbaf-fd08-4252-b1a0-fdf1e9432714", "comment": "Malware payload (Mirai)", "value": "c82a67c2aeb3a233fed261c36c681e57fd9f997da41bbb7de7b5f471318a04759845c01495e845aa3d44a41ad3322b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363784, "uuid": "b332fc9e-b6c9-4a4e-b39a-769b53d51cd1", "value": "T17DB31999BC819B10D5D635BAFE0E518933138F78E3FA7113DE189B2A538E85B0B3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363784, "uuid": "4ab0fedc-ee25-4bd9-9220-5b2546ffe512", "value": "3072:VPIJKG6tiDmoEzofDZYnwoe0jne85ogtdOgCPQh/lytX:mdDOQZewSe85ogtdbCPQBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363784, "uuid": "1a6a5e19-eef6-41ae-ac7f-8d6e393fb4c8", "value": 112160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363784, "uuid": "a223ffba-a97a-4d19-a474-c2ea67f5ec53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363784, "uuid": "7315e051-0733-4208-b120-c3097416b90a", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54475536-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333361, "uuid": "0a9ef63d-9090-4f97-92ae-bc24ac18f0f6", "comment": "Malware payload (Mirai)", "value": "95ea776d8aab7ae75b48be5bc1121367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333361, "uuid": "3c3b86fe-5382-44dc-871b-326184422356", "comment": "Malware payload (Mirai)", "value": "a8c2004f02da42f50f9ecb96eaeea2fc081166d10a7fbf440f6c31544c065a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333361, "uuid": "a5a7ceb0-2f7f-401e-94f0-7c23ab30af64", "comment": "Malware payload (Mirai)", "value": "d75140b9ac475320f8083011668f54b3a61c2a38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333361, "uuid": "efa06787-4942-44e9-b871-c183118bee88", "comment": "Malware payload (Mirai)", "value": "6a4e8999673e97019d53bade927309ab1db30be6ce75ae7bc82b12b835de249e78b5ada07dc1372374721ec643d309e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333361, "uuid": "c08ecb02-79a2-441c-b343-7c4102335c2f", "value": "T1C23308527D828F03C5D562BABAAE418C37217BA8D1EF32439D217F80378989F1DA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333361, "uuid": "1d0069c2-dc99-4310-8954-f82f086b21ac", "value": "1536:NkR7Pp3DwbSSW0RDTFGjdOaWhKRFYkJD7:KR7Pp3DhSAOhhmpD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333361, "uuid": "c58eb1d9-26d4-45ab-b6f8-6e538245ed4e", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333361, "uuid": "c983793f-2141-47c0-876f-6a7ecab81c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333361, "uuid": "8b10639d-9c62-4594-bdf2-94e7d9c673e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd474bec-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344731, "uuid": "d8f61623-a13b-4295-b662-64b33dd22948", "comment": "Malware payload (Mirai)", "value": "9bccd6ec91fc18f8344ec480c2fcff47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344731, "uuid": "9546baf6-e415-4b6f-ab3b-c3adfc95e019", "comment": "Malware payload (Mirai)", "value": "a9477a12b3f266a05f62e5eff528e8162e2cd36e0e0b891d5ad088d33c4b79d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344731, "uuid": "64a833ee-5ad5-4624-b074-03f456d5c76c", "comment": "Malware payload (Mirai)", "value": "4dcdc0f5dc05317fe1765e09ba69e323864c507a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344731, "uuid": "35b1785f-cf17-46da-b27d-6b8acf842c93", "comment": "Malware payload (Mirai)", "value": "c3a19a01c0bcbd0d5823efe85dbb4c47a22db59c0979b43f5558c48ed9e4d2c4040e0df61e17c2314da4b0da8089fef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344731, "uuid": "d3fb0688-2017-4663-88a8-81582748f73a", "value": "T163E34B55B8828A22C9D413BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344731, "uuid": "d31b803a-7cf0-4af1-a37b-0728f316dd7c", "value": "3072:qNcMOc/pkoDXe+CCC0DvZe1k6aU6zL6EiueCo2kY:KOnoDXeVCCqeS6axIueckY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344731, "uuid": "773d7ccb-07f6-4797-8662-7a75f1904313", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344731, "uuid": "f8535879-8cc1-452a-92f5-c54adaf64f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344731, "uuid": "bf15a8d5-75f9-4f1a-a0ca-e941ea11f82e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44f13c9-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769333549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333549, "uuid": "dda03067-4450-41b1-a963-d6cfa8ab82f1", "comment": "Malware payload (Mirai)", "value": "a2a4e8c3802cf50503ed701dedd4051d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333549, "uuid": "89a5fca4-4119-4ecb-ad97-8fbf167f4fc7", "comment": "Malware payload (Mirai)", "value": "acefaead28acb62560addd6405d479bfe1aad45235051b6d3e0bf6688f88d42b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333549, "uuid": "1c4ed7ac-3a9a-4afa-b458-e966118705e2", "comment": "Malware payload (Mirai)", "value": "aab1069f7f9519b2dfab1f4adf3d26b3fad20dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333549, "uuid": "55f9001e-f532-4023-b1af-5f5bb471d77d", "comment": "Malware payload (Mirai)", "value": "774c3fb2d429086d18164ad5179c2262b7eae20ed4faef8263a349fc631ace802d0fbd3ee00af802296b25ad6eafbad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333549, "uuid": "b468f20e-eb86-4fc4-9f0c-d9bed39f3392", "value": "T154234B63D55A9FD9C20A56B4A6B54E341F23F80A8DA71EF5A641DEE24007EECF1093F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333549, "uuid": "6ebe00d1-d5d0-4667-bcb5-3eb93295dbda", "value": "768:Ot2GNU9godwtUsJd2J74uDlT6eFHdSjdb/HIPRM3BwR3jC9OoDqskC7:42Ndwt0KFdb/oPRz3jYuskC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333549, "uuid": "b4948740-b723-47ee-a121-fc61b7ce01e4", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333549, "uuid": "8b0064cc-505e-4c88-8089-69dc4c57d71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333549, "uuid": "77210e46-bef4-4d36-a038-f787610db5e2", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a8539a-f9fe-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1769353254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353254, "uuid": "bcd863da-1fa7-4e5f-8c66-32e5637b9196", "comment": "Malware payload (EternalRocks)", "value": "326c939e4b3d49d7aa3979a275f10815", "object_relation": "md5", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353254, "uuid": "1a6c694d-f8a9-4b4c-88cd-98bdc3270744", "comment": "Malware payload (EternalRocks)", "value": "ad6fadf9b8c5486695e40666f1fbb534de3e76aa7f1347584cfb42a21b9ec006", "object_relation": "sha256", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353254, "uuid": "3fc7f395-3732-42e5-a049-e9030da30385", "comment": "Malware payload (EternalRocks)", "value": "31ed364102540f0b0c62383199af36aad0d2ff08", "object_relation": "sha1", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353254, "uuid": "3da8ced9-5843-4bd7-9dcc-a221c0eb61a7", "comment": "Malware payload (EternalRocks)", "value": "f5c73de0c81a14353abbda78c636a224442a301699c04903e43906f8c2bd4131b51db8b4ba50f386eae04ed58756da5b", "object_relation": "sha3-384", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353254, "uuid": "54e9b28b-93d4-42f6-9e50-f73b97c01214", "value": "T1FAA54B11AD839D7373FA73D3BE43F49AEDF4815E22261898B2E8504D27DDD941388A2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353254, "uuid": "b9fd4a7f-5994-4a69-9c6b-41435d349376", "value": "24576:wGNPUc8g9K1784tmKSS7Ac41r6O7TMkrQjT5QtaX3lUL7n:wGN41YKFfWr6O3k6talUL7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769353254, "uuid": "a269c623-02b1-4237-b261-265c0ad9ecc9", "value": 2098072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769353254, "uuid": "880f382e-9167-4f76-8c12-9420b0ea81fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353254, "uuid": "3d93283d-01a6-4a1d-a6f1-ccde6b87f2dc", "value": "testing.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f882d8-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362886, "uuid": "3406fa70-1404-4f59-88b2-51453bb32a64", "comment": "Malware payload (Mirai)", "value": "a91ba17acc2dcb8088731b194d43dd3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362886, "uuid": "0f3fbd9d-c8c5-4356-8a4d-972eaafc13c0", "comment": "Malware payload (Mirai)", "value": "ad926f24931e4d72058f24adc7fe1d2da93453fe97986645e017ff28c1987438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362886, "uuid": "53be9f1a-7e8e-4073-a728-e7d69057a8ca", "comment": "Malware payload (Mirai)", "value": "405a7434639c634146bc5c5b714cf70340bb7b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362886, "uuid": "66c5a0a2-98ac-491c-b3f8-772545d79172", "comment": "Malware payload (Mirai)", "value": "f45b0fb04735b49e86126ba88e3c7a78e6389d2af290b8cd1dcd8e8fe46e70efbe9d2b99a87a5dfdd9ccc073dd29ffbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362886, "uuid": "dc6098be-49b0-4e3d-bc13-6ddaade3078e", "value": "T18BB3080AAFB11EBBD4AFDD3345A6074939AD590631B93B793A74D81CF20A18F05E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362886, "uuid": "9af7173d-466e-4224-9ffb-84f097866e6c", "value": "1536:8aEQclW1uEgG35/qmolhXFq36n0UpqBYCxZbxc81uhuFO/vyF/eZfqFX39wu7r8s:8hBBhXh+/wTrgUadsskgBroQNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362886, "uuid": "0100360f-360e-48ba-8ae2-f424cb003540", "value": 116380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362886, "uuid": "75697c4d-c0c3-4683-b754-154c7ad65659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362886, "uuid": "4e7d3290-acb7-4f8e-9731-2c473af0d785", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3578c80f-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331161, "uuid": "655ffb54-d32b-4819-b311-89e250f97cd5", "comment": "Malware payload", "value": "7578874e3a88c7ef1cf56de472a76818", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331161, "uuid": "1c3654e0-d3d1-4aa3-87eb-c98374ec4ff5", "comment": "Malware payload", "value": "ad9b04ff11dc938fbf3bdd5b6b2f284b094f707cdb170a570e6a53d4ca3fdc16", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331161, "uuid": "cf09975c-94b5-4634-aa4c-498b33073b5c", "comment": "Malware payload", "value": "f24f72e3880f2ca4b141115b9bb6fa9d9dd4a186", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331161, "uuid": "3418f3e6-d0a8-4dea-9895-9b4173fea205", "comment": "Malware payload", "value": "97fefd66e91ff36649027ee53185b3656bdf01f7055ba44b3bd264f110c04f06997e36fa95939c06c4479fa757d13d1e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331161, "uuid": "fc4d66ac-d664-49c2-b532-2849d83600ff", "value": "T193083321B2677995DA2F637FD0A85FC844307DE1731BE56B73787FA589B068620B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331161, "uuid": "6b1db870-fd3b-4cb4-bba9-c5b9e67aba7b", "value": "1572864:nlAgVM94t9jOh4S8USrVfhLsXPIlyPkrAKvkOfejdIoDJUkk0lvW:nlAsSa9jOfyrVp84r/smkkiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331161, "uuid": "a13d0ab6-36ab-48fd-bed3-be875bb35d33", "value": 79529984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331161, "uuid": "d5b45c98-4248-41ba-987c-d93b4818d10a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331161, "uuid": "d4163713-beed-46f7-b619-b146d45cd272", "value": "gogel_chome_win10.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57bd401-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383828, "uuid": "7257f664-7826-4a29-8b03-e8f9f0d9d556", "comment": "Malware payload (Mirai)", "value": "eba2e1983f1c2643b782c5ac6f4f4a11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383828, "uuid": "d5948f7d-f09f-4a68-bc2c-34fce9227531", "comment": "Malware payload (Mirai)", "value": "ae11c290aaf522f11e91b9c05f022d6e7bf31b5cc2b6406c60a7618584db22a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383828, "uuid": "87f9f161-3425-4c1d-9df5-49aae4457e09", "comment": "Malware payload (Mirai)", "value": "2a241e31e2b79020f81685444c2a8d1fdaa7e820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383828, "uuid": "ff2229f1-5888-4540-adb0-8a9caac6d7e2", "comment": "Malware payload (Mirai)", "value": "ffaa2699ae36d17257e45f96ffd7889787c8668572cd0d9a4b2ca61879d79932b864fa127e25caa5e4fca2a17f337d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383828, "uuid": "ebe6ed8c-9b3c-420d-8505-4df790600cb6", "value": "T107934A4273690487F2A70DF12C2F6BF153AED5A221E0B285694FDB0F8175A312586FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383828, "uuid": "37157948-3755-4c89-9428-220a352c1e45", "value": "1536:EVjVctHMOmCt/OdnbkrLYIHiv2I1zx9EGgvUxu1XwuKOzYU58+0MmyvqnQ7Z7X4:YHOmqsnPzx9Txu1XwI58+5p7X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383828, "uuid": "075c077a-a045-4f5d-85ad-a6e84b3f0d5c", "value": 95724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383828, "uuid": "40995d9a-a0ce-4181-88f8-f58b692e2560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383828, "uuid": "66a3ec2a-8a87-4aeb-800e-8a10f4eb8dd6", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a823a3a9-f9d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769335219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335219, "uuid": "31a3423d-33da-4a92-b035-4ce1fc8bb8aa", "comment": "Malware payload (Stealc)", "value": "11b7c0ae414936abdc5ecb4a87f35027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335219, "uuid": "f07b3ad4-b74b-4d92-ac19-50c9d817613c", "comment": "Malware payload (Stealc)", "value": "aeefae9a5162091ca000675cf8397bb7f4abc2e2589e6e2ae1f9f414c6a70bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335219, "uuid": "77ae9f5f-105f-45cb-af9c-08aecc4f463d", "comment": "Malware payload (Stealc)", "value": "3570073d39d78f53fececcefa1d0da01985c01e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335219, "uuid": "745c8a11-35e2-446f-a8b5-b01eafcf7b19", "comment": "Malware payload (Stealc)", "value": "7a42bd1c1da2c2a7270f2e6bd25be6809e89970da2eceb9a29385f91d2483c854645be0d1954c99bd8c6c6b623e94804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335219, "uuid": "f5427e56-4ccc-45a0-b122-1d1681940ab8", "value": "T1E6D49D22759194B6E07606358C74EB508BBDBC700F616BCB73C00A9A6E716C1AF37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335219, "uuid": "b4722986-ba22-445a-9c4e-fd637a6bcfb0", "value": "61a3509ea0647265062ee40711b8de6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335219, "uuid": "d635e337-9158-4ef4-9bd0-3b2fa409b6fb", "value": "12288:jKojW1OqdCIz6wTKiXbJPpNNtv3YZtF15kjH8QJ:XjV26+K0bbnF3OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769335219, "uuid": "d765b8e9-eaf0-489b-a61f-6dafcbca5fe0", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769335219, "uuid": "c3c96830-8887-4f4b-bf31-f60c2cba1948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335219, "uuid": "cfdca235-66c5-4d47-900e-663632e6c04f", "value": "xaeefae9a5162091ca000675cf8397bb7f4abc2e2589e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6525643-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363187, "uuid": "ac3f3eba-52a5-4175-8322-841dbefc39fa", "comment": "Malware payload (Mirai)", "value": "3c2978217fa26b4208a1b3a5cd504968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363187, "uuid": "dd68cd90-2dc3-4293-a10d-f6ff76de9ef4", "comment": "Malware payload (Mirai)", "value": "b0f64475cb10b4918a4402dcea4832e4604982fe508d8948c3d60eb7e37d39de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363187, "uuid": "e12abe5f-510b-4c1b-937b-e43d466efba7", "comment": "Malware payload (Mirai)", "value": "1801318c0d2b29b1e395b5da8e7cd16c5c7fcd68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363187, "uuid": "39ff4d57-7f94-4557-ac46-64b31bf7d12d", "comment": "Malware payload (Mirai)", "value": "0452dab73bd42fb2a97a1c7eafc637bc6138fff9d27b5d16f59505ebe27a522105a24347ce2e567055789a26ac065bcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363187, "uuid": "b0d8393b-5961-4a5b-b09c-708114259d7a", "value": "T13063A61A6E218FBDF26C833157F78E31A75873D632E1D684E29DD5001E6034E646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363187, "uuid": "fd6e0d42-9e2c-40f2-b457-746d80da4465", "value": "1536:9+up+ub8uyTzHEScjR0sQSZXx8t2tMqfhFzYQ3xgiPG9AOsTXL4G:CQSyQSZ6PmFz3Bg5sTXLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363187, "uuid": "de5a25d0-97fd-4fec-b0bf-fea93f45e529", "value": 71524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363187, "uuid": "265864da-8ed1-44e3-b341-9a09b96ae061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363187, "uuid": "c1991854-798f-495f-9d06-48820477ee80", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80b7c2d-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354627, "uuid": "c5dd8447-0ae3-4ff7-87a6-526c8164a7fb", "comment": "Malware payload", "value": "67a7e2f94057fd53313e3cecdb048767", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354627, "uuid": "1d35613f-ba17-4170-ac03-58bf4ce6212e", "comment": "Malware payload", "value": "b18e6ecf1e7faae051dc96b4bc3d26c0026cbccd8ba99497e08e79c3eb6e7831", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354627, "uuid": "56a189af-000b-4f45-92e7-dea65d3b15ca", "comment": "Malware payload", "value": "bae02cbee0c381a4b99870a06000ed1740de7b9b", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354627, "uuid": "ed160f31-a44c-4cc1-bab2-384def6b2b6e", "comment": "Malware payload", "value": "687dca737c03be15d4f0329ac630e89e48ae56bcd2c1cdf3447c56fdf1310ac2c7b0cf7c7d03424659de63ef98226e52", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354627, "uuid": "4121bac0-d3e0-4f4b-9347-34e77798995e", "value": "T11BC02BBC4610CD1314C00CC17052B420DCE1D2807D55F02008F970814F0A94C34E6801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354627, "uuid": "920a87c6-9ec2-4b28-af22-9e27476fc081", "value": "3:Mu6vsUSKNkW5+mJg0qYGRXkZiEDjNVHqKpAtzMFvn:96UUYW5F+YWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354627, "uuid": "5adc5969-1ea4-4239-8e42-4c1afae8b206", "value": 139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354627, "uuid": "d56f84c7-50a4-4de2-89ae-b59444306950", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354627, "uuid": "a0d18a23-cd4a-4ac0-8881-53913c9966db", "value": "Y693589995.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ebbf4e-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362435, "uuid": "915dc42d-d04b-4350-8b7d-e9ab360a97bf", "comment": "Malware payload (Mirai)", "value": "db55fcb490124e7a3133f0e9bd7db8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362435, "uuid": "d228b1e7-2eb7-4920-b6fd-3ad075d8cbb7", "comment": "Malware payload (Mirai)", "value": "b1dd14c0c7a86a52740d079e08fe13cbdbb57d45c29e5431903322bed462b384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362435, "uuid": "462d7097-d714-45dd-b371-0bbb81ab6e1b", "comment": "Malware payload (Mirai)", "value": "1ea96015638677cb1528e47a3903472e4f8b0909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362435, "uuid": "9a701dd1-612a-4042-a7b8-3e47a71daaa7", "comment": "Malware payload (Mirai)", "value": "4d0717126d0d0d795352336a55b09f48cc47bcbaa5105e2ed31d0e4ac268d5e752df88698adb5d9dd35e4d1073becd5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362435, "uuid": "49c554be-92a4-4824-84f3-e0318ed2ab6a", "value": "T1A5D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362435, "uuid": "3a4b19e7-4b88-4ed3-ac97-ade947596152", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Z36:xOFgpOEoVv3MXL5NhGO36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362435, "uuid": "7e6d4aaf-e259-416c-b7ad-e69e0494cde5", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362435, "uuid": "b5741612-11af-49c4-9386-56a5c9af3827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362435, "uuid": "6da087a4-25ad-49d9-a946-8d09d42085d1", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f431e7-f9ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769346465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346465, "uuid": "c5b79b92-e762-4e48-9222-4523d71465ef", "comment": "Malware payload (Stealc)", "value": "d1cae4fe0df94e28b92841d7b18fae61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346465, "uuid": "64308421-7397-4d26-b896-979338a5b7d3", "comment": "Malware payload (Stealc)", "value": "b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346465, "uuid": "67b1b1e9-1b0c-4e69-a019-ed7a9cf8633a", "comment": "Malware payload (Stealc)", "value": "4fcad5cf70b5d185689ed1c3dc67283c98eeae0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769346465, "uuid": "65dcd6c3-2adf-47fe-af89-2b9160acdf5a", "comment": "Malware payload (Stealc)", "value": "b167fea1c46bbf430ffad4b644484697e33a5eec14cbe93c9e44b8a90ac431a03c30614ae8c003d7268de72eeeb46594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346465, "uuid": "867d4855-6294-4584-9e30-de395c282ba3", "value": "T11744025FE35634FECB12C13191E2DBB1DA26FC200561A836B254CA743E12DA19B7E633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346465, "uuid": "7f2b58b4-a74e-4e22-b201-21a64337ce9b", "value": "98373d527555d2211af5130441eba677", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346465, "uuid": "9c6c1ad3-7df8-4968-ab4f-f99db7b1c718", "value": "6144:DM9oGWv+sHThJ9wNri1qefzxk1urbomLjBGV3AMSb:sWv+yqozxkgnost", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769346465, "uuid": "e1efb05d-2308-438f-9e31-42f36ab6681d", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769346465, "uuid": "a70f7773-b3f6-4aed-93f6-420cdf86eb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769346465, "uuid": "1494a0a4-7ace-4f75-a87c-ab85021a1f26", "value": "b20c9dac7f4a3da31bc0a98d731112fa010bf2ed166e18d35a873121527661bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cacd40-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354523, "uuid": "6a475b27-d9c2-4403-b79f-1e35cdccfb61", "comment": "Malware payload", "value": "842f5541b7b65585714bd288ca13b357", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354523, "uuid": "9f4638f3-3a91-4bb1-a1a3-16161a1577e9", "comment": "Malware payload", "value": "b334159fee2f0aff150e027f3423e0fac622a56e51afb6ca777ff5efcdda45e4", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354523, "uuid": "dc24b92f-4451-4ab8-b9b6-fb22694e7a02", "comment": "Malware payload", "value": "14f5065cf09d4028e97fc2bbc9364d9cdd71a3eb", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354523, "uuid": "55e43559-4d30-499e-9fd9-bd3434ea7465", "comment": "Malware payload", "value": "9b669443d98872045ad448678e480f52eef4637df69876c6b77d007ab2a9093399dba6b518d024588c295180c4187675", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354523, "uuid": "126e1dc1-2e98-4cd5-9962-b9e3b4def554", "value": "T125157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354523, "uuid": "75246726-26ed-44ef-8d1f-700de5a25831", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354523, "uuid": "04bea6eb-d1d5-462b-86d4-3661a3b55436", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6HG:d/QMnl5YL7WzZyQRdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354523, "uuid": "d3640d79-8bee-4653-a483-a6b3e803e8d1", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354523, "uuid": "35b7faae-2d96-4124-9a4d-5e1798a25f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354523, "uuid": "1af4cfb5-2a2c-42df-8651-9b2cdb22b8eb", "value": "Y400055015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966e53f3-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302548, "uuid": "0b5f2b79-94d3-47c9-96c6-bcdd5169d097", "comment": "Malware payload", "value": "3562b4ad5c47fbc278cf5f0f35ac4f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302548, "uuid": "1afaee88-4f39-4153-bbab-5100d3fd6783", "comment": "Malware payload", "value": "b35b2aaa2c5aeb03c217ebc3dbc1fa968edf18602a98a74b4282e46f32577469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302548, "uuid": "8ed6e2a5-158c-4f05-bedd-41d9b2e26c84", "comment": "Malware payload", "value": "cb0804adf75573c25c6cb3998f729816ffe6794a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302548, "uuid": "9b4a1454-798f-478c-b9d8-a39b3e50164a", "comment": "Malware payload", "value": "c48fcadc4b04a3758b7b613756e18608732274d30365f1ec03996c3be54d66baf119aafe12417dcdd29f0f8bce7fc033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302548, "uuid": "af66a55c-162d-48b4-ad4d-a5e11f2407f6", "value": "T10B735C1AA34318ECD61BC5B086EF6733BA72F8B756309F2F5754DA351D10E902F1A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302548, "uuid": "c77574eb-4db9-4a34-b8f5-25313c4c4387", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302548, "uuid": "9969f420-de66-43bd-ab1f-c2e895c6d183", "value": "1536:n5l8EoNLDd0E7ccWlWUEvwznKklGgYtRFC:5l8EoLJPWgFwWkl22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302548, "uuid": "97aa8714-a27a-4c37-b562-e438c70af71e", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302548, "uuid": "005eb6a7-17a6-4590-a82f-cf7364ed55a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302548, "uuid": "2e78eff4-7726-436b-b747-f1f279342dd5", "value": "SecuriteInfo.com.FileRepMalware.15951528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb5687c-f9d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769336218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336218, "uuid": "b8a7d5de-6e8d-4134-80ae-569ca460d3de", "comment": "Malware payload (Mirai)", "value": "5116809d02c9166718366b69a9015e34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336218, "uuid": "d986d761-713a-4e4e-92a3-c94c426b4a02", "comment": "Malware payload (Mirai)", "value": "b41e2562de0d4d58cee51c04eb81787c332672b8037198b05030900ce2d2bb54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336218, "uuid": "41b7b33d-aa3b-4f0f-8ab3-bcbdc15de8d2", "comment": "Malware payload (Mirai)", "value": "faa0ea447195f6ce8f3c318d45872a71289a110d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336218, "uuid": "4a9b974d-566a-496b-b18f-2dd1bc659170", "comment": "Malware payload (Mirai)", "value": "b3d66e78f5b63f81554178444016011e9d59e8da003efdd61585c7e5a836c3da4b5e4ac6799e5aad392605b9b3d12b38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336218, "uuid": "54db0805-ca6a-4f7a-8e53-6cd33daba2b9", "value": "T171258E4AB2B334FDC057C030879BDB626931F46541226D7B31C4DA392E96EB41B29FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336218, "uuid": "a6eb3de4-7756-4613-88b0-8cd9327ff176", "value": "24576:1aV+NQH5TyykoBXHsB9xB0YIj1TvRkAvF:C2yJBXHKDB0YU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769336218, "uuid": "df77113b-38a8-4276-b2c9-c86701a4dee7", "value": 970464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769336218, "uuid": "f783f7b1-0420-45c7-ac13-ca4b59079c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336218, "uuid": "c2489909-68b9-47f8-b44d-041aedb5a461", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d261c2e5-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344739, "uuid": "735b8693-352f-44ab-aa3b-c79380860edf", "comment": "Malware payload (Mirai)", "value": "22338fc4d8ced797d4a5b4f7785881d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344739, "uuid": "1c9bf859-c190-4f1b-927a-d7111b6dab64", "comment": "Malware payload (Mirai)", "value": "b44cb571bd84e3a4b06c7260a8bd68c98e647d4cb68c3629f2c7263e88126a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344739, "uuid": "bb813afb-fc59-47c2-9c64-a0fbde52d138", "comment": "Malware payload (Mirai)", "value": "726744bf565ad560884ecf4cb489b486201630c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344739, "uuid": "82326bda-ebd0-4bca-86d9-4a350ea539d8", "comment": "Malware payload (Mirai)", "value": "33f7da57b9d63e3707153fc7dbd10a06fa92a50808ba6c8e16f6601ae86d44363344b962c0ddacd04793454a06735d1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344739, "uuid": "d4bd5e4d-e66b-4207-af96-6216abf36924", "value": "T193D34A2275391E2BC4D0987E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344739, "uuid": "7ed4d754-d9c3-46b1-bdea-65bc75c93d59", "value": "3072:1CldeCsOs9kzj2vV44qURgycykV30Qm9Jlsb3jo4:wPeCK9kzivVjqPymymbTo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344739, "uuid": "cdb9960f-f255-4bd0-9059-77316707fd65", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344739, "uuid": "c58e698d-dd87-488a-9fda-b4aad16e936b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344739, "uuid": "f6d02809-744c-46a2-8d74-1f3c8a6f40b8", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff82bee1-f981-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1769299718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299718, "uuid": "fb0dd719-8245-4620-b39c-5102f9094c9d", "comment": "Malware payload (Hajime)", "value": "253c7fd4c185d42ddce10f8cdabaeb89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299718, "uuid": "059ad58b-fff8-4284-83b4-369ca01d5d9c", "comment": "Malware payload (Hajime)", "value": "b4cbedd88f82dc2f93a4424b147be9a84c3daee6098dc742f68582a82786b056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299718, "uuid": "82550d8a-c8f2-4a87-857c-b6934622aa3d", "comment": "Malware payload (Hajime)", "value": "74ef326354a14004bf5fcc3d9120b83f8f2b2a0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299718, "uuid": "bb46998c-4087-46f7-b099-7639341b7d97", "comment": "Malware payload (Hajime)", "value": "b8c497a6141707fa15c0b1a5a2a2b008df6631fcefc30030654351d25a3191f48cf555f58bd7f328ac147ea17fde911f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299718, "uuid": "629d52fc-a774-4b69-8748-556291ba30f2", "value": "T18B42B0063E983B0BE8A187F1FF3AAE66B2009D8E672F940FD595256154F3166F500C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299718, "uuid": "47307326-64b0-4862-ac30-fc85ee837be5", "value": "192:YTmCc4HnYXvQ2mDuYedvuXH2oLxZ6qSAM9vrqj7/sBJ6HGpTJDqiwOrvw9Bpjdyx:YTYXvQDuYY2xZ6VTgDK4mpwTl5yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769299718, "uuid": "46feb18f-ea56-4e41-bb3c-2218f1a28f97", "value": 12492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769299718, "uuid": "120697e7-c643-41c7-8295-ed5445a8e488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299718, "uuid": "6ba2181c-8b76-401b-8ea5-e92e6181a7ef", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e780f52-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331311, "uuid": "f0ed4345-62ee-4b45-b595-d41e93f3dd5c", "comment": "Malware payload", "value": "6d7ac6bd5e18de4bb0efc5dd44b8caeb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331311, "uuid": "41f43680-897c-4e00-a4dc-f6469ac9c3b1", "comment": "Malware payload", "value": "b56f20c51c18c94923000949a1685d72e1b8f692fbfef29f0feea9252955da6b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331311, "uuid": "d913a8ba-a43a-400a-8251-e4211644c47b", "comment": "Malware payload", "value": "92d6bde5fa7d0e49f2faf117dc17d7240d867724", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331311, "uuid": "3d80355d-ecf0-4c7b-93b9-8ee988c5dac7", "comment": "Malware payload", "value": "85ee105f6d41bd44e23cf8533e7e8e0ee1eb259abde748740d1150c758d4719ae10f6f16d3d6c9cd156ab73dc5012c17", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331311, "uuid": "23057da6-04f3-4a81-b47b-a4a69aa849e0", "value": "T114E73320B17668D8DA1F93BFE4A85FC884307DE0B31BE96B73787FA545B064621B5807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331311, "uuid": "bfb0bd9f-75c4-44d6-9a7d-874ba7f87bf4", "value": "786432:XPj4evQgcrDj0SoeHLLToYLcB/f15XeE64M+PE684X+I785HC94UrF0WmQ9hu3A5:TkPj05eHv0J/lMo8WP4cOoUKwgRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331311, "uuid": "9e17d34b-b7ca-44e7-b37f-66311c171a40", "value": 65101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331311, "uuid": "7734688d-ed11-4544-9b2a-4dc408768a2d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331311, "uuid": "56bcc480-3a2b-4f4e-9087-7d0b63dfc45f", "value": "DeepLSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955c019f-f9d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769335188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335188, "uuid": "942e495a-5598-497c-9872-368702c49d8b", "comment": "Malware payload (Mirai)", "value": "db455e818d4398792e68892a17dd6fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335188, "uuid": "24c0028d-2915-4874-bbac-8eb8fb0de2a9", "comment": "Malware payload (Mirai)", "value": "b62ba96ecdcf779deb0ba81714233537bae79e959899733abb3c19f2f33df9a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335188, "uuid": "e5b5841b-85c5-4f75-9675-0577313efb11", "comment": "Malware payload (Mirai)", "value": "9f66512ed18e28550a165104ec5fd8d0c9247711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335188, "uuid": "706f2879-5de1-40ad-a011-bc9f3f0abe3b", "comment": "Malware payload (Mirai)", "value": "358c5d0c2d460975b37ecd26f3743c6858dc31137ee7d3fc3141d812f550b2f2e050980e6fb56f27927fda67ce60da88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335188, "uuid": "116246d7-610a-4132-aa4a-63d0f8b830bd", "value": "T130F46A627721DFA5D354C63005F3C7615AE525A21BE2808AB27CC3287A51A6D3D2FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335188, "uuid": "58eb28d1-cd21-4494-bb63-3f174914e1c3", "value": "12288:hqHt4SHPcSz/6fS4jkGeffwEWU2A3x9/8p5ZfjUrqnx+koW6:hqN4SHPcSr8SYkGfEWnA3x2fwCEko1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769335188, "uuid": "529c84b0-49c8-49c9-98d0-369de75f116b", "value": 749576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769335188, "uuid": "74c1e891-573a-466b-95a1-fe3a1c337522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335188, "uuid": "1b1b033f-4098-4156-9bae-b1165fa94fe1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a2846a-f9d0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769333360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333360, "uuid": "c88ffe62-d1df-4040-a97d-c084fa878063", "comment": "Malware payload", "value": "f6a0a87061d445cf07176a2bd649bbbe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333360, "uuid": "2f0f1e25-d60d-4de7-8358-dc61bdb22201", "comment": "Malware payload", "value": "b634c603fb12257cba70f63ed9dccabfd3c31e2ef66feddfc8927693f5a24089", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333360, "uuid": "c9c477e8-6537-4b41-802e-3094ed1d8489", "comment": "Malware payload", "value": "63b072fb8c70e60893b0eb37a2f945ab5d0cb401", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769333360, "uuid": "3e517621-cf18-4462-9347-3622e56d386f", "comment": "Malware payload", "value": "89fe0266aadc4f3102570e53cd298081cd86c4c2bd203ca58059a94a3852b1bb922124a50e16b3728c74a68ed6f0d273", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333360, "uuid": "36262f7a-542b-461e-a5c1-0fb8892faccf", "value": "T1C051138FB9554FB03AA945B45287B2C05E42D7B75B929B24D6C0FCB430AC215F92F9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333360, "uuid": "650eb930-ff5f-4ca1-acdd-012ac4520576", "value": "48:8wGWUbt+8jPijaaT3UO1wGWUbt+8jPijaaT3UO6Bhy:9GN5+8TYaaTZKGN5+8TYaaTZSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769333360, "uuid": "a076aedb-d5be-468b-a68d-90251e7bc1f4", "value": 2500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769333360, "uuid": "6e9c8608-7964-4d4d-bb5e-6f8e68b8b878", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769333360, "uuid": "d04c87fc-ec05-479e-b163-790cee61f167", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75779c5f-f986-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301634, "uuid": "d4a17fb6-af2c-4ee0-b08f-79b86dd30bd9", "comment": "Malware payload (Mirai)", "value": "631c130927369a33e1743d7282512113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301634, "uuid": "9db31c19-6545-407e-94a7-605a4998b6d6", "comment": "Malware payload (Mirai)", "value": "b63a620483d88ff344c6c259d3614511e3c2892136595fc2b5a64b984d9c51b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301634, "uuid": "a8954221-2a06-431b-9532-eedec83cad91", "comment": "Malware payload (Mirai)", "value": "a604acd02ba17faa7dbb55169c478e15a956dbbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301634, "uuid": "b3391cfb-47d8-4fe0-bb22-8cd90eedf03a", "comment": "Malware payload (Mirai)", "value": "8052039ae87cae72d8f20b3f7a4120a69a7634c7dcb529d90b3a0eb495e69e9e1c8bee5f7cf66a981abe922b7c035ed5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301634, "uuid": "53991c08-8c7a-4766-a640-4f7b725d5631", "value": "T1E2B30691B8829A2B86E423BBFA6E018D331967A8D2DF3117CC215F2577C591F0DB7781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301634, "uuid": "8b4c022d-93e3-4957-b75e-5c2692f8aa29", "value": "1536:9ZrC6uZMkwCc5xFKqJ2AjHSUIOQYacwV84V77X1LpZVoGQN6ZTrwhiA9yC:frCukwCoqUI8677X1toNN6dwhp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301634, "uuid": "3184f120-f2b4-4efb-8b71-5c208c1aaded", "value": 111423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301634, "uuid": "381dde0a-2b09-458a-8bbe-b1e0713ac8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301634, "uuid": "f15dace2-2794-4ab3-81ef-eb0831899ed7", "value": "systemx64.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afc4b12-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362121, "uuid": "98db3ebf-9c4d-4abb-8d87-fdd2746dcfd5", "comment": "Malware payload (Mirai)", "value": "1d1675775f7c1f429ab06d280ca69682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362121, "uuid": "88f5cc9e-2d68-459a-ac65-6f9c34259bdf", "comment": "Malware payload (Mirai)", "value": "b69499047eb095863401c31bb8a39e9b6a3cce8522bc67cb7ace855a31a08e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362121, "uuid": "90fb3a45-0039-4ebb-87e7-36fefacd2ef2", "comment": "Malware payload (Mirai)", "value": "f985f86726ceeb89c3d61bedb2947f486ddc8d93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362121, "uuid": "38d3a6c1-3921-4864-a893-e99a40d6838d", "comment": "Malware payload (Mirai)", "value": "a8c7a51f01625c6b52a2e07776d3dc8ae56f6019e398690075050b3df6fdaa0f7d59f9adc821a856702d8c30cff91b1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362121, "uuid": "aa63b07d-e09b-480b-a192-459acc3e1fa4", "value": "T167D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362121, "uuid": "3ae2c5d1-3176-4d65-897e-df48f55db997", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zw6:xOFgpOEoVv3MXL5NhGOw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362121, "uuid": "3186dd8b-6ce1-4b99-8706-a76e3ad3bae3", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362121, "uuid": "c8132782-7b9c-4869-ab1c-b7713f192165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362121, "uuid": "01d0d09d-e8d5-41a2-94b7-a24b3ebb04b8", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d3ee8-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384124, "uuid": "c86af316-785f-47d3-90d1-be0e37e2c358", "comment": "Malware payload (Mirai)", "value": "e4e702be5cd822ec936547dadab7520d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384124, "uuid": "6c24faac-6c90-409e-842f-1d73f38dd8bd", "comment": "Malware payload (Mirai)", "value": "b6db8bb39c7305a6a0a1024ab9b51e7d7b4c016455865504909644b4381ede78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384124, "uuid": "c8ec2a62-1c95-47d8-ad6e-b8b8413e7aec", "comment": "Malware payload (Mirai)", "value": "929f975880124be45ea43484ce3b5b6980d99c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384124, "uuid": "d0f979af-fe9b-4675-a0ee-3db376b43d98", "comment": "Malware payload (Mirai)", "value": "d2fc106e5364ce1c57a283a1f67816b3b21e917b03198e892f6ffbc40eeb0b531da8f3e6afe0956a1a1d0ab7f85a729f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384124, "uuid": "b9c77bcc-ca1b-4eaa-b88f-5160201ca9fb", "value": "T107535C17608290FCC4DBD2B85B9FB536DA23B8A91235B17D27D4E622BECED201F1D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384124, "uuid": "dcf68a55-603e-4bb7-b5ea-76e7032dc208", "value": "1536:Zg1p8Eo8mOJ+67E9jg8SEqy1OOrW/bEHvAWdQmwhT0:ZgoEdd819jg8Se1DrWbuAWdChT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384124, "uuid": "7665a800-24e9-429a-ab20-fa91fae04f78", "value": 64192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384124, "uuid": "b7bf130f-ea92-4c02-87c8-d3392fdb980d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384124, "uuid": "0af7d79a-bad3-45ea-9ec3-e18666dfc31a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf90daf4-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304362, "uuid": "f92eef9a-5224-42d9-b67f-be4c39873df8", "comment": "Malware payload (Mirai)", "value": "7b79c2da642f3ae317624dbcfb5aafd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304362, "uuid": "0f9148c5-a31e-4c07-8d40-6fe906d21748", "comment": "Malware payload (Mirai)", "value": "b6df21436b4f21f9a19fe39c34557086cc3454c4a832cc181d8f6d15d6fb93f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304362, "uuid": "d5dd0d40-5251-4338-bc66-5e630a323040", "comment": "Malware payload (Mirai)", "value": "8f0953621fcfb24471f81271dc3d4f16b49ec734", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304362, "uuid": "cf4895d5-3f61-4a1f-961f-905afa47e8a7", "comment": "Malware payload (Mirai)", "value": "98582773f6e60bcdc799bbef9fb7c6e6cb8c1efa6f622d805ec2dec3ec73bef8fb651ace29ec8acb097461a0e475e6b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304362, "uuid": "713e5946-e69d-457d-8654-0662fbe68a5d", "value": "T192C2D144F041CE01DEEB19F52E50CADBBBE46F1EAA528E8126B053D15A5D2A74309ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304362, "uuid": "21737f0f-56be-4a08-8e67-1bfb5316e47e", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PQ1+54uVcqgw09u:mam+AnKehPRa9aw+54u+qgw09u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304362, "uuid": "2686d0fb-c28f-41b3-b81b-5d6e24c3a465", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304362, "uuid": "8bfa065e-81b0-4a81-8920-294ad0d73dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304362, "uuid": "46f5457a-7eb0-476d-b10b-b7d3b4bdf208", "value": "cosmic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a0533c-fa0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769359421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359421, "uuid": "f1d63c3a-4c2c-4248-9a91-2952d5316c58", "comment": "Malware payload (Mirai)", "value": "42cd7b469ea60d05e6d8136901b22bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359421, "uuid": "c8b916ac-bcf4-44f2-86e8-ea6daa180f66", "comment": "Malware payload (Mirai)", "value": "b7913d9d9173b2249267c9c78f24be788ab1bc45483e4c63998fbb106c12cc73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359421, "uuid": "00916d72-ba14-44b1-a58c-c222a7e67696", "comment": "Malware payload (Mirai)", "value": "be340c471668a4d47fc8985e06fe9940fedbedb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359421, "uuid": "3c324001-99b6-4a42-a127-7c84462e9bb6", "comment": "Malware payload (Mirai)", "value": "76b8e62023ef05dbdc4fbe5dedf555dbf681d0d65b22b48c5dbf7c53d47554297783095ea6843f9b0d68180a10cb389f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359421, "uuid": "873baf8c-4f15-47e5-87ce-c0cc7f987496", "value": "T15504392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359421, "uuid": "8f79e137-4fc4-4d75-a18f-d6eeaf71676f", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wUUXS:7eJpJUVD1A8n0YNgEJi5aVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769359421, "uuid": "ade35fb5-4c06-4e03-9d63-1af77a9042d6", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769359421, "uuid": "7f118e85-f2d2-440d-bcfc-73a2c7ea4fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359421, "uuid": "814c72a0-1b11-48bb-af37-98c5ed174043", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eb1f05-f994-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769307458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769307458, "uuid": "0935c41d-9961-4d67-850f-ba14b7985e38", "comment": "Malware payload", "value": "31d96f006c70542a283bc841d908ebca", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769307458, "uuid": "2a813ac0-3079-4e19-bfc4-1010ace9f941", "comment": "Malware payload", "value": "b7da5160a06a5748a34b35b1649dabf8fd955c2fb8dac481a00ce7f995116895", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769307458, "uuid": "d8fb45b2-6e81-45a5-a72b-15d3e848a201", "comment": "Malware payload", "value": "a66cf89224550a89eb598ab24c38131601b97046", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769307458, "uuid": "0480f993-83d5-4194-a3d4-f55d190a3f6b", "comment": "Malware payload", "value": "afc3fc5d9f707f0969a70b4854ed25eafbd201859e0fd717bebda5827bcd562de679c95145915f4d3a03245677e02727", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769307458, "uuid": "8ee00d7d-56af-4ffc-884b-d66bec87f746", "value": "T1CAA5F12AE595E0FDF92781B59A4285C5E922BC630B252DEF13F0CA6DDD128D40F3E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769307458, "uuid": "76c8f8ad-fcf3-41bd-a45b-7a37157b2e27", "value": "155dfc2d31fa3e5e20315bf41423c877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769307458, "uuid": "9e5c74dd-649c-4a18-a8ea-30ef96171ae1", "value": "12288:WCqu6anadXg2ES4cNlv9m/8uwTAKECGXOIehrDXJwoW:XqJan0XeG7xECjIo3JXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769307458, "uuid": "cda83571-b7b2-4621-9e1a-f97d4ada5b54", "value": 2112512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769307458, "uuid": "23ce0fc9-8296-4ebd-accf-8cfd2a6e2ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769307458, "uuid": "7df2bbe2-c02b-4508-9482-b27dddb9bf8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d840a52b-fa18-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769364506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364506, "uuid": "54be416c-cf58-4442-8ff6-5a743be05bd5", "comment": "Malware payload", "value": "861a90c3ee4c5fa55d8b19852a3fc9c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364506, "uuid": "cee1a5f5-3342-46e0-9e0b-01dc3824f8a4", "comment": "Malware payload", "value": "b7f28fdcd69133fb2a84808126b681e357efad7856b6ff67c266a92a711aad18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364506, "uuid": "9ae1976b-28a5-40bf-a26a-a87609735a71", "comment": "Malware payload", "value": "acab5562621a3ebe1758ddadd9ed9d588ff85892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364506, "uuid": "3f3fa67b-99a0-424e-8958-b5668e227ebc", "comment": "Malware payload", "value": "ea42bf11bfeb05a086115d0f7db8496820caa15c67e0e5658f010b0ca8adc8796819688d3cf0d2318fbe20496be2e67a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364506, "uuid": "9d4ad078-77a9-4db0-819c-a12e42562614", "value": "T1E593288ABCC5C702C6E061B6FF1F559E371643A8E3E6B107CD19AF29634B8970A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364506, "uuid": "61cff691-0abe-42e8-a192-1b1bfb0c6823", "value": "1536:/dSXJWmACQfs528Qwxzk4MBAe/iagg3I92TB5FY0Jw5Qepijy0X:/MZWnC5ZQYNOA2iw3I9SFK5Q6iW0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364506, "uuid": "ada34988-3f66-47c2-875b-c67f3d194058", "value": 91840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364506, "uuid": "d1009d66-133e-43d4-9f1c-c1b3ffc7299f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364506, "uuid": "2561acf0-0008-4501-8941-b98ac3ce7946", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987bc513-f9f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348937, "uuid": "b39694ea-8a81-4fbb-9cd4-f542c2d77004", "comment": "Malware payload", "value": "be74e1210d3b2eba6350e4cf1a5cb141", "object_relation": "md5", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348937, "uuid": "191c38f8-6364-4ee9-a74e-8bf9e13ab6ad", "comment": "Malware payload", "value": "bc7e5be3f88e7b3070c856948862a024d280fc344d5687789a3402e875a7ce28", "object_relation": "sha256", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348937, "uuid": "df3f769b-1dfd-4227-a740-753a568ac64e", "comment": "Malware payload", "value": "26926b51516d66e6dfe969119c551026c371f4b2", "object_relation": "sha1", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348937, "uuid": "b9807797-9c6f-4caf-9e8d-b823d3b88974", "comment": "Malware payload", "value": "da194e58df2ca8b3dd39c4f32188d32a0e3e803fdaafa27804dd65667fd2fba0a47ce6b1184b9ae97d7655adfc114d5f", "object_relation": "sha3-384", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348937, "uuid": "9af2b153-8a05-438f-8ce2-01b8e60336e2", "value": "T11F84CF369E57DCA741C8B3C7CACBA655EE34419F637634C832EE8184345DFA853889AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348937, "uuid": "e3a11a58-b976-440d-b091-535ad17326f3", "value": "6144:rqFnu6f4riNBWMndYHTBr/Or1ojPmDsGFzaxmTXOEHHGsxJr:r8lc6WodqN5qNpagXOEH5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348937, "uuid": "1132ed02-bd49-402e-9174-b3b4c666da2b", "value": 374736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348937, "uuid": "d7f18794-f82f-4a72-98d1-df340c0c72cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348937, "uuid": "2d05ee0f-83cc-42b0-8418-c138b2e964a5", "value": "d2ifx.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabc2816-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354551, "uuid": "6f735d56-65d8-446f-b2e5-cd2dfd41868d", "comment": "Malware payload", "value": "199ead300916a751ba08f9041d9ac9db", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354551, "uuid": "2290e14b-e34d-4054-8319-578c9cc43db9", "comment": "Malware payload", "value": "bce4d055d5aefc9635532df9112c3b710c6e3e5ff21662538154f1c468daca87", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354551, "uuid": "c6658a59-f00e-466b-b019-ecc54b44fb33", "comment": "Malware payload", "value": "c1591e852f95991fb35d675569925a4b018830c0", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354551, "uuid": "219f49a2-827d-407d-bef9-aab4259b813c", "comment": "Malware payload", "value": "16077417208cb2bf26f71c13795e714aaedbea4a4e3c998e02113c94af5997e5f3ee712cb36d785e1b8ce6e88edca4e9", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354551, "uuid": "b2861efd-0bae-4ad9-8c7f-95371ad5eb0e", "value": "T167C02BFD0B52D95200C10CC17052F4204CF1E3C07248B02004F870820F0594D74E58C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354551, "uuid": "d0d202b8-8c01-4c60-9beb-44753b272c12", "value": "3:Mu6vsUSKYRQRQ/ReZTW/g0qYGRXkZiEDjNVHqKpAtzMFvn:96UUGRQRsoZTW2YWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354551, "uuid": "13d9ab66-e769-4e6f-bcdc-e0899ee3da0a", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354551, "uuid": "7437dccc-6b58-4830-a408-c1028cb66a19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354551, "uuid": "5d5c92e8-a8b9-4f3c-b493-eb5d88077de3", "value": "Y447092918.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda8b11e-fa43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769382983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382983, "uuid": "24a30afb-5b57-477f-90b2-71969b431133", "comment": "Malware payload (Mirai)", "value": "7b5b73f33f56edcbabafcc8a67942ea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382983, "uuid": "d0a9eadf-c854-4ec1-9378-f9a3498b77a8", "comment": "Malware payload (Mirai)", "value": "be77821cbc0721cf763ab087fc78333b954aa50c7d8b7d9548d68117c21e3529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382983, "uuid": "5fccc9a9-1842-4ce6-a391-01421c8e8061", "comment": "Malware payload (Mirai)", "value": "d77fff466fcce604cabdc5dc5b7fd3b80d7661c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382983, "uuid": "edcec9ce-2601-4ab9-88ce-a90213038948", "comment": "Malware payload (Mirai)", "value": "b13ec91df47fee89ddfe35c128bc32789d4e3a81c45453de5ef183a5e087c0a6a6f5777f20306ac6502e32f36c13115b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382983, "uuid": "55ca52eb-bc6f-418c-adbe-f6f452a69050", "value": "T1BCC3D40ABFB11FFBE4AFDD3705A60749299C594621A93B357674D81CF21A28F09E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382983, "uuid": "958e9b21-6302-4ba7-a35f-6c3a71fe4256", "value": "3072:CtBa061yfEkFRTxUNxgUmgdcJ6rVSuRX:CtBa06YfB7T0RqJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769382983, "uuid": "c3dc0211-1548-4751-8002-afefda354e16", "value": 121700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769382983, "uuid": "792b05d9-d1a9-4602-a496-d9792c75079a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382983, "uuid": "0a83c42c-3f7e-42f1-88e7-1e696cb2ee68", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3842ed-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302482, "uuid": "d60eecd5-24e3-433a-8176-2b44c14e9348", "comment": "Malware payload (Mirai)", "value": "a5c8d17164aea413062121f319da5889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302482, "uuid": "28e5d272-22d0-45a9-a012-943ca5e83e21", "comment": "Malware payload (Mirai)", "value": "be9b7c0604b9500bfaee3cf49abcfbaedd62b5815499a9f06959ef1d60c0a7f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302482, "uuid": "df73f427-499a-4c65-bf0f-a027086a196c", "comment": "Malware payload (Mirai)", "value": "0f9878592ccecfd8bc7bee7e99b0263666b3774b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302482, "uuid": "c932032e-de1e-4343-91d0-204c876c44f3", "comment": "Malware payload (Mirai)", "value": "2c37885383620c3a2e06b29a3e2a846d326eb4c5e1992056baa951428dd1eefb0965b24f27e4260b8b05a975c13eaa31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302482, "uuid": "265262e5-8cd5-4dcd-89a5-7e4d769186ac", "value": "T146D2D0ED360300FAE54888F48BD003965D105BA75249FC6BA7A6F65F8D9E5F03497AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302482, "uuid": "9932ac37-2bd2-4c4e-bcd3-1f7ce52e38ff", "value": "768:fAcua9vOxCgj6M18i0OBhPuN2+14EnyQdwSVkJgGlzDpbuR1JV:fIa9vOBj6YPusg410r2VJuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302482, "uuid": "e18dfaeb-2e81-4b69-894b-b9493a57509f", "value": 29076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302482, "uuid": "ad13afc5-17a4-4a37-94e6-de6e7c0d8944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302482, "uuid": "ea5956f3-897e-4254-9989-c6c5fc9b48d5", "value": "SecuriteInfo.com.Linux.Mirai.9788.24687.7816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea371f57-fa43-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769383004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383004, "uuid": "76a4f73c-1194-4dea-badc-b308c4d6024e", "comment": "Malware payload (CoinMiner)", "value": "98975a0764eaa7fd1f811788fb27fd62", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383004, "uuid": "59ac069d-3a62-4173-ac16-072f68ed4b4a", "comment": "Malware payload (CoinMiner)", "value": "c02f4577df223f02f532d0999d0f9f6c160560deec1925390db05e552eead07d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383004, "uuid": "71afd393-1d76-49d1-bde9-48e2274d26fe", "comment": "Malware payload (CoinMiner)", "value": "7533ce11be47558f700ff45d87f4c56bce0029bd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383004, "uuid": "81039e0d-eccc-4250-b4db-f1083d87ebf9", "comment": "Malware payload (CoinMiner)", "value": "d94f9fb134e744ded630c184b340ac8e98cb338c9596c42ffa76787f893621850bff7a3c735d617ff4d13a1880c36dff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383004, "uuid": "a3718ebf-b94b-407a-a855-2cf11de5413e", "value": "T128E6339733A80935E8E5403F46A79006D572B8AB87A885BB13F4626A7F335D17E34F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383004, "uuid": "de3491d0-ea30-477e-9fc2-d25f465198be", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383004, "uuid": "92aaf34f-e35f-4152-8ff1-18c4cb5af8ac", "value": "393216:rfSaM0tmurEUWjdaXVJTcoW9UWNOrzO3KWX3zLpEer:rf8dbdmVhcd9UWNOOJpEer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383004, "uuid": "d59ab66a-9aa2-4c5c-909d-16a2e4bbe6b1", "value": 15211816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383004, "uuid": "a2a7af72-3d9f-4bba-9731-487bbfe4d69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383004, "uuid": "af2c9723-f061-4359-a0d3-0f81a765c5c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c3a394-f9f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769349525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349525, "uuid": "cf1f48b3-1af1-4c64-8360-98634e77ae46", "comment": "Malware payload", "value": "b0fecc7ee3cbb6ac4255c1bd94eece8d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349525, "uuid": "2c89d312-15c3-4049-a935-1e3beb870fff", "comment": "Malware payload", "value": "c0ae241d60442044c232ea27a9af959eef19fde8f6bc0a11de44b87e56c697ca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349525, "uuid": "c79fcde7-79aa-4588-a0ee-6ec41fee17f1", "comment": "Malware payload", "value": "f7c5b4cd66952b5b13ec90884f3ff371679f6652", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349525, "uuid": "6a727345-bcf5-44c4-80b2-c629a6c02ac6", "comment": "Malware payload", "value": "3dfea696b00fb56024ec36909480fb7a8eb924a44709c7efba522aced51ee65b69a05788f7dcc6acc566a5a2b94222dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349525, "uuid": "80c2649b-a2db-4b76-85e2-6e5bbc074fe9", "value": "T1A6E633B302BE0985E917B83420E6A74DC15A096895CF1A72D71CCB61319B8DFFCFD998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349525, "uuid": "221e4d97-a545-490a-aa21-2eef94d3f995", "value": "393216:sJf9B6McNnuI159+U4gsX/2tkpim6XHDRBP/Nxg:sJPjcNnv1z+Atk0muv/NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769349525, "uuid": "78afdee7-d691-437e-b088-df8c22205627", "value": 15048316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769349525, "uuid": "7abac230-37bd-4540-9015-b7a35e292018", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349525, "uuid": "414047c8-76ca-463f-be9a-71f5c3ce68cc", "value": "clike.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed1590d-f981-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769299716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299716, "uuid": "99316478-c630-4274-a247-44d13cd47cb6", "comment": "Malware payload (Mirai)", "value": "d747a4e129f6b41326a488ef36ba03ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299716, "uuid": "6446442a-8a8b-40a3-b328-761ebb2088c5", "comment": "Malware payload (Mirai)", "value": "c0f4e3dac179613297cd7898ad6bef9f17b83b7bd8e257c82e6b64d2ddeaad7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299716, "uuid": "525aec4b-e896-4de7-a120-f21376a75381", "comment": "Malware payload (Mirai)", "value": "3b63db18b8cb2e6dfd6d09e5062007eaff9ce785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769299716, "uuid": "351b855d-8b4c-44df-b922-acfee5e2a45d", "comment": "Malware payload (Mirai)", "value": "a6da11d79d7a489b6acafa2e28c586060a861b4ef276cdbc382f376bf019b6e61b124234ae6dddba26481f592aa27b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299716, "uuid": "0be49ad0-0cec-434c-b29f-ead92e39b084", "value": "T1CA835B11ED786E27C5D0717A51E34630F5B643992ABC5A0F7EA31D9CEF14320312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299716, "uuid": "f9724215-925f-44a0-9160-0f0ee7f03bee", "value": "1536:954vvmfwmaDttPYHn0wMNmukgflGPbFIRqwusnA3:/84rWtHNFsJunA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769299716, "uuid": "4b1edc4b-aea9-487e-82db-095bc13c83d7", "value": 88536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769299716, "uuid": "f522c334-d509-472f-8002-3bf7888663e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769299716, "uuid": "fd0135c6-00fb-4299-9d02-66605f566335", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca83c2e-f9f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1769348353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348353, "uuid": "d59d2d1f-0eea-4a29-bcb9-c9685cc40e3a", "comment": "Malware payload (Efimer)", "value": "b2d4d232018673f862c5b3e5d896e9c3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348353, "uuid": "267060a1-0079-4d67-8c38-f159543f2874", "comment": "Malware payload (Efimer)", "value": "c1cd2963be395254779b46007fc7b040f697dce0f8785662f30dca1e637db9af", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348353, "uuid": "def8f089-4936-48ce-87dd-fea88c22404f", "comment": "Malware payload (Efimer)", "value": "bd4f99ffbbed35b768b0dbde4b87d81a1533458b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348353, "uuid": "f41fbb70-8f0e-4205-9777-982e5e71a149", "comment": "Malware payload (Efimer)", "value": "82e1cddf345a89416a13b5e5300af4e0b2fea1fd13202a39264e33807b3899d3b1fd87fc0fd942bd47a7913ba26a68cf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348353, "uuid": "26cfbfcb-8441-462e-ace7-292843bea43a", "value": "T1DBD6338851D555EEE6E3807CFEE261A4E868B8F65332C69F17F88361AC135D08D3A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348353, "uuid": "f96de09d-58e2-4fc3-a841-949c8219ef94", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348353, "uuid": "6dbdc388-7302-403f-b2b1-e15fb581d45c", "value": "393216:zyhqN3alog90qGhXMCHWUjicuI3/PkuUS:zyS3Hw0qGhXMb8fH/sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348353, "uuid": "6b07dc05-7c95-477d-b13e-5e5a8f5b7557", "value": 12763819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348353, "uuid": "d84fc09e-1a69-410a-8e0c-b1b86aaa9c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348353, "uuid": "23a626eb-daa8-49bc-853b-2e139edd326e", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df58a27c-fa2b-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1769372678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372678, "uuid": "f461d056-5819-4a69-a930-2e95a0e0b3d7", "comment": "Malware payload (MaskGramStealer)", "value": "72b8eacdc04f767d3f6daa0e46a4f838", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372678, "uuid": "657f57eb-2c9f-47f5-ba11-4d3593b50848", "comment": "Malware payload (MaskGramStealer)", "value": "c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372678, "uuid": "edcb4e6d-bd7b-4d5d-9948-b194b87e9cf1", "comment": "Malware payload (MaskGramStealer)", "value": "72232bc762cefd130644f2252f252028b5251a9d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372678, "uuid": "e75b8de5-4fc8-46e1-a614-e396b7e31276", "comment": "Malware payload (MaskGramStealer)", "value": "617ecd2b3ca92015ce720de22b65a566f6c80398d7d8b13671ad8c0cd7c7cee205a53973ee5a7b00e2872e537f338a79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372678, "uuid": "9438bdb4-b51c-43dc-b576-10a79c43bf50", "value": "T196A533DD47E62A03FADF42B2F21CD4176B9266D607567DDE8C0812AF194D86DE8B0332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372678, "uuid": "4a953c01-cea6-44e6-ac50-b14ffe8a1960", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372678, "uuid": "9528bdc7-5bdb-4b2b-ab59-7616644aef6b", "value": "49152:3JSg8P7oEFKGjLNpYubbzV0HC6WHPCKw6VfSm+EgkS:pi7dpLXYczWC61Kw6VfSm+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769372678, "uuid": "89a7997e-4743-4867-b284-467da1c3c1a3", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769372678, "uuid": "2a494080-0a4c-4d07-bc96-032abb043a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372678, "uuid": "a04077ac-ff7e-4cfa-8f29-089d19f57fe2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960a92f5-f9d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1769335189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335189, "uuid": "649bbbdd-8910-40a3-a954-74a749eea9cb", "comment": "Malware payload (Hajime)", "value": "2df2fc18a312864aa8e792ce61f97b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335189, "uuid": "54ad323c-484a-4280-aa14-e2c63336fb1e", "comment": "Malware payload (Hajime)", "value": "c2afb4d7beeecf012db64b898e70d741d2f211158f97f44d2c910e118a1aa7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335189, "uuid": "f663b236-a3c8-4efd-929e-3ada22378819", "comment": "Malware payload (Hajime)", "value": "4084853773b6aac26899222d9cc6d8586f5bdae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769335189, "uuid": "1ae0fb94-ab3c-45f8-bd7c-9eeab2a959e6", "comment": "Malware payload (Hajime)", "value": "ee03bac008a0abde35d4a444e4eb5a73c8fdd12db48f9feef96f8e1eedf96e67aa6cafbd5aaa1d380ee29cfd50a3da3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335189, "uuid": "44183c98-5ad9-4838-8a7c-563dca2c88be", "value": "T1DC23028623663F72D12158F5E7FCEF85A04A7D94AFE6180E7C227698B47135C28C8D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335189, "uuid": "d0f3d552-d221-4a5b-b3bd-8cf6f76b69c4", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1Xo0Wg3+:yYI0ARqw1qAEW67UIWi7M8gmfmJo0Wgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769335189, "uuid": "ebca7e0a-bc6c-4803-b3ca-0f8c82723d91", "value": 48528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769335189, "uuid": "e5b660e0-ad0c-4b9c-8d07-b9cc77f0ee59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769335189, "uuid": "075dec46-8631-4518-be71-8508ddf47f3a", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adb5718-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331224, "uuid": "f2d7e7be-68ce-4aef-8cf4-b022bc5f9712", "comment": "Malware payload", "value": "54e37546786803f2b81344ccafe6771a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331224, "uuid": "dfc85271-2afa-49ff-9461-6a9a307cd502", "comment": "Malware payload", "value": "c2cc6e0d8d966dabc13cd923f3ebfd1069e1f80f251b9ae0569eb99f970887cb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331224, "uuid": "dbe508ca-ad04-4a95-96e2-b07b3e3f4291", "comment": "Malware payload", "value": "17c224b5c3d19b13b7308bd7acc3e14bc8fb4807", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331224, "uuid": "0aefb69d-dd7c-4595-bbde-57d4ad884701", "comment": "Malware payload", "value": "3f45922b0badde15695ee603a1150dd11daafc58875497d2b2b8c171c7ab0fb8d291040ee2f6be7d31e7a424bca1b065", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331224, "uuid": "ec32b89f-9582-428e-9dd8-afab53513efb", "value": "T17486E121759DC132F66F02B1962DDA2AE53D7DE20B7004EB93E4F95A6A304C25339F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331224, "uuid": "c7ecd722-d3e8-4712-a388-3a95ede27301", "value": "98304:cd8yXKlFC2YIddGb8zYIxdtaW8lc1KVl1OEB6ioKopx3djKI6VOP+NswnLR:K8yalQ23d9zrtt8AIlqXD3AI6VPso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331224, "uuid": "161f6a5f-93d9-4ae5-9f8d-7eeaf1a29379", "value": 8458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331224, "uuid": "7c2b7ffb-00ae-48a6-ae99-c400ea30ce74", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331224, "uuid": "ec8ed052-d3bd-40f3-82f7-13bb7fbdf9b0", "value": "Linest_chuani6x4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e673b9bd-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload (MimiKatz)", "timestamp": 1769331458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331458, "uuid": "818b1d59-100f-4e87-83de-70c134604421", "comment": "Malware payload (MimiKatz)", "value": "87d1e02fc739172035e528aa8bb38006", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331458, "uuid": "3fe3b2a1-74e8-44a1-910a-c88a605cb048", "comment": "Malware payload (MimiKatz)", "value": "c2ea5bd256621c9f0ad164139ecda59dbaaebdd4d14d6f200eeac0506c6900e8", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331458, "uuid": "ec7d529d-8109-4d02-8b36-5141e6b3dc27", "comment": "Malware payload (MimiKatz)", "value": "58525de2edf2af4d03bf71517c95bd4d8c95ab20", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331458, "uuid": "5f53b890-b44f-4ded-a8bd-1c1c3f952522", "comment": "Malware payload (MimiKatz)", "value": "017ceccdf458f92efa0528cb603d29889b2074de5c62fd0d8e6bc306b21a23f0ff8aaf14accac4e30da19b2799e35cff", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331458, "uuid": "ddea8413-94a9-4486-aca4-6d444a523666", "value": "T103C6231175CE8676E67F803455A9DB3AA2F53EE1077250EF53E0896F0E325C10A3AF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331458, "uuid": "a92eb176-d5f3-41bd-bf48-d2da61650f6b", "value": "196608:CM+tyfVYHj4ZkCFDKoIaNrml1N8h+fJFonXzRVao86wFcifLSfff3Kq5sft08LFf:CMuyfVYD4nFiaxAi0JFFo86UxL0fytq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331458, "uuid": "0732f811-54dd-4323-ac9d-390f6db1de96", "value": 11968000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331458, "uuid": "dfcf4f09-fdef-4d48-9b8a-b967e26a9c3f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331458, "uuid": "625604de-a4a4-47fd-b0fa-d175198fc88c", "value": "leidian-2.3.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7685302a-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354463, "uuid": "6623fa28-8a8c-454a-8137-af5355bbd225", "comment": "Malware payload", "value": "217d88afd55f6a5d2f6213fb34bcf91d", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354463, "uuid": "226ef3e5-6b59-4354-bb14-7aff1809a118", "comment": "Malware payload", "value": "c53d5cb53a38c7200e6df7dafd1d9b47d49f039789c6c353148c27c5146704b1", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354463, "uuid": "82236bc3-1620-4fb9-9eec-7a9d25808be6", "comment": "Malware payload", "value": "efe4469a61faa0e5576115615bc37c6630543596", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354463, "uuid": "83c28978-8261-4161-ae8b-c56134acd7da", "comment": "Malware payload", "value": "8378062673755e3b243e2c0e63e887a2cf91dca8cf65b35c26778391831e4eabd204963b3564de23f50213a884a5dfe7", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354463, "uuid": "af8bd8c9-f230-4bfe-908f-d5a0ce26e245", "value": "T1D7C02BED0914C52104C00CE1716274609CF1D280B240B02009FCB0C15F6594F38F9841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354463, "uuid": "c25aa571-2817-41e5-a7f2-b84d44d79fb6", "value": "3:Mu6vsUSKGdhQQoKlSnSYzT0qYGRXkZiEDjNVHqKpAtzMFvn:96UUYzllcSk/YWDEHNTpAtz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354463, "uuid": "bcc0bfb9-4fa0-491f-9eb9-ce91dbb46896", "value": 139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354463, "uuid": "004c8d61-401f-49b3-beb5-ce7a5016b487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354463, "uuid": "fc8d990a-9f24-40a9-9f82-120723ed018f", "value": "Y76537384.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86268e47-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769344611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344611, "uuid": "59e90ea1-896d-41d1-9964-a281c0a0fa52", "comment": "Malware payload (Socks5Systemz)", "value": "ff3e2f0b00f302145c67e71e83f22f42", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344611, "uuid": "f5fd393d-11ca-485d-9b3c-ce318506f6b9", "comment": "Malware payload (Socks5Systemz)", "value": "c55e611c13935d40dbe959782957ed8628b8fc2664fa4f243e48ef032574d1ea", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344611, "uuid": "a8b0122b-7d1f-4903-9d1a-30069661dc02", "comment": "Malware payload (Socks5Systemz)", "value": "055f96561a51b7822d9544aee7b3f3e31cd61475", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344611, "uuid": "8078930c-dc9d-4d9f-9b10-fddff0a23d1d", "comment": "Malware payload (Socks5Systemz)", "value": "734350abc0d6bd904af8414e1b48aabad418f58c3cf4e2492777479aad5db75bedd544fcf4a2757c2ca3b6699af24604", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344611, "uuid": "300cf383-fe10-4485-8a95-38058d863595", "value": "T112A5330E2BEF7292C07A63F914A2095B9B3379B18F65C17FF498996D8E326C07635341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344611, "uuid": "88e2ffd6-ff01-41c4-aadf-8054cf5203d5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344611, "uuid": "b629573f-f6e6-49d4-9272-b92e20688470", "value": "49152:DEgRaF8foXLranKQFK9ZCHRn4vUKndUtntY27MuCblVNofVGae:DEgRaGfoXLTRbCxn6dUttY27M7Uca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344611, "uuid": "60e621e3-607c-4e81-b997-f497427c4533", "value": 2098688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344611, "uuid": "04af8cd6-733d-4972-96c0-23db91f0b789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344611, "uuid": "54cba639-97a4-45b7-a508-525dceb7a93b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbe5998-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304384, "uuid": "46344265-10c7-4625-8e38-3ba68bccd859", "comment": "Malware payload (Mirai)", "value": "7ccebe21bd9d88f35478f66e476b580c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304384, "uuid": "781d7429-a471-4b15-93df-d65cebf2a0f0", "comment": "Malware payload (Mirai)", "value": "c578da4e5ae2e4c277b1bbbb9132766346d7d201970f9866a3dfbe76c625814e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304384, "uuid": "52843df5-e651-41cc-8ded-1f916aa3b084", "comment": "Malware payload (Mirai)", "value": "036ba3ac364baf209708bdba5823713b1357b6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304384, "uuid": "aab57914-c096-4543-926f-6d7d10206547", "comment": "Malware payload (Mirai)", "value": "c6c7f83c87555407d2e8467e998a2faaba1ec45df916f4cb7ad4f48a1fd7a7f2ac89f9e908ace0f2f6f6f6b5459a412b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304384, "uuid": "ba331853-505c-4242-82b5-a9acb6fe6e0a", "value": "T195535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185A94FD74A4235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304384, "uuid": "e405a2b6-5f56-4521-9d92-621c09721fce", "value": "1536:fp3/tcoPzVx57hown8n4SVsgEZJB4kv9IZ5:ptcEVD1own21VXSJB39Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304384, "uuid": "0d9859e0-c8c6-4d65-b396-3586eb51edf7", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304384, "uuid": "bf515a2e-14c3-47e9-a476-a63eff391d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304384, "uuid": "c81d7762-392a-4c30-8d34-316f073a8d08", "value": "cosmic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950e4d59-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302546, "uuid": "b91519c9-2265-4964-9e25-91dc3dba1bab", "comment": "Malware payload (Mirai)", "value": "b766d416bccee60388cfa0c35e0b7c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302546, "uuid": "6940e7ab-614f-4ab8-9a5d-352213f20bf8", "comment": "Malware payload (Mirai)", "value": "c6538b66ccf15f40cf810ce00f1a9100602bf3b22a12db74e6007affc92cefd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302546, "uuid": "372642d4-9da3-43c7-94c1-0003b0f95bca", "comment": "Malware payload (Mirai)", "value": "d29c6ff7b4faf6f6ec309fbdc94a5198eeaa388b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302546, "uuid": "354f3f02-4286-421c-94ec-7ed485a58148", "comment": "Malware payload (Mirai)", "value": "334b65175c498bf90c4d8d7a59457e851ee1a65b92b5aef81842a0a61a2ee8fa0d0cb839ffcbdeee417766577f03e25e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302546, "uuid": "b0552926-61bc-43d3-9686-be0565a63fb4", "value": "T1DC731981B8819A25C6D513BBFD1F018E331697E8E3DE73129D205B647BCB91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302546, "uuid": "c6756d8a-966e-4daf-b4ea-454024d6aa7a", "value": "1536:gtnNgY1kiuVZwdNCoImgTLKKi9AV3b5yAMS1fj5CkcyIyiDluUsPwxw:VZiiZkN+muGKi9AF4XStKluUsPwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302546, "uuid": "88e5afe4-854e-4941-b549-0c53eb76599f", "value": 80452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302546, "uuid": "877eeb6b-ab50-4025-9d87-ce024f1a73f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302546, "uuid": "113950db-47bb-48c1-93fa-ea717044ff3f", "value": "SecuriteInfo.com.Linux.Mirai.9788.30677.31695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe9bba6-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302483, "uuid": "ba767024-1e4b-4f09-b552-ed4a795ea450", "comment": "Malware payload (Mirai)", "value": "bda96ca7d6bdcbfe4381ae2a63b39f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302483, "uuid": "947f238a-72bb-43ef-b87c-0b29a1369b09", "comment": "Malware payload (Mirai)", "value": "c78afdfb262108cb3bc9fa8ddde6039cfac0139074325e0a3c6dd4248634c348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302483, "uuid": "367a9dc3-a67a-45d9-a4c8-c0a35ec0947a", "comment": "Malware payload (Mirai)", "value": "3a0619196f8ac0153354210b99f8d3b5f06810c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302483, "uuid": "0fb33a43-3bc8-4f72-8a34-0f1d5dfd38e4", "comment": "Malware payload (Mirai)", "value": "80f538a928bfa9fd57e1c28daa74495b331faf43b72f8b45f55e8135dea867be585047698a399990610bb16254763620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302483, "uuid": "42072165-a55c-4546-8e07-e7ef6f353b87", "value": "T11F330291D7684B21B17C5C31AB9488E21BFA7FBD951778272C108D05792B56E32F314F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302483, "uuid": "2b36b596-86d3-4e3c-bee3-1da58fbf6563", "value": "768:fryB5QylIycucsg59kLUf/lcEXjdcysqbkE7BzqWe+4oywf9q3UELUFkg3WalYDo:zuNi1ucl593rMY91sLM5eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302483, "uuid": "f911e3a8-6966-4bc1-a46d-d377327272d9", "value": 51624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302483, "uuid": "3f11a47d-ccec-411e-ac43-b41dbbe156f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302483, "uuid": "e22b887c-4e55-40ce-9172-4c45f868b896", "value": "SecuriteInfo.com.Linux.Mirai.9788.7218.10094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8628ec8c-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769330867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330867, "uuid": "a7c37b00-4bad-486e-b313-0e0c5b545e72", "comment": "Malware payload", "value": "dbd387184b23d2842c812d9f3e486b3f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330867, "uuid": "23e11d9f-542b-42c6-8913-a2291f6ac0fb", "comment": "Malware payload", "value": "c8e569cec37323813aad4cee487f8b1462be1fe2147520846c13d30afa67aa31", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330867, "uuid": "a2570d37-5a35-4469-af17-29ff347967a5", "comment": "Malware payload", "value": "90870401984350f6936bdce4b3fcd9bbdad9de58", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330867, "uuid": "328db29e-701d-4697-99d9-9a2e44e12d7a", "comment": "Malware payload", "value": "6d375899517abaa5da6e652e6cb08a657224c392a9831d05e7f527ff8f587086acc127bc5887ad8d38eec21448bf2474", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330867, "uuid": "1615f8f0-db03-4bb0-98e5-61cd19502b5d", "value": "T112F7333279CE8774E5BF92704661DF2E92F63DD0077180EB83E4986B1A368D1453AB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330867, "uuid": "e9d47cc7-d741-4d92-91a8-14c44fb66097", "value": "1572864:3uyq/mvvgkLE5KRLBMzBe56lhyI0KnaY4M/xhCbyHxDYlE:3pZvgshiT3yKaY4M/pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330867, "uuid": "1a0b9185-5c5f-4a16-b548-8cc76156cac4", "value": 75038208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330867, "uuid": "fd15024d-e9b6-4956-9a0a-6b5930191a4a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330867, "uuid": "44c89ee5-6892-414d-b2f2-08e9b7d4e727", "value": "win32-telegram.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b772f853-f9d7-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1769336533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336533, "uuid": "f9f7db6a-f509-4e64-becb-03e767b47b90", "comment": "Malware payload (XWorm)", "value": "1c2d067555198225b46c2962c2c93cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336533, "uuid": "f3c3ae0b-445e-4e3a-a7a4-a4f10cddc0cf", "comment": "Malware payload (XWorm)", "value": "c9075526dac81bb63db7437c48c1d419707d94e064a500a5cabbb71981cbc35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336533, "uuid": "2923affe-8228-471f-85b1-b5b6620a28a7", "comment": "Malware payload (XWorm)", "value": "db9f639d3319e6bce689b0046f801718d363d346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336533, "uuid": "c23f0642-3e7b-423e-8a5e-cd589c52a048", "comment": "Malware payload (XWorm)", "value": "1e5548d3b4dc44c179c69a6676a67fa9f0b44de87493a361bc351ebe83f7d362d87158794475938302261df485f8590a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336533, "uuid": "d7992cb6-1966-4ac5-a5fe-b6735f056d88", "value": "T11F44C25EAA41D8DCC6393BF2B4D2C454426EBCF6F432A65A16843BB43972B4D4F4B843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336533, "uuid": "6582e92e-9602-408b-8e96-ffb2dd8c44d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336533, "uuid": "d38ec7a6-67bf-44da-8837-f733736e2da8", "value": "3072:2IznKeHT0rzLCGNFBxIqJEQbWUwT5XxH4vjoQ/y/2YqcscuRuh:jqzLC8x3b8T5Xuc+BY+Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769336533, "uuid": "fdb72f65-bc5c-4810-bfb7-d6af8a03a2fb", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769336533, "uuid": "3ddf302b-5be7-476d-8418-a785455b24e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336533, "uuid": "4d55af9b-237a-4cdd-9727-35405499a576", "value": "c9075526dac81bb63db7437c48c1d419707d94e064a500a5cabbb71981cbc35a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163b16b4-fa08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769357308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357308, "uuid": "66fc7e93-9e94-4164-8608-6d79a47e0c6c", "comment": "Malware payload", "value": "95323605fd13248903c1a987bb5f9d3c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357308, "uuid": "679abf70-121e-488d-b99e-a4631f5755d0", "comment": "Malware payload", "value": "c9c8f9bd1925d2be8e1275e10f4b23f444a63f0d716fb3f3a751445bb25cf405", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357308, "uuid": "7ee10157-04f6-4554-8b4e-94b0a6661c1d", "comment": "Malware payload", "value": "5c6e659f226d077ecf9d21acecddd194b48fba73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769357308, "uuid": "2355b097-9bc0-4485-8cdf-1aeac0068e93", "comment": "Malware payload", "value": "d9808d0d12e791df3c138583e4239f9199faf8aacc9ebbc62da7242bdfe2a11b7467240f395ac3a023ad8e7361096a59", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357308, "uuid": "fd56b90e-e8be-498e-a153-cb1211394e76", "value": "T119B533C3C1B96935F0E03BF1F1DAC76D6D66CA951774A580AE98978FE343326182DE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357308, "uuid": "749e852f-ace8-4d40-9859-e1c6ec6151cf", "value": "16115189c3817c69eaca44014ebe16e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357308, "uuid": "0031398e-e47b-4332-b17b-b3feebb3552e", "value": "49152:JKj4l+Nh5gxJ8msjBa/CmzxazUM9/h7iP5I4qgFS:JksG5gx2lGVUb9NihlqCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769357308, "uuid": "2250e720-5409-4221-a941-7d653411b6bf", "value": 2463232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769357308, "uuid": "7768d07e-1a49-4e39-97f7-2cd1d96a4139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769357308, "uuid": "bc865529-b129-4b24-8dc0-ab82cca6b530", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f0924b-f986-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301814, "uuid": "3898cee5-1b2c-405e-9c38-dbd767c90a0c", "comment": "Malware payload (Mirai)", "value": "68cfed234a6536ef768dd42cec3e10db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301814, "uuid": "536574ea-b928-412b-b4d8-49224fcc20d9", "comment": "Malware payload (Mirai)", "value": "cb21763bb89afbdc23dc0f00e0a0ac2b2aed3e292263c195b588a1d0acdbf265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301814, "uuid": "0cacc4ac-854b-484e-9e69-fc77066443a7", "comment": "Malware payload (Mirai)", "value": "feb8becc79e172bad43bb27788590ae306249168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301814, "uuid": "c18339f1-61be-4efc-9b13-aa1b3cceac21", "comment": "Malware payload (Mirai)", "value": "74d3662e95d9405082510ce27081a077375b513036b22d165ac072f54d29c8903b65a05b66cb933c7bfdcfe32e92c8f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301814, "uuid": "6d71ab4e-ff32-47c5-b498-30ebac83ce68", "value": "T1DF53021A5D5817FFCB7564F0068433609EFA0BF97A16DD418762C696FF122E89AC32C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301814, "uuid": "4be701a9-793c-47fc-9382-501c0a1e8488", "value": "1536:0AuFmSBHblkj5goFEHT4ulPzsGMf44/PAysSE0VS1:XuIqbQ5goKHTNrdQ4KU/0Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301814, "uuid": "e583ff8f-e732-4b99-9a6d-31a03e8d202c", "value": 64420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301814, "uuid": "d20c48f0-e2b6-47b7-b6cf-085bc0d64b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301814, "uuid": "714675a7-f335-4e4a-adf1-c396c9fac094", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c668e2-f9cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769332078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332078, "uuid": "a7c4a388-add1-47ec-97aa-6e096d69e18b", "comment": "Malware payload (Mirai)", "value": "91f67d2631540d03c0f92d65ed9d56ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332078, "uuid": "d51553d7-40b0-4503-aad2-ab80aecd94e8", "comment": "Malware payload (Mirai)", "value": "cb5bfe0ea43cb35262a5d94b8cc9e6df5067e267b605cf45a9845d9535a6d309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332078, "uuid": "915c0b66-6877-4a53-a889-434c0d5a694d", "comment": "Malware payload (Mirai)", "value": "298b9a38d5599866024fe833a5222280d03353dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332078, "uuid": "00782024-4939-4210-bdb5-9f18880b3888", "comment": "Malware payload (Mirai)", "value": "3cc12c09f116043f41260515d59bebfab61a184e1626db492d927382060ad9b789907f9e7d88c02d228a0e3edd77bd09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332078, "uuid": "4db55eb5-b448-42a0-b9ab-88edd2f7b3cc", "value": "T11C53B60A3E219FADFB9D83354BF78E20564437A62AE1C184E15CEE411E7078D741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332078, "uuid": "c98ffd81-6fb5-4a75-8476-32d31f7ad096", "value": "1536:z7i2RCg3JvmzaIxSf14VGOHINseBm4QLfY3ZoV:zNRC8szaBf14VnHjeBm4QLfYpoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769332078, "uuid": "d96cbc79-ee3e-4259-90ad-f566e7bb8dc0", "value": 65880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769332078, "uuid": "13e70972-7c0e-4de0-a785-b40927b6baba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332078, "uuid": "b02ebd8c-9f82-4514-b0fb-026889fbda6a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e296a92-f9b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769323606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323606, "uuid": "2f371d99-3f96-4dbf-8857-cf23a7cb4fd3", "comment": "Malware payload", "value": "6ada6aaa8e380fc78e69a0ddbea880a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323606, "uuid": "906b30c1-1392-4487-81c8-c1648ca6bb49", "comment": "Malware payload", "value": "cce39443ca963b283dc95b1cb6b1286d19c0f6705f48755a3b6a442f16f2e40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323606, "uuid": "5990f6f2-4827-4c19-a8be-80034d5ae380", "comment": "Malware payload", "value": "46a89a20a5b0d1c5e8609cfb2e33c226717cd1cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323606, "uuid": "af96c3b6-b65a-4503-b8d6-b47bd4c3788c", "comment": "Malware payload", "value": "7588e44ce55170a1d98ce4d8db60fbf36e39dc87ec67189ff2558d1b46d869fc5732f14e8fb9c6751d3b206ddd89aa61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323606, "uuid": "96c96cfa-70c4-431d-9788-51e2d6cf8ee3", "value": "T19B330B07A59360FDC29FD474876B96376D32B89503343F7B2B98ED311E60E612AADB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323606, "uuid": "b5cd07d6-97f8-4f1d-8abb-84698b152ea0", "value": "768:MIHlRwJ4vtvaSyedC8pkxpYgrSghD73OoUEr+4:M2laJ4vh1LQ8expxB7OOr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769323606, "uuid": "272531b4-99bd-4ca1-a5b0-10f94ef06cf4", "value": 54464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769323606, "uuid": "8cf01d43-49a1-4d0f-8921-592a665693f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323606, "uuid": "5f8cc461-fd51-4eb0-9a3f-614fdbb6edea", "value": "x6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a7ce86-f9f1-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1769347394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347394, "uuid": "cd663e38-dfbc-48a6-adcb-31039887118c", "comment": "Malware payload (LummaStealer)", "value": "36a33ec6784193f9f46b7119fab39ac5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6740", "colour": "#CFFA40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347394, "uuid": "e34a2a99-2e5e-4b5d-9495-7e9bdeb929c1", "comment": "Malware payload (LummaStealer)", "value": "cdbce5bbffcbc7ade6fbbfa6673b7759e3d2057ee86ea9d9d6d6b163209d1718", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6740", "colour": "#CFFA40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347394, "uuid": "c107ee78-1472-4c6d-89e8-1631c75bc3ef", "comment": "Malware payload (LummaStealer)", "value": "7127dc295d2de6bb184991bcfb63506c2ae1a760", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6740", "colour": "#CFFA40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769347394, "uuid": "071a1797-16e0-408a-85f0-54e033fb1d77", "comment": "Malware payload (LummaStealer)", "value": "2b342a1e94fc9c23e467a7bc7243c7c8fbd5753b0baa2f3e83de1b9c7693e1f4d838bb6adbaef4161dcbbbdd05afb6f6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6740", "colour": "#CFFA40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347394, "uuid": "7bf52a18-92f9-43de-8a96-130d61c05ffe", "value": "T115F633EBF7DA266C68373B7751E26F0803CC73A536B662481DCB4193782B5D124EA069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347394, "uuid": "86d59139-78b6-48cb-a75b-e49f68fd7a72", "value": "393216:G7HF84JpvbZeihg8MeBGMsPSy8pmY/a33km7:G5xpZHhnsPKfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769347394, "uuid": "4bf64e29-577b-425c-84ed-f361ba5d4b61", "value": 16180515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769347394, "uuid": "6a631477-ad8f-4a13-bcb6-7e6a9818f382", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769347394, "uuid": "c6ca3f87-42f7-4ac1-9d41-6058b785f066", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88467ff7-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383699, "uuid": "dbec843f-fd61-4efa-a53c-1c3cdd6b08a3", "comment": "Malware payload (Mirai)", "value": "55c57999b022cb45879194c1c7293540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383699, "uuid": "11359fa5-54ad-4f0a-a9ba-1311c9b5363d", "comment": "Malware payload (Mirai)", "value": "ce76c3bf616c342d9100abfb3dc5c3eedd362c1cfd27c5da38d43a650af2b90b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383699, "uuid": "3f5a44fe-8b95-49e6-8015-2a2569928149", "comment": "Malware payload (Mirai)", "value": "15c11f484c2650a27dcdc2cf642e24bfe081fb50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383699, "uuid": "f3cdbe82-4f4e-4dd5-a1c1-71a9a95c1b51", "comment": "Malware payload (Mirai)", "value": "d9792606a69e13b8c326407b32e73a8eafff2e0a70e8756a2b71714a25799ea6136cbc44a0c66160429b7b92441242e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383699, "uuid": "0cedd12d-9d16-4028-aca8-bcb4c33d6abd", "value": "T17543F2743A3161B5F5718BB3DEAE0E4B025AC7C0CD6471B31D16A6FDB9860C502F8A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383699, "uuid": "ec2c09b5-dfac-40c6-8fad-ed8b270f4a3e", "value": "1536:dvR38fJ5yDoeW3miMO2zYSQsU+DsLn4f6WkLE:z3AleQsUueXLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383699, "uuid": "120fea5c-5363-4d87-af7d-750ad206572f", "value": 55984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383699, "uuid": "8ad27531-50f6-4012-a8d5-769013c880b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383699, "uuid": "ef5583e5-31dc-494b-9b0c-f77e5113c5d5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1a2fea-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304356, "uuid": "2955f6a5-fe61-45b3-aab9-7e1a7e72edbd", "comment": "Malware payload (Mirai)", "value": "4d90c00e1663532a65f9490f22577d5c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304356, "uuid": "c04be9c6-556c-46c3-ac71-3ea31f864cac", "comment": "Malware payload (Mirai)", "value": "cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304356, "uuid": "ee4a0db4-1efe-461c-8231-67be6d2c146c", "comment": "Malware payload (Mirai)", "value": "ed2c6b9c931b66f525c7711113dead048f1fa7c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304356, "uuid": "dbfc3f84-2d64-4d36-ba20-98e3f7475333", "comment": "Malware payload (Mirai)", "value": "28080ab20aaa39b03422d2b55cc132a556b2687415a44a670202d0862050f3ea7c6f2cbd30340c66310aa9c56beb6d34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304356, "uuid": "a78369bc-ca4a-4fc6-8f51-7c98e7733006", "value": "T12C5193C6B2144130AEE2DD5639B8D484F2C5A9D36DFAAB2544D5BCEDC64CF4C3C60A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304356, "uuid": "1a0647c3-9761-43ca-b3f0-0f73aa8dee11", "value": "48:vnRoRqRYRCRkarg2Rb3RCR5RYRsR1URTjRwe:vRq8aUkOgw9UjaG1OZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304356, "uuid": "e7073b9d-308d-4f6e-82b8-679e70efa072", "value": 2779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304356, "uuid": "5b5823e9-8c6a-41c2-ad2d-cb99c092d2f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304356, "uuid": "d7c0a4c7-675e-45d1-a899-1f26940d91d1", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b572b9-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362587, "uuid": "aa5b29b0-b61b-4b65-8f64-46d9ee24e3e5", "comment": "Malware payload (Mirai)", "value": "3e736b2d4c3732378f2a172f6297d3a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362587, "uuid": "db97cacb-4589-4917-b934-750067b51508", "comment": "Malware payload (Mirai)", "value": "cf3cd08dc3f879dd61a9cce98ee2fdcf9840d69f1ce1d9218e803d38ec637c92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362587, "uuid": "266ffc52-9504-4152-92a6-1df47bf2fe24", "comment": "Malware payload (Mirai)", "value": "6f40430c054dd6d03e9b380e894a34a955c589ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362587, "uuid": "a9830b75-31df-476a-a704-0f545e9ff3eb", "comment": "Malware payload (Mirai)", "value": "0206013efb59ec89f83b6dd40adc25b06a9bc097e458098e8ec3f507af2c9714ae682ff9c19f058cf039cdd8878fdaf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362587, "uuid": "5dac4ee1-df93-45ab-adbf-954d54a3f051", "value": "T1BEB3B50F6E539F7DF32C83744BB78B25AA99279633E0C185E25CD9411D6028E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362587, "uuid": "ac2f109f-4240-424a-9019-b3b91d6c04fd", "value": "1536:hQGEaQjzh33F33fQ3X31Axp/Fy7uwCZZyklWyIsK5RaJVBwMAYhX+:hQKQjG1AxKuw7fcK5kJqYhX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362587, "uuid": "7f84aea1-bda6-4334-8ff4-a97f9bd350f7", "value": 113580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362587, "uuid": "4da67272-5c12-4c2b-98bd-0144b88319f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362587, "uuid": "0af43046-d003-46e1-b184-d334b597e502", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1767ff-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344727, "uuid": "1cbcdacf-97be-41a0-9b4d-5312c5a08d26", "comment": "Malware payload (Mirai)", "value": "2110c05d675b4a609c87e0561437f07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344727, "uuid": "75c839b1-47a9-46f4-b60c-aa1a2def636d", "comment": "Malware payload (Mirai)", "value": "d02346db29ea7d2673b5a77f4db60be737f8dfef0201bdbeaf2d57076190c97f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344727, "uuid": "b71b220f-1a83-4e23-9364-c1868d281246", "comment": "Malware payload (Mirai)", "value": "1a24802a070b1e7d4478f2f94a04f298f59f553c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344727, "uuid": "104d524b-2b12-4948-bd18-c892c3cc6b59", "comment": "Malware payload (Mirai)", "value": "dd84a75f1029180d01027aced3599cabdb0a49d74a6580289f6dee89a97ba64ea6d7b8fd76a3cb28d5d00609de0a4a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344727, "uuid": "ff9dcbf0-d42f-417e-9e32-c06cbf93407e", "value": "T172F3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344727, "uuid": "8badff90-22a0-4b9e-90f3-b19a412fd849", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwa:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344727, "uuid": "05710442-f1a6-4d7f-8dff-2aa1e7147ec1", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344727, "uuid": "ccd224c2-3761-45ef-9912-844870fb681c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344727, "uuid": "353fd23b-8a5e-4c4a-97da-796c4dcdf091", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c950983-fa19-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769364647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364647, "uuid": "f5a6fa7d-a657-40c2-b252-747c3ce9170b", "comment": "Malware payload (Mirai)", "value": "eef7fe09c165ca4fbf5c60e043bf7ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364647, "uuid": "50773776-3a05-443c-a794-f9e849b3fb26", "comment": "Malware payload (Mirai)", "value": "d04026e173792fba4d313b0032e43322876f811db49f9386133d71faf4076535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364647, "uuid": "e06f2ad6-fc41-4a33-b889-4e7014abc7b6", "comment": "Malware payload (Mirai)", "value": "c53f5a9a446e21a0fa1410c8c1e526fe5c0cd1fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364647, "uuid": "c01fff36-ddc3-4ea2-9629-4f1977f78024", "comment": "Malware payload (Mirai)", "value": "e7f5b510ad22d906a269420bcb679972edfd0a515208d50d798de3e56a173a3d29b4582c909f284a460a479272139bbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364647, "uuid": "9bf7e59a-f371-49e0-8271-e024f48578d2", "value": "T184A31BDABC858B11D5C525BAFE0E618D33134B78E3FA7213CE185F2E574A86B0A3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364647, "uuid": "4a827926-ec13-4334-84ad-3911e2b5586d", "value": "1536:GWnYGA50k693A0wKlul8lbE2TYfOg0vZs1feDdabfEB9VscMDiFH8bUEVAeM7y0M:K50kI9BlG8lbE28fH0vZae/3H8bUEVAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364647, "uuid": "f5729d4f-2c66-4dcd-a9d8-cd1bb498375b", "value": 97988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364647, "uuid": "4d38b39d-4872-4d9a-95d1-d7a0bd4f4167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364647, "uuid": "a51f1701-851a-4b71-aeda-e8bd8891870f", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77187ff5-f98e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769305072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769305072, "uuid": "e35c4b89-ef26-4a56-af9d-dae7fd65758c", "comment": "Malware payload", "value": "a5b9ca0ffc2008d1f72b117d03e5002d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769305072, "uuid": "08b8844d-585f-492b-b014-31673cad5e5e", "comment": "Malware payload", "value": "d1d5dacc6208b6698e7b6ddcab740f9d7a2fb15a106eacc1841a3d2a3824d1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769305072, "uuid": "8aee1691-3a55-4804-8c7d-b1abb0d34d05", "comment": "Malware payload", "value": "646e51db8d1eb0017c233600c8d5b52537a745b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769305072, "uuid": "f9ab2e4b-de04-4561-91a2-2adc53f24d5f", "comment": "Malware payload", "value": "d41b5b945177246c6b79509719ddf1b77112eb9c040db2462e09a89c206c440244107f1909724868a647c29ccd5728c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769305072, "uuid": "1d886f19-2053-496c-b667-1f575b3d66f3", "value": "T185330B0BB59360FDC19FD474876B96276D32B89503343F7B2B98ED311E60E612AADB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769305072, "uuid": "1609407e-542f-4839-82a2-77c6a2b94e31", "value": "768:TMHlRHJDtvaSyedC8pkxp0grSghD7HOcUEr+4:TCltJDh1LQ8expFBzOKr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769305072, "uuid": "dd64b53f-2d1d-4dbc-a76e-e587e08f19da", "value": 54464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769305072, "uuid": "05ed29bd-68de-49e8-8072-71595ae96d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769305072, "uuid": "dc339b62-a7c4-4e22-aaf8-2e79a9b427ac", "value": "x6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a66290-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362436, "uuid": "8112167a-044b-4fa2-8469-dbd2d64772d9", "comment": "Malware payload (Mirai)", "value": "cbc46ab6039f0ee532f02ea56ee8a790", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362436, "uuid": "1de82fde-68dc-482a-819c-22f478feb653", "comment": "Malware payload (Mirai)", "value": "d1f5662d2351316b85afa70fc90bcff088451a03259b83aa1fe17cb61be33e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362436, "uuid": "ea01679c-a682-49da-86f6-3c3136195245", "comment": "Malware payload (Mirai)", "value": "0aa4aa6f356e0cc33b6f0e35ce711f9f1e314a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362436, "uuid": "0d1cba7e-ca46-4c14-bbfb-e20e3fc8335a", "comment": "Malware payload (Mirai)", "value": "06db253bb09a23cfc736930f5a786dc3d0733a8bf9d44b6906b2606ab48c39677e3dbbebe934d386ec2c5c933546a3bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362436, "uuid": "5539e6ce-aa27-4fd9-803b-62e0d8ab66e8", "value": "T119336B62CCB6AE64F16985F47130EF791B13AC00A2872DBA15A6C7A5D043D8CF64E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362436, "uuid": "3bcea7d0-b891-4061-a501-5b369dd938cc", "value": "768:F7QfuAerRrXOPox0GNRea4I4ft7goMGD7ICh0Bdz/fx6X:Fkf5Kx+PrbtzMwIChMXx6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362436, "uuid": "b8ec666f-bf93-48dc-aacd-a03a299bd0af", "value": 50564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362436, "uuid": "de74dbb8-fc99-4fda-9a26-47884c044561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362436, "uuid": "0072e9f1-d2e9-4baf-9697-2e5c94b583b5", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e99a43-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383831, "uuid": "4f9aaeff-458b-4b32-a968-00b99cd4d9f3", "comment": "Malware payload (Mirai)", "value": "e04e479295add4f39bfc2b1e5a761630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383831, "uuid": "77637dec-14c8-43f3-b9d5-ec594239ec26", "comment": "Malware payload (Mirai)", "value": "d23eb1ee3a8f3b84fcbd3ee3d3c8dca5b2cf4dc72b3dc1eb85b7ffa3af0afa97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383831, "uuid": "3c4290a1-f7c0-4c02-a865-5a21f8e9d0ed", "comment": "Malware payload (Mirai)", "value": "234a725119c4fb072beec17226aa800ed0cc9c03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383831, "uuid": "24098ff3-a042-45ad-be22-031b1565c35f", "comment": "Malware payload (Mirai)", "value": "5863ed6a092b160ba5e9a650ded5caa7abd9e5dc753ccb988577d25bf95e0abf585865b02423474f425f8c6852db676f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383831, "uuid": "a1555b73-fd88-4543-8607-1518ec7dc7a7", "value": "T127C3B44F6E539F7DF32C83354BB39B36A65523E223A0C285E25CD9501D6028E586FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383831, "uuid": "c4c6cd34-a169-4f3d-b9f8-21f53cb48559", "value": "1536:hIxSNn+3jjNjjtejtqH6EIgghCI4yO4azFrRRa6BRcAsYKQNFhKAmvxSHmEQqj+0:KAnWHLIRL4EiRaBYtKAixIAFgEXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383831, "uuid": "c7f9deed-5dd1-4383-8188-ede17cbfa92b", "value": 118564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383831, "uuid": "5931cdc9-ca7d-4362-a627-bc646e7bbb75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383831, "uuid": "e5c24573-f819-4904-8e5a-12d5b4314936", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b231e0c7-fa39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769378615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769378615, "uuid": "ff1e3ab1-af92-4586-bac8-c4cab336750b", "comment": "Malware payload (Mirai)", "value": "6a5a5f9e9e1e6ca772876a2592f81259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769378615, "uuid": "89a27c61-4e6b-49c0-adbb-57bccd93e8f0", "comment": "Malware payload (Mirai)", "value": "d30ac968ad9657028176acd59a5af01d0db46f4f21a6c991ff2953e886636265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769378615, "uuid": "9de1323a-d82c-418c-80a5-616a11e2abd8", "comment": "Malware payload (Mirai)", "value": "48e3b369a74c8eb236d37332c5ae2278c681254b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769378615, "uuid": "48ab5207-ffdc-4255-a38f-1765988d229c", "comment": "Malware payload (Mirai)", "value": "3fbb5a2b5acf130bd058078a77a21b90ac337611d54a89e633bdfe72cfe5acdff2921e9765e018a2e0513fa0f9aaa728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769378615, "uuid": "58cf850b-e5bf-4ebd-ab85-d8931da5dca0", "value": "T10B835B819242E8F0ED050175713BF337A632DDB801B8FDF7F3655576582AAA0B28674E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769378615, "uuid": "f59e62c1-ba68-4d58-860c-8d6fe01504fb", "value": "1536:eN057uXY27SgWJS98WB26AS41jU2sws7f3F39VfKEEQCD6rMYwmTXcblNF6yjA:eN6UzWNS9/3wjcwCf1fVPrMYwwMRro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769378615, "uuid": "692be5ba-80a4-4e70-87ca-1dd01e58fa69", "value": 83124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769378615, "uuid": "4b6f955c-aec0-47a5-a94a-63c5258f5db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769378615, "uuid": "db45ab36-8b07-4f0b-b4a3-85d6b0a0a31d", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84e1eff-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383833, "uuid": "d4e30d4b-2e88-4d91-af31-9c210fc38635", "comment": "Malware payload (Mirai)", "value": "376911c50156c1241b3cb051382e8443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383833, "uuid": "ca05aa95-9e1b-41f5-a52e-703cc907d3bc", "comment": "Malware payload (Mirai)", "value": "d37f15727a91cd5aa3bc26a51c18482bee2941c483ac6dfa1fbb6af74c4a69e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383833, "uuid": "59a456f8-1dce-4cd2-b267-4812b52fba29", "comment": "Malware payload (Mirai)", "value": "7308729924ab1e692d05f0c0b137307c5bf26026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383833, "uuid": "d3c72d9b-c77a-42e6-ba63-aa5876af674d", "comment": "Malware payload (Mirai)", "value": "8f90ff6beba9c6b03f06c4f8aec04c797d4b3b2862cc984a30b668b58f543a63c33098e58d6e9bde079d1bcb6f0492e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383833, "uuid": "835b2176-da31-44d6-b23f-ed0ebb83c68e", "value": "T154937D11CCB19EE8F03A2D7110FAD9BB4713F586D90B6CBA3C47C621505BA94F5A6BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383833, "uuid": "3543eccf-b6d0-471a-952d-1d1d5799845b", "value": "1536:8K43KmVS8XEg+tzGMdx5emhFS99aE4Tz2WzmOEFCeOVKydYX:8KUKSz+tzGqx5/hap8RmOEFO4aYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383833, "uuid": "90958b19-8456-4288-b05b-7ed29d5e6f8a", "value": 91780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383833, "uuid": "89388323-0467-4561-bde9-389f13aacdc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383833, "uuid": "166d8b98-ed32-4ef5-a15f-afea82d2c590", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d167e6a-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769330664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330664, "uuid": "1b6ad125-8d1b-48b0-b6fc-d44d4bdd33e9", "comment": "Malware payload (ValleyRAT)", "value": "034a2c98986a4198547eb5c76335b58a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330664, "uuid": "e9ba6ace-84eb-4966-8788-53ba0c26de4f", "comment": "Malware payload (ValleyRAT)", "value": "d5ead8ca98692fb8447aff13afc1a9b149f19043239216c47aa042e82065d97a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330664, "uuid": "620d6d6d-9371-4030-99ba-462ca3451b00", "comment": "Malware payload (ValleyRAT)", "value": "6eb25b0265f873f6896f08a96c320eb7479ae80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330664, "uuid": "306622b2-8b5b-4046-87e4-cad887b41d65", "comment": "Malware payload (ValleyRAT)", "value": "99761bb0a33aec8d09c2c99501f16b5c79820b38564d0e3ad5e3cdf5a7d55325bb30fc7371b10ccb99eb8a1ab4624342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330664, "uuid": "4802a5a4-8d2a-4c70-9e94-ab81ff19e3ee", "value": "T1881833A65A80D6EFC92BC6F56CD1C7044E5F8CDA1C6ADE301BB539C8721CB35A217329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330664, "uuid": "d487bb0d-9c23-4236-8fb7-eb7fb94ac12a", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330664, "uuid": "cdecb33f-d492-48e0-9594-ad000ac5ba64", "value": "1572864:0QXj2w3e6emI7DkA+dyTu2PZWkjfvJD0hFkr0pXoRacpxoIpnC58oe5ADZ/QN:zj2kJgNT/W8l0y02pu5KADI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330664, "uuid": "972fb60d-81aa-4510-9aab-6484795aac0f", "value": 91139049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330664, "uuid": "c85d313f-69a5-4557-a4af-75cc8f5dac40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330664, "uuid": "071eeeca-0212-4c64-ad7e-b006ef0fbebf", "value": "C-windowse37-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e14e4f-f9b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769319940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319940, "uuid": "53b9df85-1d3f-4ffe-b21a-b35748a09589", "comment": "Malware payload (Mirai)", "value": "d6d1d21a656a067343f51a56db0d02eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319940, "uuid": "4ca9cf98-d383-4313-a5de-f5af736f395d", "comment": "Malware payload (Mirai)", "value": "d6d73d6b97a0a68a0fc0c220c4cf441031ca9b12c263c2a87b7e40237f85937c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319940, "uuid": "302339c5-ccdb-48aa-b46c-6da411ec7422", "comment": "Malware payload (Mirai)", "value": "519cb43778891001b1f8c9c70f15ecd8ad739baf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769319940, "uuid": "cebe48f9-f2a0-4d63-8e5a-c9d82e96e41e", "comment": "Malware payload (Mirai)", "value": "ca6bcb0edf1c1fe8af356b8200250fb38a51a3e0f7a60889163c01b659a3b923e3440378098ac291442256ce0dc02719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319940, "uuid": "29d04ff2-b840-4d06-9a11-1b9d5af086bd", "value": "T16434E706BF610FF7D86BCC3706EA1B1129CC681B26693F367634D968B60B68F45C3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319940, "uuid": "d14df52a-b9b3-45b9-83b1-45e82a322881", "value": "1536:YGUee6YMi4wCn9y0c/nwF9DsHVgoz8KlDz8fQJ4FDOy7k4h+RXJ8BzVve4d379Ov:rUTwFYn8y6TmXQEyU+PVpuYOR2ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769319940, "uuid": "795ccbce-0c54-4960-8618-69fb4b745c45", "value": 236172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769319940, "uuid": "ec22a5d7-1816-4368-a38e-3ae01bbbd88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769319940, "uuid": "02ff4a57-3e4f-4a7c-97e3-804bf0c561c9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7988b26b-f9d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769336000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336000, "uuid": "36448534-e6ca-4ba9-abbc-3f093ae1601f", "comment": "Malware payload (Mirai)", "value": "a24c0572239289725b3531a345b39f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336000, "uuid": "1d3e63a5-252e-4e0a-a01c-a23d903ed09a", "comment": "Malware payload (Mirai)", "value": "d98a5fa8c0f680b3fb9246a802e751359e7ceb5505651aaa4b062b648afd0900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336000, "uuid": "2ec95bcd-66c1-4af6-84db-81a10e91820f", "comment": "Malware payload (Mirai)", "value": "9c708da7ffff6ccd8a4898630ca734675274451b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769336000, "uuid": "eb4cd1bd-f647-403f-93ba-41598a37954b", "comment": "Malware payload (Mirai)", "value": "354cb5c2f8a795c51531b44f00236f2adc884b02b94dd37e5d6cb6297cc33017b1ac14e072d76926758e3a0d2fd15046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336000, "uuid": "cfa191a4-25ae-4e7c-bae2-15425f31ecf1", "value": "T1C1059E9EF783D4E2F29341F5014FC7F20570A0166067FAF2EB45AA7678727922E1622D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336000, "uuid": "c4173daf-2912-4211-8b09-2e4def18e826", "value": "24576:+CX/FuBh+EhtkiCmWLNm/KgPm3pBIfLZnd:+KNuBh+EhtUweAfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769336000, "uuid": "0525887c-14cd-4ef5-bbb5-c7dee2048ecd", "value": 823192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769336000, "uuid": "f924f8a8-8c0f-404a-b073-88525061355f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769336000, "uuid": "473e625f-7b93-4eca-9488-127661db92a6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ee3197-fa3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769379125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379125, "uuid": "768cea4d-bfa7-4e8f-bfb8-48e73c3c2f78", "comment": "Malware payload", "value": "d5d2a0ac4905c290abfb35752ea88632", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379125, "uuid": "5d4816f7-68ba-4714-b669-1d5c58ddc51d", "comment": "Malware payload", "value": "da30c0ee5a3755e719e72a8451930177fc138824c8d918614c3c2d45febd1ee8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379125, "uuid": "9cb86c65-186d-4cf6-a192-b46ad7051968", "comment": "Malware payload", "value": "8385af095b673458226967d591d38022c78e87d8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769379125, "uuid": "7dd4a81b-7f4a-4541-a88a-55f8cb0e7f71", "comment": "Malware payload", "value": "772ef944ade4647ac0238617e05026dc6adb9201e5c5ccf2f0bc42fd64d4e7e9a327af423d8bc24d61319ef97e5b5f22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379125, "uuid": "7f820054-a89f-4edf-9d0f-f92ed0f5f125", "value": "T191F6339773A02974F4A9803E49F2C009C533BD9A53B085FB17A461BA6F73AD17B35B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379125, "uuid": "c7920282-58a7-4f5c-9759-a81d01913de7", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379125, "uuid": "62b88bad-b416-4896-9e65-4784d6923ae4", "value": "393216:Yw8nSaM0tmurEUWjW1V5CVGepUNOy4x49vHDXh1xkK3zLpEef:YwM8dbWz8VGeISxu/jBpEef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769379125, "uuid": "24fb38b5-239f-4335-a134-dc2a96df12e2", "value": 16417486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769379125, "uuid": "6484d452-3376-48a2-966d-76b638d16258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769379125, "uuid": "6aacfdc1-b6d0-4943-ae7d-46b4de7c3d0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b15ca8-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362168, "uuid": "ef1941c9-4b84-4a40-ad7c-8d8767b8d903", "comment": "Malware payload (Mirai)", "value": "9b5716ef6703df898994511a07625c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362168, "uuid": "883b7a04-d86d-40a2-b553-dc4aae5f0b5d", "comment": "Malware payload (Mirai)", "value": "db973cac55faea6d81677dbb5b320c747b54081a34012836b06ebbc83077efd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362168, "uuid": "4e7ce720-321a-4908-b06e-26d0d1f0534d", "comment": "Malware payload (Mirai)", "value": "7ad449c5131a4c1bd94765c0477aafce1de44bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362168, "uuid": "ceb557b1-a858-4a72-a431-5fa8251bb4dd", "comment": "Malware payload (Mirai)", "value": "b86695a08d4a2f2170b4a041d2ca0726645cac0e162536fe50f2e68e65aa21a779dbe25293206b1957b9418d8b4c3ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362168, "uuid": "15f464d9-2fa3-407f-a875-861bc8aa1f24", "value": "T107148D68FE4F68D2D2C7E37DAE4A0FA230277D749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362168, "uuid": "30346972-e2b8-42bb-8ee4-8724f9521e93", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPx1:bOVfbEdxm4iubH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362168, "uuid": "c69852e6-e1d0-48e1-9635-777d9b44e1ec", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362168, "uuid": "c91f2312-56f3-48cf-b50b-09262b90d940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362168, "uuid": "105f60f9-5089-4277-b1c9-db49d51734bb", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d26612a-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362125, "uuid": "4dc60f7f-40cd-4344-b16d-0cf420e215f3", "comment": "Malware payload (Mirai)", "value": "4f32d66833b4dd4426b2aafa26500a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362125, "uuid": "6f869e0c-5a6b-43c3-b6b6-957e4d449fb0", "comment": "Malware payload (Mirai)", "value": "dbcdf0153c25ce45a3f5bc8c0898d5069b49f35fe422b547b4c30d9c84b66342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362125, "uuid": "23b82556-1d2e-40be-b264-e7eda39b7d7f", "comment": "Malware payload (Mirai)", "value": "e9a3a2c1dbd53ec439265e4762ab414daf83451b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362125, "uuid": "740ef156-8212-4169-b8d9-2222216f9cd8", "comment": "Malware payload (Mirai)", "value": "d36409e0ab58d56615b7d82869e5e9109a607dce23ac5d3ea28271bdf759bd1dcf46c4325a027e916e4f541f34a819a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362125, "uuid": "84da2977-ea82-4c43-bd1a-f9650b8a718b", "value": "T13D146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362125, "uuid": "79476fac-492c-479c-a169-f1898e6084ed", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtR:BZAyFzQSdS7Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362125, "uuid": "e1920c72-4a4b-4cf1-9262-3576eda8cdd2", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362125, "uuid": "163e0f7b-9c7f-49e5-a48f-669fee6d26d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362125, "uuid": "0fb017b9-1fe2-460c-99ab-9318f4dbc326", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d2aa37-f985-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301292, "uuid": "6d7163a9-a001-4e1d-bd14-fc5a2ba0cf62", "comment": "Malware payload (Mirai)", "value": "317986eb13b033565e281be14d7db46d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301292, "uuid": "a46de45d-49f7-4b1e-94a6-9f747a6efe7d", "comment": "Malware payload (Mirai)", "value": "dd050a776c3ef172c4076ced1c2712ec234f202225ddf66467ec9afedf3fe292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301292, "uuid": "dfea2d08-1891-480d-8195-97bd5fef0434", "comment": "Malware payload (Mirai)", "value": "abfeadf576abc7ed5d6c348c92c1c1ced181eab8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301292, "uuid": "d25bb5b6-d801-4ca8-b156-3b7834def0bc", "comment": "Malware payload (Mirai)", "value": "9ede5c00ce2130e95e0851350a449155aba5622749444ffef0d5565f112462e7490b2d54f8d7100cba437c3c6ddb042f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301292, "uuid": "d17d2329-1cf6-4e30-a759-34e41cfbd940", "value": "T1FF3301D01762178C8261D97438AA305E4524292F72EA29502DABD08EF45B623ACB7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301292, "uuid": "5538909a-467a-4d2d-8881-ad35c70e8085", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQN:8D+CAXFYQChaAUk5ljnQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301292, "uuid": "cf7e9d8f-c0e1-40ed-8432-940fdf07d928", "value": 52440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301292, "uuid": "bd720b31-7119-497b-9ff1-77bb9a5f2424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301292, "uuid": "ca2183d5-4583-4105-a8da-9b64bb48a375", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c539442b-fa1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769366192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366192, "uuid": "9051d24b-1e16-476a-8b50-3b74e5140407", "comment": "Malware payload (Mirai)", "value": "0284fc435788d3c0d7f127db4af91b57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366192, "uuid": "009e0f4b-9be6-4833-8479-3e99daa274a1", "comment": "Malware payload (Mirai)", "value": "de5ec67a0c3aafa745c5b3b311de85cae7d48a97eefeaca4b9100979a931da36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366192, "uuid": "0ba786d1-3d19-4b73-bef9-9c93fe71bb9f", "comment": "Malware payload (Mirai)", "value": "2f76d06a9d29124606ceceaccfbb5dfa1331bfae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769366192, "uuid": "e9c82312-50c8-407f-b34c-ea9c4308d4da", "comment": "Malware payload (Mirai)", "value": "add0f0d87730d25c72b22687180b476861673116a3652b8e7856cbe9fbb095d8ec2cbd1461b52c4a31a2e74a11d74269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366192, "uuid": "cd81e932-61a5-47b8-a57f-bf6fd526d7a9", "value": "T1C5434B22BEB61D37C0C4A57A62E74335F5F6434A34B88A2E7DA10E9CFF546403217A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366192, "uuid": "b271b527-e74d-4637-b085-e3182c97617e", "value": "768:l5oOT8G06crVScE6HOaB9jvBq/awMnZ0t+O+OagMsa/1YQAih8xvqnLVp:l5rTO/7E+Oavjs/a/nZ0tMSMsi1owNn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769366192, "uuid": "785d14d1-6093-4eff-9173-b9d505034bf4", "value": 58968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769366192, "uuid": "6cb3e169-42a3-492f-bd59-e6ad183431b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769366192, "uuid": "e7b78799-7a67-4203-8142-7c8750bafe60", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228117f9-f9f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348309, "uuid": "1d732275-bc51-4ad6-9c2d-99e8e0e7923a", "comment": "Malware payload", "value": "08d14ce6254c8066839d8022935c042b", "object_relation": "md5", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348309, "uuid": "d159f098-6111-4a96-8628-ce0f0c90cd4c", "comment": "Malware payload", "value": "e0a2ceb90964ec41059de34908398e3946ff5eca334a4d620573486ecc21f495", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348309, "uuid": "f6bc8655-94c1-425a-856f-756c082d92ef", "comment": "Malware payload", "value": "058d30f6790cf59cf2b43e910d215a53adf78642", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348309, "uuid": "81a20d34-2995-4666-b4b1-95671c41b9b0", "comment": "Malware payload", "value": "4557e2a5a50ab6e8191e2941ab979edebb7e0cce9d8c8d6481e79850b8ec13e1e64512411de8aefa88d751c512110527", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-250", "colour": "#E9DD7A", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348309, "uuid": "bfcef832-f45b-491e-bcf2-ed50015d3444", "value": "T1AE268D31E543A165E8F928B3A3FA4BB348EACD185725D1C3A5C478D586713D332FA24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348309, "uuid": "6cd71780-a914-4be4-9bff-c62e6d94a897", "value": "88e87de6c1cd25baf0c731a778bb1647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348309, "uuid": "ef0f0923-1e68-46b4-98a2-8adb777a32c2", "value": "49152:Myh7gD5od33dGJZleQg4KQYi4i/hoAVIuiVHP2nJMTPsXy9p4mY6CZ4E+FQA+lgg:fZdkO4KQYi40hOuWH+JMoXQ1YT4E+HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348309, "uuid": "bb5ac977-74e3-4d87-b8d2-ce4e99fd17d2", "value": 4727072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348309, "uuid": "b23bbbe5-0070-4345-8dbb-07ab46adb3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348309, "uuid": "e9a60486-ca66-412f-b143-ff8d75f2a73b", "value": "python39.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191e6c4a-fa0f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769360320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360320, "uuid": "520c3c7e-adf5-4277-9329-2af4afd3c4fe", "comment": "Malware payload (Mirai)", "value": "08dd3ede3a51d26be7fc9c9b09653447", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360320, "uuid": "a6956e21-8558-4bd5-a95d-197f51b7f844", "comment": "Malware payload (Mirai)", "value": "e2c03d124b526b861d303f1f0bbfa8e12449bdaac671e8c190b944c5782cd927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360320, "uuid": "da60426c-a2b3-4cea-a641-b0f4ff4783dd", "comment": "Malware payload (Mirai)", "value": "70caa555130d0477b75b2af0203261efa75c9413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360320, "uuid": "1bee3960-73cf-4e0c-a402-a110c0ce513a", "comment": "Malware payload (Mirai)", "value": "5031d4efc1234936c62b49dca60904758d822f510f7b8bd8e5487a12c637026692266b79c5f52a83deea570699b56a82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360320, "uuid": "3087468e-5baa-43ea-800f-f11f0e1d59fe", "value": "T1405302F694E87DCCC2999734020B46423EC6B774A085A53A76C4B6A84FF1354DBD8FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360320, "uuid": "593cee78-5f15-4d55-be10-c75dbb03c7ce", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA6XPLkg4azHX:CM5az1Fy0oPgdZX6hTo8R1PLGazHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360320, "uuid": "82f9f1b3-b7e6-4175-a9a2-4e4feab8827c", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360320, "uuid": "98076389-211f-4059-86d4-b34524cca48b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360320, "uuid": "d155523a-057d-40d0-901a-8b2f82d728d5", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dd28be-fa43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769382812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382812, "uuid": "c5b59298-8f35-44b9-89e9-d2457bb0e9f1", "comment": "Malware payload (Mirai)", "value": "c16b84c9059f3a4df2ad471a87d474b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382812, "uuid": "cd05752c-109a-4ce1-9e5f-acb136bcf5fc", "comment": "Malware payload (Mirai)", "value": "e35808dc44d35341fd1c7a5b65c5119118a2180f6dc86de55452bdc476207f31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382812, "uuid": "8c243a6f-774c-49b9-9543-da794306393e", "comment": "Malware payload (Mirai)", "value": "b51278d062a94ea524fc99fcde58081f487c8854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382812, "uuid": "8d52b823-9c52-4fcb-b911-37e9fb8f674d", "comment": "Malware payload (Mirai)", "value": "5cf5f04170cd1d2c7123a67db311ff11063be550f8ce45398c1e1595d8593ab34fba5a5a46b5c52dc8fc12bc48fc0ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382812, "uuid": "2522f309-0968-4e1f-92aa-e375af081b77", "value": "T1D2338E72EC662E18E15942F07035DE7E1753A5B0C24B2DBA18AEC7658043E8EF54A3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382812, "uuid": "14d9f165-7fe7-4ae6-9153-29e56978391f", "value": "768:yWyQI3UJnQgEPaxtb73rRc1pIxReGgw4p4mNET0oP9adoOCk0RdU/0tdXt:yWJ+gx57buTIuGoN2P0oOCkz8tdXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769382812, "uuid": "77ba2573-d083-498b-9439-90b1100f86d0", "value": 53360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769382812, "uuid": "59f90a8e-8582-4bf6-89de-7b87226af3ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382812, "uuid": "95b2b4b7-28c4-4a44-86eb-16fdb4c40894", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43c44bf-fa42-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769382511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382511, "uuid": "e029e948-9aaa-4765-8c10-50f91eca1bb5", "comment": "Malware payload", "value": "7850b54dbe8f3b53b49737bea1487a8e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382511, "uuid": "0ed9a035-f063-4e1e-8c05-ed86449161d6", "comment": "Malware payload", "value": "e381969c7a6cbae0875a58b1cadd9c653426e408254983c373b83f7d7c34bfff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382511, "uuid": "48d12c2a-0526-48a3-8a57-ae3debe8c22a", "comment": "Malware payload", "value": "5d99d29be9a445008298672e8e5eabd55ea82188", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769382511, "uuid": "90aede69-3c03-4569-b9f4-defce2d7c80d", "comment": "Malware payload", "value": "ca96aa57f41f250974212036efcd3eb46129fca4f17d5e0c01f9e66f2c2400becc24682b92cc72498e34dba436baa97f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382511, "uuid": "a131d054-ab1a-4b6d-a792-be7dc53b2181", "value": "T1BFF5338F37B6C8FEE642D2783A8589864EB6BD08513C24459C6D8D4927FBAC0C6537F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382511, "uuid": "989f19e0-c48d-4f95-b6fd-33a0a5d26fb6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382511, "uuid": "1f03a6a3-140c-46d4-aa5a-a7aca2d28e50", "value": "98304:Mh0x4Q8tUU2O3KpYprgQfAeQYMZrHIH2KmW1Cqe:CxQ8tUK30Yp/IeQYebbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769382511, "uuid": "65b1c73a-a5e2-4b7a-910a-c30ec4f06799", "value": 3493869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769382511, "uuid": "a11a5c66-daa8-486b-b079-b69407f88200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769382511, "uuid": "44b34927-6334-4501-a441-caba9103c4d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e768b23-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302481, "uuid": "5e7436a9-57f9-43f4-8b0a-6e790ee662b5", "comment": "Malware payload", "value": "a277bdfb8cf0148857d11e6fb913a763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302481, "uuid": "78a3f5ce-aabc-4081-8d56-8465f0f775ee", "comment": "Malware payload", "value": "e4910e01673eb4a96805b692922e1d1b20971c3a314a052f8e2103039489d4b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302481, "uuid": "a6426e6d-9991-46ed-ab42-0353dc0b4f6f", "comment": "Malware payload", "value": "50607da9bfe5bd209f1edaff6f0a67c353c2a096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302481, "uuid": "6ad1ee01-bebd-45a3-b9b9-f40a95306dad", "comment": "Malware payload", "value": "c3444561587628018837dc15abb7c929907bc0c3a292ff1a380985bbec56c19688e66cff722ac6e074444997cdc2ec67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302481, "uuid": "79206d70-3d91-4df5-8e12-84ddfb102a84", "value": "T1A903E0536792B6FCD839D53689A70281D31F38055B2F9BBE08A825792C76381AF23B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302481, "uuid": "9fb3e5bc-eae1-48d3-9a78-043afc43515f", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302481, "uuid": "c3c6825f-4d51-4b35-8fa8-cd34c9708247", "value": "768:znyJHubAUnDU+QA7EhPdkvSe5vSQE3gncL7KgXLbKwwVmusqhzLYrgn:zoObBZQA7Ehlkvh0bgcLGobKwwSA1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302481, "uuid": "70330c6a-d3cf-434c-a93b-ad0d8d16b0c5", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302481, "uuid": "19cc15be-2a20-42e4-9722-abf0dbedf04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302481, "uuid": "d59ac373-07d3-43a1-a07c-507b7571a2bc", "value": "SecuriteInfo.com.FileRepMalware.15951528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f7a1a6-fa0f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769360366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360366, "uuid": "aeaaf7ba-80c8-4b9b-bf24-f592c8215e52", "comment": "Malware payload (Mirai)", "value": "e11290d05f6527513028c21453cc57e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360366, "uuid": "6d69530e-b8d1-4de8-aee6-9a8b44ad1570", "comment": "Malware payload (Mirai)", "value": "e4f8402845543fc38678a05aed3d269508d8c49f4c2910a9ead64c62d949594c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360366, "uuid": "40ba58aa-785f-4405-acea-3a8ab2133185", "comment": "Malware payload (Mirai)", "value": "4b4d1ebe87fd7a343a5f7b95f5af7bb709a745bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360366, "uuid": "ac7a7db1-0974-4108-b1c5-38ec337e5e17", "comment": "Malware payload (Mirai)", "value": "23df271661416e84fa4c825d963f94ce835124498797411821aa700b37d13939ce757159384fd0f67ee7c487b97e520f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360366, "uuid": "2cbd7eef-a3f2-4028-b0e7-e2a542c7c344", "value": "T138C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360366, "uuid": "21d5e294-6bce-4411-a4e2-0600f62d83c8", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy3w:VoRNjmj1VGFVrRiyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360366, "uuid": "f408379f-ec8c-400f-80f2-606332cf102a", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360366, "uuid": "19cc36f1-96bb-4abe-9cc5-09746b1fa376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360366, "uuid": "0b989a94-f9a7-4fd1-9a12-a78605e0c005", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739b41a4-f9ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769323964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323964, "uuid": "52e2da40-8ae0-41f8-89f8-6b1e35d29195", "comment": "Malware payload", "value": "0d2917ac0b622379977f23195eb47e76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323964, "uuid": "9525184a-1935-4702-9dfc-42192bbc9cef", "comment": "Malware payload", "value": "e5ad8d255fd495136ea567a5241fbfb2c39ca2aa4082ad15c12a3f2589e99b0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323964, "uuid": "76bc2365-d0bc-48a4-8812-5be6bae43b6e", "comment": "Malware payload", "value": "83db2acb27faccb2c97a0bbce9afbd720f0c421d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323964, "uuid": "22db2cd1-2f84-4371-a21f-a26f62fbb786", "comment": "Malware payload", "value": "60274becd6f99998ec1d0bd4a870edb6a8d85da2568ff0ff3e357528f9fb00c99b4f63dcf32a06e35abc3a1aea687c77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323964, "uuid": "796b8057-9d63-4ee6-979c-30c6a544d7ce", "value": "T1B801E9DE05613F7183348F5CB5734528600ED1D4FB635689D94A042A4CE8747B529FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323964, "uuid": "b2b31e39-1862-4238-967a-53ac6e0f2280", "value": "12:xVHP3UVHtdvVH8NIjlT+VH9iKl2YVHlcRKVHI69VHk9+VHpFG10+VH9UVHuh3vV/:P34deNIp9KlvG6QL/rxmUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769323964, "uuid": "d920e723-555c-4c4a-ba46-22dcaacf3c19", "value": 752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769323964, "uuid": "93faea77-2cc0-4ab0-bdb0-bd338ffe69d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323964, "uuid": "cd429219-0e35-4844-b11e-7f313a94e07d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd5397c-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331041, "uuid": "ebbf898c-933e-4b85-9cad-edc2e9306f45", "comment": "Malware payload", "value": "200aec7c26d86aa6dbddf0b6ee46bbf9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331041, "uuid": "90c78f00-d9ee-4468-aa87-6e9ac8d8b372", "comment": "Malware payload", "value": "e688cf2b3fce67a169cc02b410229b3dde6f84f03d5c76c9a978fe3afa077965", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331041, "uuid": "7e45a311-6543-4337-bd4c-9758845747d3", "comment": "Malware payload", "value": "3035621154b38635777684f31ecc55ed06ef8cea", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331041, "uuid": "be9e383a-9e4e-4240-b6a1-aa7ae9b26ae1", "comment": "Malware payload", "value": "12d8142bbc3b73deb00a15bb0875364d067c07c8c00ff5f0a6bd33c8f07ce1f07f3729a313c45b84ade093a9ca180c58", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331041, "uuid": "130b47da-2c20-40f0-82be-563f07ec91ef", "value": "T120083330B27768E5E62F63BFA0A86F8481347DE0B31BD56B63787FA589B054650B1C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331041, "uuid": "4e844383-d283-4056-9361-fdedf925dc07", "value": "1572864:Bxyzop3xA9HoS9coQcqTv9AIkX9JTB7wScm6S3VTnXM2ZdW8L2j5:LOoDsx9/hqTv9ARTTyMT82Zdqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331041, "uuid": "b41963e2-86f9-4abd-a6de-25bb676afbc8", "value": 77373952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331041, "uuid": "0f1e12f5-bff5-4163-91a2-78f12c86eef9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331041, "uuid": "f2b76d18-a55c-479f-92b9-b48d89fe9d31", "value": "hr_sysdialog_win7-win11_202601024.111.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b2a8d1-f986-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769301815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301815, "uuid": "98ddb9ba-e479-4e09-a586-197dc6d4c4a7", "comment": "Malware payload (Mirai)", "value": "395c16a4ac5c05ffb527d720f10d9cb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301815, "uuid": "631395e3-aaaf-4ab0-adac-64e2068b9418", "comment": "Malware payload (Mirai)", "value": "e788e4ffa50bce22142d86f232cb6832bb07c3d036ff816854af8debc0dc5dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301815, "uuid": "aeb478e9-22d2-40f6-8ad3-fe78063c6a62", "comment": "Malware payload (Mirai)", "value": "f9dd81a6dad692ead113c5f13a282b81ba905e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769301815, "uuid": "444976b2-5208-42de-b5c4-1af9701e701e", "comment": "Malware payload (Mirai)", "value": "fe4513f8d5839cfd16125a45072a8ac6ba785bf95779e669254627d0ea2e65c12a659d46524bbcd7d338e16041f17549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301815, "uuid": "045bfab0-81e3-425a-ae4a-98ff5ac554e4", "value": "T1D23301D0D3E11FE6C4FB92752B9E76515A30E6718728CAE54A843C456BE1B4C12CE8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301815, "uuid": "90a70226-2db6-4a0d-8b40-2417ae89fe7d", "value": "768:GC3cz0GBTqHei7we1r33OPB+ZyquILVSzSe7cMqIcYPqyLhp4nbcuyD7UsUR5:739wex1L3OvYyZq6Pf1p4nouy8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769301815, "uuid": "291848c7-ecbb-4981-a672-915155fa37e9", "value": 51988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769301815, "uuid": "1a6acb53-8f04-43f6-abd6-03343e329e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769301815, "uuid": "db8a4819-fdfd-41bd-8c86-982fba95fcc2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96516816-f9f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769349363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349363, "uuid": "7c25bddf-5203-42c3-9841-70637c68fe38", "comment": "Malware payload", "value": "1f0ee56343572b3600df5835ccec8347", "object_relation": "md5", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349363, "uuid": "8d855b37-e7a0-416e-8f00-69fd09ea6b18", "comment": "Malware payload", "value": "e7c91950301dbdc2b29e311628936adc7c59149b01ec4ccad6146de25f4c0f9a", "object_relation": "sha256", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349363, "uuid": "f71694bd-25c7-4e1d-929f-f421a9739e4d", "comment": "Malware payload", "value": "7b1e67bcb9b31720d42fdc94acf43b9a3e0bba89", "object_relation": "sha1", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769349363, "uuid": "95ec1234-7a06-4fed-a90a-9d3e7cda7072", "comment": "Malware payload", "value": "7d047bbca9fe6ea738129cb6d872b59147aeedced27a70ffe3a6b9145eb308bbc8c75db7b3a4b8784f8f257dd9a0f20d", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-107-177", "colour": "#F4F9D2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349363, "uuid": "47401e0b-4811-43a3-92cf-e590f8a9b24c", "value": "T11D96331B96F30786D3A7F431C6A7B54E6B368288D0850CB26D1947D23283D776FEB612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349363, "uuid": "30d1a131-6878-451e-be08-80579da68a43", "value": "196608:L5SLa88MExZJ8Ll5RjXdKfabvy0DKkHYcu5DWhwsaESrdXzt:84MEvJIl5RjXd9p0WcEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769349363, "uuid": "85847ed5-8ff3-46dd-8ab5-2283fe908e7d", "value": 8809671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769349363, "uuid": "e0594d59-65f8-4356-9442-88b3fe5dae6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769349363, "uuid": "a149c636-7a35-49ef-9b81-3d5e508ad8f6", "value": "dn9b3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f930cc4f-fa12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361984, "uuid": "cc9fa1a3-57ab-4045-98f5-e2c5e540a3fd", "comment": "Malware payload (Mirai)", "value": "b0c5e5817ad9227da20a61f921f25330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361984, "uuid": "b86173e7-34c1-4f4e-b6f8-b88f1c8fc76f", "comment": "Malware payload (Mirai)", "value": "e887552f464bee3ff6994a7005d9074f8136e6aaa287faf27e51f82a5d91d5da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361984, "uuid": "5c23c8b9-086d-4d56-ad5d-bf0bccd54ac5", "comment": "Malware payload (Mirai)", "value": "cd77f89bee316daa18e435d5818d54ea0d5f29a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361984, "uuid": "88aa13e6-c800-4e30-b336-83d6697ce863", "comment": "Malware payload (Mirai)", "value": "09e26beb57ac2bc41f1999a5c0c1c522b6b8959fd1d5bab2214b2b56cc7bc3a074cab87290fd624eb8c171017918c96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361984, "uuid": "830f7ba3-81c6-4157-81cf-57ff93322329", "value": "T14793288ABCC5C702C6E061B2FF1F519E371643A8E3E6B107CD19AF29674B85B0A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361984, "uuid": "1b225068-28fe-44e8-85a7-204d2e7ab46e", "value": "1536:EP+1hG0KbytkvJ8TidfJ4bMhACIJnqDv2/HvCvY0J25pec8ogzDK/vYX:EW14h9h83IhlIkDvGqE5pTNIK3YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361984, "uuid": "cb109815-a85e-424d-9d90-7bed3a2548bf", "value": 95624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361984, "uuid": "c6e92637-a4e9-4790-83ce-948dbc76b56b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361984, "uuid": "e502b38e-00d3-4516-84ee-055791cd54e3", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9331e11d-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383288, "uuid": "f619883a-d268-4872-a8c3-229295e7f650", "comment": "Malware payload (Mirai)", "value": "9e13e6f4d154ea0d17283e897735589e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383288, "uuid": "4ef4747e-04f5-4e1f-804e-03fc0405edfe", "comment": "Malware payload (Mirai)", "value": "ea147f75569a79b6594801335977ac607b790ab362f6c43b8f64b8157abff727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383288, "uuid": "41a01225-f5e2-4dc1-acc3-3980853a45d8", "comment": "Malware payload (Mirai)", "value": "686ffac7e92d22111654be3e97777750becf4c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383288, "uuid": "3d4c048e-25ca-41e0-89b8-43c3b3fba08e", "comment": "Malware payload (Mirai)", "value": "33970cb244f3984c3105e51ba70f1fd1f5590ed9c516dd8008c84fe777efc810af61fa53fc0c18771aaea78cceb598a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383288, "uuid": "c33f61c0-2432-4b29-a58a-25e5b046479b", "value": "T1C8B31989BC859B11D5D525BAFE0E518D33138FB8E3FA7113DE185B2A538E85B0B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383288, "uuid": "dd637573-4080-4c42-8fc7-1003ab5058ed", "value": "3072:dpSyp2EtW1myEtLfezviSlukeEQ6Qb30vgyV0ZUQz4KxX:by1icviSlunb30vgyiZUQcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383288, "uuid": "7c52ee59-a688-4d7c-bbbd-a9b28472cd31", "value": 116980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383288, "uuid": "cd3a0cd4-6115-40f8-8425-a659cdbc03d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383288, "uuid": "12f9dbcc-612a-4cb1-a118-bd3a67fe16bf", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf82697-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344732, "uuid": "d6e2b699-ac9a-4342-b1f1-d8e55f1bee64", "comment": "Malware payload (Mirai)", "value": "434fe9975b0a0b54a5bb92482686914d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344732, "uuid": "10883269-3fd6-47d7-b2d0-38d4fc8a503a", "comment": "Malware payload (Mirai)", "value": "ec1c1f0f7bfc129b1f6ce18609f137795b9d332d91c2d6adce581081dffbbd25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344732, "uuid": "dc0d2987-e8c8-4aa7-be37-78368ac3e804", "comment": "Malware payload (Mirai)", "value": "a587ef0ecbec9cc41ff357b0b35477fa60eb7475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344732, "uuid": "505aec34-c966-471e-9c04-08c8cea5a7e5", "comment": "Malware payload (Mirai)", "value": "9228772fb36f627169e61b6612d08235552820cffcd6ebf9e00c7530fc96f2b323207a0bf44bcc31bbe607d0aeccd352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344732, "uuid": "aba2debe-3a80-4ceb-8a1d-130d6c6f6f87", "value": "T1ACC39E32D8396DC4C1A45434F8B1EE711F61A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344732, "uuid": "2924db33-24e9-4ea9-9f79-a274a391223d", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwRQaX4jnOsKigXIQSUwrVr1vwq:qf5Z5Z98XdmVMJaxaX7ziGSUGfIwEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344732, "uuid": "f719ed8d-1b7a-49c6-8023-352bae9ac5a9", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344732, "uuid": "aca6128f-28c1-43be-860c-5f4b79663457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344732, "uuid": "ba54b610-eaca-4071-8915-8d4965d16ea4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b157d37-f9c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769329909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329909, "uuid": "2f1429be-bf6a-48f1-a39e-cc17b122d098", "comment": "Malware payload", "value": "5c0cae595a50addfaa3f4562c687a0ef", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329909, "uuid": "924a2641-fa37-4cfa-8ffe-15120be635fe", "comment": "Malware payload", "value": "ef18188e4350786183d2f488ac6d4649a4c9100f328d0e487b9ec78552b9d69d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329909, "uuid": "a26c07a6-c1f0-4073-ad35-85ca348cae76", "comment": "Malware payload", "value": "1db1953380b6b2b3ab8362aee8f1ba07c7b5c80c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769329909, "uuid": "67cede99-ea4f-4238-a7c5-28a480b0e5f5", "comment": "Malware payload", "value": "c5938b149fe91e47e1de7a41e5be27efed4dfaea8222c523707399a338b0ac0d24921ff1975b3adc5f9b84fa3fef6eaf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329909, "uuid": "ce638809-27b1-47bc-bf4a-c4db4aa59243", "value": "T162083321B27739A4D61FA3BFE0A85FC884317DE17317E96B23787BB146B164261B1843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329909, "uuid": "95702235-79f8-4389-a0f9-6180fa7893e3", "value": "1572864:ll7SgYK7KnE9m9hBmdn5TSaxDZe3iEf3cT8uDESzccn8VeV0:ll7SNdE9mYHTSaxDY3jUEYb8Vi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769329909, "uuid": "7f272b2d-e857-4fd9-87ee-52a50f76a1ff", "value": 79990784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769329909, "uuid": "7976a01c-77eb-4362-b3d2-2e63ae3f6754", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769329909, "uuid": "89c57b78-536c-4d39-815a-3d4a984cce89", "value": "google+chome+win10-11_v5.3.1_1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a57a36-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384257, "uuid": "f60ea6fc-101b-4b63-9974-93f2b04898d3", "comment": "Malware payload (Mirai)", "value": "23e56023e328c487a3fdd34847455793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384257, "uuid": "59e25113-3d65-49fa-babd-1fa1c9c5e210", "comment": "Malware payload (Mirai)", "value": "ef7097c0d374e039739cc2735aa1ddeb99fb604f7ac5fe4e9eed98b8d0151ddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384257, "uuid": "d239b1e7-7bfc-4c7c-8575-0ed2f771f521", "comment": "Malware payload (Mirai)", "value": "2c5278b8cce846e14abecf256d9386ae0a43fdfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384257, "uuid": "e0189171-34b9-4831-a419-e53225e42e3a", "comment": "Malware payload (Mirai)", "value": "788c832d667a00dc996b500d15f9977ec5060c2bad38ae2be1a89d5e3f4c230649439ce6eec1239629e4500988978e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384257, "uuid": "d2d619e1-ae72-48ac-9582-a95c6d2beb96", "value": "T1C9A33A11FD781D27C5D0727A51E74631F5B643E926B89A0F7EA31D8CEE14220312FAAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384257, "uuid": "606ed04e-a946-4bcc-b37b-a17a241559a0", "value": "1536:Vak8Q3qlVAUSwMy/vJEfZTDf/tvDfEPM/MX1JgTZ0y028viO9HFrnE:MH3XAwjvJEfZTBwXX1q6N7rnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384257, "uuid": "471b9fd5-1ded-4bfb-a40f-d46f2fa31405", "value": 99780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384257, "uuid": "9c381dbd-9238-483f-accb-efe8fa564460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384257, "uuid": "6b2fd5c4-497d-48d8-83af-be7e9af11a61", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268093eb-fa23-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769368932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368932, "uuid": "4f886490-40ca-484f-8e4c-b588e9ee2580", "comment": "Malware payload", "value": "feb06220641429a1c4b550e7e3dcf44e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368932, "uuid": "9afddaf4-d689-42ff-b186-69b85a3d547e", "comment": "Malware payload", "value": "effe4899482f8a991369df46453c5a7127bde76ec59ea816e0bcafe9f612aff1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368932, "uuid": "47f7df25-939c-4a90-84f4-6afbbfa63747", "comment": "Malware payload", "value": "367ade1ad4b1e86ba8243ca41a0e47e7185eff1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769368932, "uuid": "66739e36-18ba-4544-b33d-cd876a272900", "comment": "Malware payload", "value": "48eab6d6f9cf5c6f5f9dd8e60a489cc4ab5dd7396acd01f3fbe61ea4496315dd424e9973dcc1fb1d77956d50f36f53c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368932, "uuid": "b6165e8f-c928-4d65-a76d-bbd3aa69cdf3", "value": "T1AF46F019D47990C7FCD302F23B699262A8137E3FDD3CA92B54B48B409249DED126B53B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368932, "uuid": "cb6ad1dd-ac1e-4aca-84ac-ce21a076f255", "value": "6d2ea576a9afae15b9b53bf858809461", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368932, "uuid": "015a2e82-6aee-4fad-bb87-910a5027c450", "value": "98304:nFypbyB4/zrVvTVlGRJChyQhUUmcRc46Oyi4g:8P/PVrmJCZRmOyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769368932, "uuid": "314cfffd-420f-4d4e-9a2b-d81fe32665e2", "value": 5475840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769368932, "uuid": "ba4d436b-e46e-433d-9181-1496d867586c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769368932, "uuid": "368be989-eab3-4a60-9ecc-5c22b36b6251", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88569411-fa19-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769364801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364801, "uuid": "8f551fe2-563c-4ab8-9073-ee9408a22d55", "comment": "Malware payload", "value": "0e2de048dabef27b35b8291934f79da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364801, "uuid": "26f66ff2-32ec-4918-ba41-4b0992ed08c1", "comment": "Malware payload", "value": "f036bb3dacceb7fc56e6d86687568a273adecfdb676dffa5abb0d572aeb78bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364801, "uuid": "39c9e969-ab9e-461c-88b9-7fecc4c4e99e", "comment": "Malware payload", "value": "0d869c7fa03250dbfc747b28f2aa65aea5c8dfd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364801, "uuid": "b21ce8b4-e714-415f-8cb3-37528a0224b4", "comment": "Malware payload", "value": "51189fc59628c3ca23fce418126dffcf8e9baa1b4ccb49ca92a266de9c63b9607c465af99d308d7cc9b851fa67738b00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364801, "uuid": "1808fe05-b666-4e5f-97ce-47f86d4bf83e", "value": "T10BB4231882599E31BF9828F7ABACD53E1173E2875A4FBF8166F4C500B753029610D3AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364801, "uuid": "50fa9c25-902f-422f-a356-aff9ee925fba", "value": "12288:oYkiQprdFz4/PzSupPF32i/LYD8mBdILKF90xlEA:RzOnel5KDZdILKFKxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364801, "uuid": "0b991d2c-9500-4ebe-be84-826e6ceee668", "value": 514691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364801, "uuid": "f794216b-b08b-492f-a643-aa74737cbe95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364801, "uuid": "dfc9e70c-651f-4b45-8810-040fa6351501", "value": "bizy.mipss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ceb6b2-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362165, "uuid": "22d17da1-9d47-4aa6-a324-8f41e6d7c517", "comment": "Malware payload (Mirai)", "value": "b72172f35e9bc7ac5a83f6b6fd6d770c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362165, "uuid": "21c6e412-3da2-4586-9e6a-5d623c6e9fd3", "comment": "Malware payload (Mirai)", "value": "f0619d9624f3eb5e0362c8a6e82f5ce1d732442cce4bc3e347cba7a9bbbfc3a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362165, "uuid": "851728d8-4b5b-4c06-bf37-2514a2a956e2", "comment": "Malware payload (Mirai)", "value": "056c2dfe49d53e4199b6b47b79d94fdb37a46ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362165, "uuid": "817aa6c3-9951-4e46-8b1b-cbcc9e1a27cd", "comment": "Malware payload (Mirai)", "value": "804bb241a682c36196aa5a268468cb190f51ee13a6f593962fcdbfdbd45abd6e09b64c3d6f27e4e0d348e0caf4ac29ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362165, "uuid": "5ab3a6ee-1bee-412f-92d0-4ee8f4722e7a", "value": "T1FDC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362165, "uuid": "d93cec3c-5068-42f1-be28-67297b643761", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyiw:VoRNjmj1VGFVrRiy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362165, "uuid": "dcb46e97-1052-40cf-a6a1-1fdff21b6a85", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362165, "uuid": "24c60300-bc1b-401b-8ab3-8e8c4d328f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362165, "uuid": "4957934a-2b0a-4331-ab07-b91d91baf407", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e7afec-f988-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769302550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302550, "uuid": "95003a03-e536-48a2-a0f4-b2662567f695", "comment": "Malware payload (Mirai)", "value": "50a7f74d62aad2c5589b7b83035c8a28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302550, "uuid": "08146e0b-357d-409a-8980-5bcdf0037f1b", "comment": "Malware payload (Mirai)", "value": "f06c55fdc18461750f67e538743f7a1421857b4660918eb7e9780b61aa6ab74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302550, "uuid": "f5380f5f-4518-4950-a09f-26ffdfd45217", "comment": "Malware payload (Mirai)", "value": "1a9f50c79a4b891cad0289f16fda229edd313aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302550, "uuid": "824a9aa5-74fe-4ef5-9778-9455937814e4", "comment": "Malware payload (Mirai)", "value": "dcf693fa79b52d9735e6e4c23e9f5768c0cdc2746d3c60b1d8421760b12999bc565acf8c31caa931b3882da0f5e78c06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302550, "uuid": "4d5ee877-0fe0-41f3-a66e-36ed1ee1ab31", "value": "T1A883B6197E218FBEFB9E86384BB78E21564833C626E1D581D15CEA015E7034E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302550, "uuid": "673c2ea5-1f12-43c4-b941-5afc8d754530", "value": "1536:T+/XIq5WQpTs2Qyx8lLEr0vOZM2c/7wRVfS2NZN6q:TaXocTR0Er0Wm2bRVfS2NZEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302550, "uuid": "860e5049-1c03-4ac0-b062-9355be0d85eb", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302550, "uuid": "27dc41b8-d398-47a4-81d0-41fa6fdbf5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302550, "uuid": "1ec2b166-6414-407e-b6eb-4192007c10cc", "value": "SecuriteInfo.com.Linux.Mirai.9788.24687.7816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79a83ad-fa45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383832, "uuid": "fff53f1c-5b99-47db-b597-9e626c494b30", "comment": "Malware payload (Mirai)", "value": "9c23c164ea74a98c78f9245090d079c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383832, "uuid": "9a6c4fe3-0b3d-455d-a574-4baafa8cf922", "comment": "Malware payload (Mirai)", "value": "f0a9e312033ff5ac296b1d68a00ba03b07dcdabc4368532f13ea7e8b0e43d0f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383832, "uuid": "fa553252-abf5-4ef0-85b2-8e583d9ae695", "comment": "Malware payload (Mirai)", "value": "7601e3fb9e0f053f46a3a7707fc19c279c400d6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383832, "uuid": "8a9f7a14-29ae-4044-9531-4fbf5ec390b3", "comment": "Malware payload (Mirai)", "value": "cc6ced316c90f8f2e0a75de306fac448709844d24f7d841f7a2b9d1dd03a32ee10c8b59da47efcbdc52e22d062bfead8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383832, "uuid": "d16c04ed-6e6c-49e5-8608-da3c98667398", "value": "T12783184ABD81AB15D5D525BAFF0E518933134BACE3FA72029D245F2527CB92B0F3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383832, "uuid": "50716a43-1218-4a82-9f78-2c1a4613b9e1", "value": "1536:4NnaT3IMPt6kiGsEKFeg2ff+sBHyHIX8zuChjIEmUxlllkiT7qVwnWZNzYaX/i:jIMF6rGTueVBBX8zuChjI0h7qVwWjBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383832, "uuid": "b559168b-0b22-41a9-9a39-2fba294e9310", "value": 82216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383832, "uuid": "60a0d5af-6409-4ac1-993d-339474c06f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383832, "uuid": "e32c7f7a-5c72-46cb-ae42-55305ddd106f", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d058db82-f9ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769344736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344736, "uuid": "c44cd24a-04c3-4d79-b73a-847279458507", "comment": "Malware payload (Mirai)", "value": "21383f19c2a3a34cac06253bb2482628", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344736, "uuid": "f1ccee6e-adf9-4872-8c62-6bba9fc7548e", "comment": "Malware payload (Mirai)", "value": "f0f07432c87c5f0f85220ecb4163b6cf6e68d5769dfff78825f013f2b7d9fe54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344736, "uuid": "28d91908-46b0-47f8-b9db-221e8ad17db0", "comment": "Malware payload (Mirai)", "value": "9f76672681b16ca1485848785440b5faca42917c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769344736, "uuid": "07a1e4c1-a47d-4401-8ee1-f0bbd3a8a88d", "comment": "Malware payload (Mirai)", "value": "dafe10ca16f6006b44ab2561c3c7ccbe4c4929024d752a94c1943dcc320efafadcad95964148addc73050e9567f4338a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344736, "uuid": "c363cc01-340c-4296-9919-d3a53907121c", "value": "T123041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344736, "uuid": "75cd545f-ca7b-4047-8792-caf3fdf623ad", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAK+LYV0fCtZ1SD39rsJzjM9fx49SY2x:t3nEr5dfHPq7UTo7+svR9X0l6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769344736, "uuid": "a270408d-36ba-4e32-90e0-854bca3b3437", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769344736, "uuid": "9ddec0b8-a1d0-4244-a59e-ae6addd6c44a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769344736, "uuid": "11b98bce-9c58-4338-9429-4fb925e9dc3d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51ee3c2-fa11-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769361521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361521, "uuid": "225785ac-082f-4f1d-9b13-dc4388720da6", "comment": "Malware payload (Mirai)", "value": "02e9b67bf9e80242e9a41eabcb4dc720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361521, "uuid": "5f119a6d-342d-4a46-a084-de846b9f2ece", "comment": "Malware payload (Mirai)", "value": "f1c1675096422557b338187c63c33f18fbc2aa61039e09df4c81a836ad426563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361521, "uuid": "003592b4-4990-4b1d-9459-6c7d65744cc0", "comment": "Malware payload (Mirai)", "value": "c27ed72fdbfae788e89a5ac8f7e61f957280dd9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769361521, "uuid": "ffb044f1-9870-4998-92b7-8f8cbc2b97ac", "comment": "Malware payload (Mirai)", "value": "291eb8e51c20da06668d736f615c39c4bbc4cab320d53f993f412d76ea2e419d04e8281f0aeae7fbe59bd63b6baaeaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361521, "uuid": "e8219e3c-9764-4bfd-8ddd-2aeb38db966a", "value": "T132B3E085B210AA55C02672FCB187099093B17E7B4B9A150B8473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361521, "uuid": "9d585703-8001-4821-9d52-113a0dd13f03", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wu2:as5zqhr5Nzy7wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769361521, "uuid": "607b8b7b-1f27-4160-9e84-4dc693a8f115", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769361521, "uuid": "bd115373-fd76-4f7d-a35c-1146f43fe5c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769361521, "uuid": "953b6849-a1de-47a7-893f-bec151c87a63", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c401a9-f9cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769332080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332080, "uuid": "01d2fab3-1045-4f6c-ac52-0d15e26c114d", "comment": "Malware payload (Mirai)", "value": "78330c80bd1b200ea0dfe4f46c128135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332080, "uuid": "4cf7abfc-0aef-4dca-bada-05e77e471821", "comment": "Malware payload (Mirai)", "value": "f1d66a02dd25bced105fd72b49fdc493fd1cd6458e96cd41be8a48119f280e9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332080, "uuid": "387ff189-65bb-4152-b2f7-bf97f7465f9e", "comment": "Malware payload (Mirai)", "value": "98bbe66f821ac89eb4de45bb4eead0bdb805a8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332080, "uuid": "529c15ed-4b75-4eb1-bbc0-0ec3c67b5492", "comment": "Malware payload (Mirai)", "value": "0509ef1b9463a739deef8cb174bb64a15e686bdab038868673d7953fa93a98f4f55bc70a7ab6c40921b4573ea569e3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332080, "uuid": "3eb63235-09d5-43f0-adc4-caf46828cd97", "value": "T14533099279928F03C5D522BBBAAE018C37217BA8D1DF32079D217F8077C989F0D67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332080, "uuid": "9a969115-50a4-4fad-99fe-e068ae5e0e50", "value": "1536:JdTx9nRp9Su0DZ2IEqSBgWhKhxJVVM7Z:JdTx9n39rWSBzhGRVM7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769332080, "uuid": "f03dfc54-7090-4214-99d0-76309f78a35d", "value": 52772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769332080, "uuid": "248fe1b5-4167-44c9-883e-3c6a30998330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332080, "uuid": "dfe4f1ce-a5a2-4b00-babd-d7c8a9256908", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8675015d-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354490, "uuid": "8cd255f8-a43e-45ef-a0e4-02f617018389", "comment": "Malware payload", "value": "b2eafaef9ccfc0a913b9ee4cc36a7b5f", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354490, "uuid": "e15bb747-f1f3-4fa4-aeb1-91b88a8cee90", "comment": "Malware payload", "value": "f26bb2c9cf11387f4096fd4961ca61d97748174cb1c9e9b3919d9071373b8e05", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354490, "uuid": "1bf07ed5-58e8-4b39-8206-af0316e34df1", "comment": "Malware payload", "value": "50a8bc2b70b15be84875f01ce7c2e0f866229375", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354490, "uuid": "945248f3-57d6-40cb-a77e-60bfa0f0f14f", "comment": "Malware payload", "value": "ac067213c91cabb2d5f535a3655348bc1f943bb5f3c6574e411eff6276ff12e3d59ef28da47845a7325d4a6c87ed6b24", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354490, "uuid": "c9bc1f1e-5ef9-4481-b92d-34b358e00ce3", "value": "T1B3157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354490, "uuid": "ec4f64f6-9462-4e3e-b8ed-2232676313e1", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354490, "uuid": "b8c32f6a-7f42-49ca-b71e-415a0ffc6aa4", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6cG:d/QMnl5YL7WzZyQRd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354490, "uuid": "c77e859e-ed78-40f9-8fd4-6668f9a09ad8", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354490, "uuid": "cc02472f-7eff-4cb9-9b95-5724f21742c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354490, "uuid": "7b4fb6b1-d373-4e14-acb7-5b111af456b5", "value": "Y281798985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7035c29-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363188, "uuid": "3ea97841-4224-4149-85e7-4d44aea63577", "comment": "Malware payload (Mirai)", "value": "7a2b8364dff52470577c4a0474473f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363188, "uuid": "8bef0323-bb13-4da1-a48e-4203a9a920d3", "comment": "Malware payload (Mirai)", "value": "f33e6455976ea9b36a3e6d3740a257b456cdb7f9f0b6f1eaa4f03ddd819835b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363188, "uuid": "3d80c7ab-86ed-4bf0-9a29-f12ccc9fa562", "comment": "Malware payload (Mirai)", "value": "25ce24b04d2d05904d524c3378be46bcf45c1e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363188, "uuid": "62e71b0b-1182-44a2-bb0e-f3d7c227e94f", "comment": "Malware payload (Mirai)", "value": "cd053ccb8f9cdd47b0c0336e840e73549e5f621d1ba8da541ddd667887d9417b5da2f3e416f2f15fac10b4bc1450725e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363188, "uuid": "b4184b99-daec-4d57-8f5e-85380b8d7828", "value": "T15FA31BDABC858B11D5C525BAFE0E618D33134B78E3FA7213CE185F2E574A86B0A3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363188, "uuid": "c5958faa-b349-4617-b0af-58b43eeacccc", "value": "1536:GWnYGA50k693A0wKlul8lbE2TYfOg0vZs1feDdPbfEB9VscMDiFH8bUEVAeM7y0M:K50kI9BlG8lbE28fH0vZaeK3H8bUEVAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363188, "uuid": "1006f190-2d3c-4085-82d6-d251c1b2db1c", "value": 97988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363188, "uuid": "5f5ee82f-bd96-440f-9302-10944bb18c9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363188, "uuid": "26e72e3e-465e-4b41-b9c3-9d0730b4f80d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de47054-f989-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302882, "uuid": "42358ea8-d43a-428f-99a5-e47f8b664310", "comment": "Malware payload", "value": "94f181e7930b867e7b3def09b4cc635c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302882, "uuid": "cc8b44a7-2723-4a2d-8139-cab8bba308b0", "comment": "Malware payload", "value": "f3fb80b230b1a884d943a4396dab181890a6893244fca069b2a04ebb0d34c7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302882, "uuid": "d1e8adcb-2e7f-40de-8956-34863644d483", "comment": "Malware payload", "value": "4887d374b13e218a5fdde690400e2fa448c3e5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302882, "uuid": "258eab24-ae6f-4589-ac4c-4880e168e5eb", "comment": "Malware payload", "value": "69495fcc4e8184091b934126b6ecce01c3dfde497a1423609af008bfa8ffafc9ea2d8aa384f324a831114c28dc6d0714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302882, "uuid": "a428a283-f861-4571-80b2-99f78df0d605", "value": "T1C9C73317F79D12FCD4BBC2748A12590ADA777C1246208A9B22E4769E9F371901E3FF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302882, "uuid": "57b790d4-66b0-4f30-b447-52ef9e6f4034", "value": "a189020a7b241ae3c1f33d850a9853db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302882, "uuid": "fe733dc6-f3c1-4a43-a744-f78c9762f077", "value": "786432:LZwWsw7v9NcPHDGp2Keij6idEiKG6yM4noioh2COB0OKiaq85GS5le0N/EC1zsl:LzJpsKcdij6idVMyo8TB0p/5Gox/1zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302882, "uuid": "3910b87c-5a78-42f2-a48e-8c4810ad720c", "value": 54371840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302882, "uuid": "98d202bb-875b-4b47-a3d1-4920d631fa54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302882, "uuid": "b4d8f069-7a4a-499f-891e-b8eff4dcb64a", "value": "Telegram-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c93d2c-fa0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769359883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359883, "uuid": "31fb33c8-3f21-418e-93d8-80579fb0cc69", "comment": "Malware payload (Mirai)", "value": "5400e9329cb5000b2780c01351851660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359883, "uuid": "8f77547d-0fe9-4269-9de6-600a4947dfa6", "comment": "Malware payload (Mirai)", "value": "f4168e8340f4d60be6f1d590390015f1b09c91cac9678ece096af5d13a950aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359883, "uuid": "06850309-493a-4063-8548-0d6a4aeea3af", "comment": "Malware payload (Mirai)", "value": "169ff425558d095818e2ab5e6a315478d0b64d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769359883, "uuid": "cf3a6ba8-ba18-43aa-bf2e-5c4454591faa", "comment": "Malware payload (Mirai)", "value": "fb2d6160340b82bf89571ab7c6c6fd618f11ff027977f7711602589d2f1a249e00d4e4f61ec6961aad7f04a3aee607df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359883, "uuid": "00399ea6-558f-4eeb-9fef-1530e1d6a60a", "value": "T1147302721167DDA2E6B2C03263877E497E32846A037863BEBC79A71FE486E115C4C45E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359883, "uuid": "9a0d7bac-c669-40e7-98d4-28be7c2d90a0", "value": "1536:a8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmUyw5Korj:hzRnwP0bMQ2RijvDZZ1rYGhG13m5KSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769359883, "uuid": "159a3874-a087-4484-bfbc-4d377b01b43e", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769359883, "uuid": "96dec4fa-4fd8-428d-940a-8436e6166f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769359883, "uuid": "95dd007a-8fa8-47ee-a515-09935f3a1dee", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75738683-f9f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348449, "uuid": "5ebe4f72-b381-4b61-bc11-4f921e4a1f16", "comment": "Malware payload", "value": "3b8e3c67643cb9f7d78cb091ae9afa6e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348449, "uuid": "236f36a4-6ed2-4329-bc7f-9f9180cdb58a", "comment": "Malware payload", "value": "f43edbb93a7255129839ae9fc19a960e95dc4035ca17367d45b03deea1b47626", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348449, "uuid": "6fb19b8d-742c-4e4b-933d-279dc3f36942", "comment": "Malware payload", "value": "623c04dbb5a2fdf713ea12585d05cd7ac6dbe210", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348449, "uuid": "51440113-a8ef-4d21-8bba-1303a03d7ebd", "comment": "Malware payload", "value": "7f8f6bd5281d2d83810c972fd6777a4b3683ec3a7012dbd3a305d09369a76bc21caa065cdf3bc6e8d56e36bba22ff65e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348449, "uuid": "0c2b4b0e-e911-44cb-a950-a3942c06fe72", "value": "T15495335B93C572A7E83607705DF511038A32BCA5A7B969BF1164B06CCE331E4A836F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348449, "uuid": "f6fd275d-f749-4739-afc0-cf0e275550f7", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348449, "uuid": "6efec908-f59f-46ff-92c9-99fa1bb7aaee", "value": "24576:i+K8EoaGlFQWwThdZtLKSm4jC4Q1vIhOptnNuMI/Ll8QG6rMJTOGHbGtlsz9ftbw:0jo3rQ7d9BpQxTnN1mLl8GgJTFbEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348449, "uuid": "ef42b1a6-8d13-488b-9548-5f4c9806c6ca", "value": 1937920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348449, "uuid": "687fcf9c-91d9-4549-83b0-ccd54e6d8cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348449, "uuid": "e41eca01-1e0f-4199-89f9-55f70f20ff1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc32a244-fa47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384699, "uuid": "03314686-977c-430f-b4d4-e0e26a59ea15", "comment": "Malware payload (Mirai)", "value": "be463d2816b8b8ea7d3998060789d599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384699, "uuid": "c66d107f-8186-422e-b28a-1ead8dfdc908", "comment": "Malware payload (Mirai)", "value": "f47d6817b277324bc258b4172a7ccdf3e6b1bfa96f1e3d12a21f24236d3a6317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384699, "uuid": "d10fccd1-9edc-45bf-8bb6-41623c682906", "comment": "Malware payload (Mirai)", "value": "e58ed0796820e8edda82912632cd6d9fed0c7c58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384699, "uuid": "e66ed238-2d8f-48e2-9908-4990ffb00edc", "comment": "Malware payload (Mirai)", "value": "c186130994f65057c7ac92bf7d89a8c188e620ca696ca54501db904826bfcad98fddde04ec796411080b36bb14a85103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384699, "uuid": "be72c9d5-75fc-49b9-9209-be4b866ebff3", "value": "T1E582BFA5D3CA7D51D431887AC9388242E2968778E39B3377542047BCF747A5463FCE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384699, "uuid": "a5213858-e635-491b-8fbb-9450ae00ab64", "value": "384:W+MaSBxBPpKzEOKrJDTk1PEPelGe+5BRBVsaQhymdGUop5hJe:T7SBPwzEOeJDTKEPK4SaQs3Uoz/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384699, "uuid": "41f15311-0d7e-409c-b3fd-92a02ca19afe", "value": 19012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384699, "uuid": "e410c930-de22-4e69-a6d0-7c5ed31d2ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384699, "uuid": "39c29649-89c6-49d6-8e42-5c8cc9601249", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7617317a-fa18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769364341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364341, "uuid": "32db27e5-4577-4167-80f7-d30eaa2b1704", "comment": "Malware payload (Mirai)", "value": "96e2ab2c336c45bd2d8cc41b1e09f20e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364341, "uuid": "60633a55-31d9-406e-a6a4-368061b1676b", "comment": "Malware payload (Mirai)", "value": "f4d4b5ea6d6a1c3b8af364911ab30ff4a93df7fb58e826d0d307f99d222e36e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364341, "uuid": "fe1e24af-8889-4b43-9d6b-4e1d555f9458", "comment": "Malware payload (Mirai)", "value": "de8207151a8a5ab8537130410c947ee5741b7f8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769364341, "uuid": "3300400c-6275-4777-8fd5-3a0b212e0032", "comment": "Malware payload (Mirai)", "value": "c638b1f5a5e09044bcefd267ab5ac8b78749de1ada0d91a74f3744830dd65f6d8f6640bcc16474ded22d8e9a6d21e80e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364341, "uuid": "c0e7d33e-3eb0-4e7d-a464-57be1b7f020a", "value": "T1E763F619EF604EBBD86FDD3746A90B8535CC954722A83B753634D928F21A04F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364341, "uuid": "972ad2e4-0e19-423e-bbcb-b1bf5ee60b86", "value": "1536:n3nALqyzg5ak3DPJjjA+kge87oepZCvt5aZkR4pVAX:n3A2yzIak3DPpoepXD+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769364341, "uuid": "70b5f8ee-4702-4925-92c0-35618fa83734", "value": 72532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769364341, "uuid": "381b857b-14c2-44a7-b2ad-314ff43f319b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769364341, "uuid": "da8c6010-f818-43b8-8737-df07ff4f4b0c", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa987ab-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304389, "uuid": "86884a9e-cf66-4fad-bb28-4c66f9a0cee7", "comment": "Malware payload (Mirai)", "value": "0cdc826f811908f5571f53f96eac960b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304389, "uuid": "d9125f8b-7aa2-4733-9212-81a9d97604ad", "comment": "Malware payload (Mirai)", "value": "f4dd831c5ac9c7b0cce76e5bf610723af474d68540b8748a1415cba2048020e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304389, "uuid": "df1451db-439b-494a-8511-cdcc2daaa731", "comment": "Malware payload (Mirai)", "value": "04583eecb5b29e03c3e6888fff5f21e9969ae3b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304389, "uuid": "8564d552-17b0-4eb3-8540-085413e02e76", "comment": "Malware payload (Mirai)", "value": "d778148344691b22c9fb1908074980eabfa491b63dbafc04e97a023c77420bc61a81462c7bd41c73c9761d4e32611079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304389, "uuid": "91db8db3-4c95-4cb4-abb8-feb56e50a8fe", "value": "T170630AC4F5C785F5C81B893860ABF73FCA32E57A80719BADEF8A5E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304389, "uuid": "1f24ed9f-dbe2-4467-bcdd-85cf636fa3ab", "value": "1536:99IEpE5HVjXLbHZbVCzpKXwY49cuPbYAeWky81:4EpE5HVjXfHHIKhEcuD9bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304389, "uuid": "fe6c48c9-d84c-44bd-932c-9bad40a6e67f", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304389, "uuid": "c71dfb83-b85d-40c2-8ccb-789a1f84bf2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304389, "uuid": "6bb10b56-28d6-4782-9fd0-63d738058464", "value": "cosmic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5910207-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363186, "uuid": "be24687b-cd08-46fc-baa9-eb0ef773e886", "comment": "Malware payload (Mirai)", "value": "e38114adf96722a9ab26b75cd80e4f40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363186, "uuid": "b07cdf25-3d05-45b4-bc01-e500f94637c2", "comment": "Malware payload (Mirai)", "value": "f53007dbe01bd9633d93d24e93d9a23d8958a42ab447c5a5a4451cc66501b4ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363186, "uuid": "50c58edb-e9af-4b5f-af9f-b1d1521502d1", "comment": "Malware payload (Mirai)", "value": "27f1d7ddbbe40b187052f2c00e196b72251b6fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363186, "uuid": "5e44e840-9070-40c8-a421-d902c537999d", "comment": "Malware payload (Mirai)", "value": "1606668906f5171e6869decfe559e96c4a5b2f957375ba6763e9b8c5a764654d425769b3effa351d5f3b8bf7db38d5e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363186, "uuid": "591c7033-5145-4ed5-ab24-0d112276afe1", "value": "T18693288ABCC5C702C6E061B6FF1F559E371643A8E3E6B107CD19AF29634B8970A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363186, "uuid": "2ccb275d-ad88-4cfd-be44-6cd6d2114756", "value": "1536:/dSXJWmACQfs528Qwxzk4MBAe/iagg3I92TB5YY0Jw5Qepijy0X:/MZWnC5ZQYNOA2iw3I9SYK5Q6iW0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363186, "uuid": "d5238e27-b3a3-4751-b246-ef1f370cfabc", "value": 91840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363186, "uuid": "6b0271a7-ef0b-4da0-931c-073c1934ad64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363186, "uuid": "3864a68e-a63a-45e8-8dbc-584fa2c7cc0e", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c0ccc-f9cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331254, "uuid": "aafb70c4-09de-41b1-bb1a-6d85a7d3a08a", "comment": "Malware payload", "value": "1417547c8908811ac2b021365b410d99", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331254, "uuid": "a6a62062-b270-47d6-945e-1a67d308cf38", "comment": "Malware payload", "value": "f53297dfc416bb5c47eb984b319b3079c462195146eaafd28e1195ee8554afb5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331254, "uuid": "5b5a9d49-6e87-4209-822f-e87a3714b08a", "comment": "Malware payload", "value": "3d9412a795c75440268c78839fdeab80d24e3909", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331254, "uuid": "75ae8b2d-4479-4113-a0ea-7afb43653a23", "comment": "Malware payload", "value": "06e41c09506e27852d50142496016c0e35903bff489235993d7068220836bc37604a5a17810853fd2042cc84885526af", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331254, "uuid": "7770f4fe-5abd-4b87-b8ae-b4aad97e4223", "value": "T129D60221759EC132F66F02B2562DDA2AE53D7DE20B7004EB53E4F95A6A304C25339F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331254, "uuid": "67298c07-68b6-435f-a15a-af98a9b55040", "value": "393216:A8yd2t9zrtt8UsqT3UsGcGtgbXRScLRHk:AxsBSJi3UsGcOaSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331254, "uuid": "df94b99e-4b8d-40ff-b0a9-4a5d74221247", "value": 13486592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331254, "uuid": "2d2e2565-a858-40ce-ac2c-b2e21fd486df", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331254, "uuid": "13d3767f-3211-4823-a719-7a5edb585ca7", "value": "ldpuan_chuand6.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f38423-fa46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769384259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384259, "uuid": "2cfda894-c639-4ef9-afdb-b99b0fc36ed8", "comment": "Malware payload (Mirai)", "value": "8ac3f841b90c018bcb57cd2af69eff55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384259, "uuid": "fa83f48d-ae40-4bee-9963-4937516fdf13", "comment": "Malware payload (Mirai)", "value": "f59a3f0913ac53c8044b616f2357e14d18d20b6597f6938f3b2d20c4bf3adfac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384259, "uuid": "5ea07344-baa4-40eb-b3ca-f1dbeabe63b2", "comment": "Malware payload (Mirai)", "value": "8f6231719253f9105447ab373dfcd5baaf0f9bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769384259, "uuid": "0f0415d9-787f-47d8-86e6-645c5d537025", "comment": "Malware payload (Mirai)", "value": "047ef8e5aa3b5e5a4a17a455df7514ae6cadae9a7364a7131fcd629c69ffd600cae051f724420792d8f5b1cad8b68884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384259, "uuid": "f9e7c1e3-4af9-446a-ade8-30c472ece68d", "value": "T10293178ABCC5C702C6E060B6FB0F658E375643B8E3E6B1478D196F29634F8970A37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384259, "uuid": "d768c5c2-1fdf-4ec8-bd4a-8fb9828e33e2", "value": "1536:fdOiz2q08jcvkV7Uv8+4ByCG0MDsR/Sl2F2PBA/Y2NC5beKvBaqDVX71NX:fdLz2v8NxUasC5MgQl2FL/25b9lDVX5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769384259, "uuid": "37870c57-1347-4364-9dd3-1ab585f16bbd", "value": 95796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769384259, "uuid": "40396c36-6e77-492d-a45b-bcf7b1ecea38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769384259, "uuid": "93063587-3e48-4c03-90ee-91cabb499bfa", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08fb4ac-fa01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769354641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354641, "uuid": "27aebf1a-e05d-4bee-9142-78fdb0941788", "comment": "Malware payload", "value": "499184561bcd0a418e37138f2efc8cea", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354641, "uuid": "2093e702-9fcb-4a73-b287-f79a96eb77d3", "comment": "Malware payload", "value": "f5e16a6e2492d88eb6995cdca646c0f343a887d11eae7a29325044e2e3a09c58", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354641, "uuid": "2c336afa-5d4e-4752-bb0a-22908356198d", "comment": "Malware payload", "value": "9bd822580b128c5888ebeaa6b399f926ddf66f8d", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769354641, "uuid": "635806af-1beb-4ad2-9b73-275522f607d0", "comment": "Malware payload", "value": "7245970fc266abc2e6c05f0054c37a49e6ed4a8cf255302314f292f6019400afbb394b5f04d2999f4297adfe1dceb886", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zx-pe", "colour": "#8F334E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354641, "uuid": "096a4194-8cd0-42a5-aaec-b96a81155674", "value": "T19AC080ED1B5580B054CDC86EF12674205C76F1F06157BC724D9D60820E059B45096C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354641, "uuid": "f09fc20d-5ad0-4a22-b05e-cf3272513af4", "value": "3:Fvsa3LWeSQkH3ccxdIBFDhLGOtjve5CRViEDjNVHyoQ2ofeTYUWAJ5tzMFvn:FUNyIstDdGQLbAEHN4v2o2TFJ5tz6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769354641, "uuid": "b7fb9be3-72a5-4714-9276-85dd7c77a506", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769354641, "uuid": "b0371e4e-aa4d-42a1-b4e3-5bb67146a785", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769354641, "uuid": "cbf7e533-fa99-4c73-b9d5-44f21136467e", "value": "Y696093177.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74588fb-fa44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769383429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383429, "uuid": "bb17718e-d7b8-4f77-994b-d8e02648e31a", "comment": "Malware payload (Mirai)", "value": "7103adac2d9b1c4d244d38f6317b3548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383429, "uuid": "fc71447e-dd48-46ae-90f8-6688c690db5d", "comment": "Malware payload (Mirai)", "value": "f75a6a43deaaf2930885a32970c98e1b7804f7aff5f468d3514be0972ceebb8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383429, "uuid": "47c0d59b-b255-4d48-b7db-66069a4d4989", "comment": "Malware payload (Mirai)", "value": "bc0ea2ce875207c1d2166c1643d22dd13e69d99d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769383429, "uuid": "c82b047a-7cf9-47a2-a105-00246fb1692f", "comment": "Malware payload (Mirai)", "value": "7ba0a39e02ffe1fb7047493f81cb61b46f03590641c98206d7c62840c5c9970fb5655e43678b16aaf749012df479c425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383429, "uuid": "5834efcb-2c19-47f2-a162-592158919f0d", "value": "T122631856B9919B25C9C156BAFE0E518D33134BBCE3EF73129D246F24278B46B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383429, "uuid": "abdb5df1-4075-46d5-9f9c-422600d104d1", "value": "1536:3SnCjP6TsF/3sDn8e8vrwdXriG/CIsMMmis1es2Hseiv7T5YOX:36Ts5348e/rV1es2Meiv/5lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769383429, "uuid": "f196ddec-3202-45a0-976a-8f7336c0f339", "value": 68768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769383429, "uuid": "1a6f28ba-d071-46c2-b28d-f558c3108d24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769383429, "uuid": "662a9cb5-49d9-475e-bd4c-eb488f2f5ba9", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d2408d-fa15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769363190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363190, "uuid": "36f28f13-4e1d-4121-ad0c-c6883cbadf08", "comment": "Malware payload (Mirai)", "value": "9e37806ccee21c3f19d8e97f6084ef85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363190, "uuid": "f32ee3cc-cbfa-40d5-a524-137771a893dd", "comment": "Malware payload (Mirai)", "value": "f81137ecf5369581b7d1276b68b9f1bf874f2368268cc271b373291798846fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363190, "uuid": "a8cbc3b9-16c2-4e80-9cf8-ef04cacdaad8", "comment": "Malware payload (Mirai)", "value": "0ca7701a39c76bb91e1bed7907cd12091028568d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769363190, "uuid": "b2b187bd-78c1-43f7-8d57-6862db5cf7ec", "comment": "Malware payload (Mirai)", "value": "fb4eff0e77743222c8b7b54119667e637703a83887712aa0ea41ca1e0cb1d965738a1090d119769fc6ead2ee979beaa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363190, "uuid": "b81b907a-5989-4bd3-a281-8238330cefe8", "value": "T194B3B50F6E539F7DF32C83744BB78B25AA99279633E0C185E25CD9411D6028E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363190, "uuid": "acfcb035-d815-4749-b956-3c0be684d168", "value": "1536:hQGEaQjzh33F33fQ3X31Axp/Fy7udCZZyklWyIsK5RaJVBwMAYhX+:hQKQjG1AxKud7fcK5kJqYhX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769363190, "uuid": "7336d650-fc04-4d05-a242-e9eab0194834", "value": 113580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769363190, "uuid": "0df448c6-8c38-44f9-b6f5-89ee7ecf8a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769363190, "uuid": "3f5e220c-5a2e-49a4-ae17-f0e5245a7eb7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df22856c-fa2a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769372248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372248, "uuid": "0dd93de3-b145-4e24-9cd3-8a2e309ae5b0", "comment": "Malware payload (Mirai)", "value": "5e2db805f91054c2c297203d9f097c24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372248, "uuid": "102f7a81-cf52-4531-8f8a-54a0e05fad02", "comment": "Malware payload (Mirai)", "value": "f897d4ef5bc4d917fe067c530d9155a125b8b0b857d19f655f842ee3edc42c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372248, "uuid": "5e59e158-ab4b-4771-bd1d-7dec676ffed6", "comment": "Malware payload (Mirai)", "value": "27e3197f123f5ec20492ce6bee400525a9732bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769372248, "uuid": "00069fc8-b977-42f9-8004-438707c5a40c", "comment": "Malware payload (Mirai)", "value": "095792a966604249aab11092c921ddfc51bf08fc080600da44b4040f5c8fa221eaf619cfda9ecb4251e9e447e5a661f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372248, "uuid": "ad5703c9-2945-4165-a5a2-4c3f7be75854", "value": "T16662D0B4654393C1E2C4147B4DBF066A3BF3D9852FA8CBC8260A3D4B9DC60B870661A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372248, "uuid": "be6b7ea3-8520-46a8-8964-f44127bae2a3", "value": "384:m01zW/bughEsdX2AMXsAkZa5wAu4JmPg7xfn0m5s6D9i2Y65:Zszc0M/csxxns6Dw2R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769372248, "uuid": "a0ca3ae3-2afe-4401-91df-c4d98779d7f0", "value": 15697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769372248, "uuid": "fb8afcb0-2ea2-4500-9e3c-ac7bf45c1ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769372248, "uuid": "af647217-b205-4e1d-be13-b973b2c8ff45", "value": "SecuriteInfo.com.ELF.Mirai-GH.28846677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea0ae4c-fa13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769362127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362127, "uuid": "51a25bca-2012-4cec-91a6-6cdbbdbd6530", "comment": "Malware payload (Mirai)", "value": "aacb6ace755edff9c57174bdbb2630ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362127, "uuid": "53f552e4-5d78-488a-a406-f3664f5d1b4f", "comment": "Malware payload (Mirai)", "value": "f8b1a672d691ba681050e49658e378dd279402b2f0a9482c6481a6ee16cb18ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362127, "uuid": "893714f4-d400-4753-9b9f-a78d39052528", "comment": "Malware payload (Mirai)", "value": "cb72fd9dbe36017f1cdc88beda4808a7b5d8d30a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362127, "uuid": "8aa8201c-6058-4b70-b421-39d7c73195e7", "comment": "Malware payload (Mirai)", "value": "f2dfeb5ae125c51cd613ebd9fe0c9767f7d0f3d75a46dea1147c10e71be424b79bf4339e4797a08093f30a57af6fe548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362127, "uuid": "e6d7b285-d4ff-4438-a95a-065b8b32c76c", "value": "T17EC3E185BB636991C1A242BDA4C01AC387912E318BA317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362127, "uuid": "63de6f05-d775-4b22-8092-12ebb488d3da", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnA:0OCDjXG9qTWywxlxTnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362127, "uuid": "44a37593-e848-4fd6-b334-a85c7fc2b5e6", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362127, "uuid": "93460eff-7545-48a7-b378-e89989f92980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362127, "uuid": "8c96e3c6-6f19-4280-9520-decc00313c11", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92f6360-f9f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769348186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348186, "uuid": "cf9fce46-6bc2-4dde-83e9-a53235864741", "comment": "Malware payload", "value": "ce67552209730fd02ac4c9f35d14cb2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348186, "uuid": "e1a9b1fa-d89b-46b5-949f-83ec5b63bcf4", "comment": "Malware payload", "value": "f8f52d0c711638b4fa7071bc09255c9ea6d13afb10da5eeca36bde332f7c3b34", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348186, "uuid": "9a2bde1a-7231-4f88-b4b9-bd6f7e2dc7dd", "comment": "Malware payload", "value": "d513b5211444dc64c1aa90afbd61d4f2282b24e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769348186, "uuid": "90374e1e-148f-4912-9c14-05a293e30fb0", "comment": "Malware payload", "value": "3647e38d8af96309664d06384e7cb1746076721bc88f6e0d89e2f64f5140297348c37d7563bb83ad4b96ded515a0c6f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348186, "uuid": "eb8d23d9-bc3e-453e-ae05-9a3ce911bdd5", "value": "T159066B13ACA08DA8C1AAE138DE7255457B307C080B7033D72E93BB691EB77D5517BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348186, "uuid": "9153e949-14be-4250-a7c5-12e09334bf53", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348186, "uuid": "38eb3bd5-2ff5-4a72-b6a3-5ebd43570118", "value": "49152:zX16WsS7LTsD7IkuwbtG75iWZh4wq/i4oFfvxIhIL:z5Q65idoFShIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769348186, "uuid": "4e1eaedb-449c-4f7e-ba26-ee1790f633be", "value": 3729624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769348186, "uuid": "a1d28ecf-d6e6-40fd-8ca4-fd7e207c51d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769348186, "uuid": "07f80db1-15dc-48dc-966b-c7d81ebf91d2", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad985f57-f9c4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769328356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769328356, "uuid": "c853e7e3-8a37-415b-96dd-ca86e8736266", "comment": "Malware payload (AsyncRAT)", "value": "e49b60f7d835de6d81db2930197afbd8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769328356, "uuid": "156b9054-82d3-42dc-9688-cbdba34f9b1f", "comment": "Malware payload (AsyncRAT)", "value": "f952216fd3203db4fe89b492c5e2bdf2af5cce406ca90a8dc9037054c0fe8709", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769328356, "uuid": "2a9ef7fd-7350-4f99-bb5c-9e082b3f8460", "comment": "Malware payload (AsyncRAT)", "value": "38f4ee0156d1fa04a0d68595ac3e30ba1ae0b560", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769328356, "uuid": "4790c25f-1570-4f01-9f7e-6dd7e440692d", "comment": "Malware payload (AsyncRAT)", "value": "02446b609a5afc81fdbf098e2349def965a02a6dc0700bb78b5b733a1cf5f94f6a24213772e3cb1f4c957a94df1a0150", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769328356, "uuid": "d2c43263-3ee5-4202-bbdc-39bfaad59143", "value": "T159D309012BE488B2DC9859BD6C6347304771DFA2680CB60B6FC434BFD9BA6C65D12EB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769328356, "uuid": "1c9dbf1d-7008-4785-9f18-6ba1adb66a62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769328356, "uuid": "0d584c65-d2a0-481c-8402-2867a873738f", "value": "1536:MJQpyy00+idwzcsGbbSHyowGu2K42RSX4xolrDjJVclN:KVy00+OwhGbbSc2K42vsjjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769328356, "uuid": "7c3efe2f-ed55-4f42-96fa-2123a54e113e", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769328356, "uuid": "9bf39731-a2f9-4408-b97b-4623d478d577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769328356, "uuid": "c116842f-18dd-4743-a85d-63d0fa0d81a7", "value": "166bet.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e07e9d1-f9cd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769332169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332169, "uuid": "5992cb59-660d-44a7-9664-da2e64b735e2", "comment": "Malware payload", "value": "2ddfd9b100dfd35ae8eeb2a5a383d566", "object_relation": "md5", "Tag": [ { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332169, "uuid": "01fbc34e-0a5d-4b47-bf58-e22d2e4a5b5e", "comment": "Malware payload", "value": "f985cd667c77e7d99c1ac2ea9cb0861ded15e1c2d44e480cbd178ca8b2caae42", "object_relation": "sha256", "Tag": [ { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332169, "uuid": "bb4363fa-2e0a-4bb5-b8df-c6a193f3e4bf", "comment": "Malware payload", "value": "185938460c4dd40915d1e1c9163d5ca6d5c7c85d", "object_relation": "sha1", "Tag": [ { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769332169, "uuid": "d0290c69-84dc-462b-a564-75ef3ffa083f", "comment": "Malware payload", "value": "fb5ad885d934e53dc6186d0386fab28179741d9150c3b27f5eaf546e82c44dce55e3623bdb0999350284f226cfa6e854", "object_relation": "sha3-384", "Tag": [ { "name": "homabrews-org", "colour": "#641ADF", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332169, "uuid": "f2072a95-bd49-4bc6-927b-a1f16befdff7", "value": "T177E2E826785582F03A8E8CE9AB49F4C62709F10E89C4B135B0BDDF0C37E167461B5F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332169, "uuid": "75afc293-c84b-43aa-8cf6-7748cec33af5", "value": "768:iIXI8KcfKa+9KqeV5CmHn8luvJAZ6s38VSvKY1Jt:yYfKa+9KPV5CmHn8luvJAZ6se2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769332169, "uuid": "74c1087f-0ccd-475f-b124-cfd0c745d8fc", "value": 33013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769332169, "uuid": "80af028f-d0ad-4002-b36d-dfb60cf63a88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769332169, "uuid": "bf16bfd8-d181-40b1-9c34-ff3462092e57", "value": "f985cd667c77e7d99c1ac2ea9cb0861ded15e1c2d44e480cbd178ca8b2caae42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e61242-f9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769323963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323963, "uuid": "ad80d16a-8523-4732-b9e7-93888b182137", "comment": "Malware payload (Mirai)", "value": "f95279c73cef023f4aa990d00024c398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323963, "uuid": "7442a019-cf56-4b70-9f5f-d1019aa3c8d5", "comment": "Malware payload (Mirai)", "value": "fa1718e2fddd1d0c8408bc4a63391ddeb26c7468de3891f4ae0421e638e32944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323963, "uuid": "29535350-b0b0-42c5-a4d6-09116c07ee58", "comment": "Malware payload (Mirai)", "value": "3eb0ae9c478f9749302fe2276af179f4f1d68d86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769323963, "uuid": "5faeb95b-c820-4858-98c0-1eaba86ae2b5", "comment": "Malware payload (Mirai)", "value": "59eb7e65cf1b1fcda8ef05d4dfaf4613d3fcc031f16e5a2f1993263d732c2f8e3ed44e203099963530ae65431c418184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323963, "uuid": "bc423a5a-c668-4e39-86fe-00ec93c998b6", "value": "T10E430119DC06F85DCBB329B1C460C940245EEDF1E6BB207A4A4D5B94BFE6C0224FBA17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323963, "uuid": "76635d43-ce3c-419a-9d2f-15ca2199fe5c", "value": "1536:PqVGH0vNMpqbawBx0kche5n5Zvp4hjQes30Jx5D:kGH0Vsqekq3ho5Zv6hjQfkxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769323963, "uuid": "79d8d86a-3cdd-4fb3-a0b4-39a7280ab6a3", "value": 58708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769323963, "uuid": "ec9f5161-ee70-4064-978c-a94fa7b300b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769323963, "uuid": "a87d97f7-8d6c-41c6-9836-28dc8a91b40c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112eebd2-fa1a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769365031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365031, "uuid": "03c224b7-8de3-4255-9939-4e5274a1d9ab", "comment": "Malware payload", "value": "2b5776a8602c25732e5510261a8e139d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365031, "uuid": "0e522d9b-f57b-48a9-bfba-cdefa72e93f7", "comment": "Malware payload", "value": "fa7ed3b205631c0560e870ba8a23494e12e0b78bba684daadab2a14d0db0325a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365031, "uuid": "607aae84-0106-4272-9f5a-464b9d2a9f8f", "comment": "Malware payload", "value": "ee0484ecd931da12bf29dbfca69a7122dd8048f9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769365031, "uuid": "29c40515-7b90-47a3-82dc-9d3406a451c6", "comment": "Malware payload", "value": "f23a641ff41ef88bb25b9bb3fbc0fbe03cd1df103296162463fa267e42e42bc441a8472f2eddca3f47325ec818f3f4fe", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365031, "uuid": "31f10f46-6001-45ef-be2a-5f9c02d4e36c", "value": "T1CDC5E014A878D0E6FDD741716B566221B4327E33CF282A9B51E4876CD90ADDD0A3F32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365031, "uuid": "f1bc370c-772e-4bfa-9724-57d31783e057", "value": "155dfc2d31fa3e5e20315bf41423c877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365031, "uuid": "bb787ed6-b850-4462-be87-5090f6aece37", "value": "24576:jVsV1wkFGaBo09PZknct03g1QxWL5f/A/J/xKf6sne:KZwqo0OSyWLh4JES3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769365031, "uuid": "750c27e3-3c0a-4d01-ab80-cc0368452090", "value": 2507264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769365031, "uuid": "e57bf51b-145f-4e7b-b9e8-74f42094de7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769365031, "uuid": "b3faf929-3528-403c-a06a-9b1415401ddc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7380e0-fa10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769360864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360864, "uuid": "c3d3be31-e63b-40ba-a0ad-67088f44b51e", "comment": "Malware payload (Mirai)", "value": "f7e00a432a0c3a129dc5782a72f8392f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360864, "uuid": "c14b6172-6e0f-4890-a2f0-bdf902efce54", "comment": "Malware payload (Mirai)", "value": "fac0f5c3a994959fad9e8b1e590c2d31b34b01a88faa4173cd986e239f4c6fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360864, "uuid": "e1c9e303-7f0c-496b-8071-201adafbf6ff", "comment": "Malware payload (Mirai)", "value": "06ec9f93ac09910f7a2f0d9188e38c2349c6e1e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769360864, "uuid": "8f6d5939-4314-410f-8769-fadb4597024b", "comment": "Malware payload (Mirai)", "value": "b13ee33a4046e7c12e62308a6069834332052d6eab4805c58e6523a225929739b3f004f78804247d091044ade9d06a22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360864, "uuid": "bc6f4be6-88a6-4cf7-a4d6-5f4a88eb8046", "value": "T17FD35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360864, "uuid": "cfe01302-d237-4614-80d6-e58e4a77d76a", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQY:yIRfe3xvvSrlvZZ7UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769360864, "uuid": "8ecfb5ff-1950-4eea-b929-579b197c0cda", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769360864, "uuid": "6dd114b8-d13c-4f69-adf2-2f55a48b1c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769360864, "uuid": "d789f065-968e-4121-abc7-c7ef4e1dc33a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bcd0ea-f9d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769334831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334831, "uuid": "6e431cab-350e-43fa-a57b-5faae5a5ec45", "comment": "Malware payload (Mirai)", "value": "7b772f807923028fd55d05ff9087804e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334831, "uuid": "543f258e-272d-41d2-8f31-7563041f1f0f", "comment": "Malware payload (Mirai)", "value": "fac72dd20ada5da0593e2c693bac110a235c71aa1077f8dc612446f4bf6d0cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334831, "uuid": "a3b4ea21-9082-432a-9724-6abb432d1459", "comment": "Malware payload (Mirai)", "value": "c7ee97635ac586213f968ef6f995c78cb3cfbdce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769334831, "uuid": "8a8d9a1c-41f8-4819-99e7-c679b8e5206a", "comment": "Malware payload (Mirai)", "value": "9c2119dc2016d2c7147fcf7b480e37c64be22f9c5dbec164ebbe7736078f7d83d326ae44ddebeaeea5c0246610d76a26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334831, "uuid": "e49a18cb-7a1e-4ee3-96b0-3400f524bb19", "value": "T1EBF44B06BF805FEBC4AFCD30492EC35701E9E9C756D1662A71BC8B9CBA5D25A0BD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334831, "uuid": "5f812dbe-eff5-4149-92d0-23d13a0a06d0", "value": "12288:eGlLY/yLMaLB1k5Rlqvbm/8DjRqH52ApzQ555jLleI56zkZGjclY46HhFA6XtF/E:IXrbfaU0NE1pzI5nbvKqHEko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769334831, "uuid": "10fa18d8-7844-4941-a67c-6ea04fb3bb4a", "value": 749576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769334831, "uuid": "5d47b49c-fc44-4062-8a10-a8a5ecec7ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769334831, "uuid": "de4e83e2-f472-48f3-8ec4-866e7df84064", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2db7c7a-f9fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769353303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353303, "uuid": "01a34344-5ec6-40a1-9d3a-93b3c112795b", "comment": "Malware payload", "value": "ee2fff67f70d65276408b0029531da6a", "object_relation": "md5", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353303, "uuid": "29d0e1b0-e1a5-4792-a300-0b07ec3e9bb7", "comment": "Malware payload", "value": "facd4e46a394b1354e23ef9c98982a070fe4a780cd15fc34fbbf5855874334a4", "object_relation": "sha256", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353303, "uuid": "b700d1f7-f9f3-43d8-b23c-be5ce3d6dcad", "comment": "Malware payload", "value": "fcc25266e8bff91a1f92714a369dfd8b3e540146", "object_relation": "sha1", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769353303, "uuid": "98f0aa93-4059-46f9-8396-9658eef68646", "comment": "Malware payload", "value": "561d1c7682084bce542935c81bcc9595176420dfdb0c845ce0c76482d66e60b43aae217b16661cc8e1ea26dd75f33683", "object_relation": "sha3-384", "Tag": [ { "name": "animate-pancake-cc", "colour": "#494C3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353303, "uuid": "fd003dec-95c3-49c3-8f11-865ff1881de4", "value": "T1D4A633E9CAEED374E93AE576F378B34322630E1149AF4D555B78039F04DE7A8010686B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353303, "uuid": "2cbf4c6d-a439-4995-a752-924845592b1d", "value": "196608:FXrYJTj2czr39HtistLu7kmZmkJ76hkN6fdf+hD9xYEgcnB0BsI2f+8Qaw:4TjfNwsFat6h26fE59rnWBn2hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769353303, "uuid": "f112b356-bc0d-42a1-874f-9361a4eac9d7", "value": 9627121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769353303, "uuid": "d8b0dc61-6b8c-4b2e-a760-9328b98725a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769353303, "uuid": "3940144b-abfc-4a0e-8b5c-4b35c54cddee", "value": "services.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d035a868-f98c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769304363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304363, "uuid": "93e65731-2ea8-4c72-ae8f-6ba7836f00cf", "comment": "Malware payload (Mirai)", "value": "2609b452f417608964b69ed1b0ca386f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304363, "uuid": "92047f80-267a-4bb2-b9ce-7db07b16f102", "comment": "Malware payload (Mirai)", "value": "fb9192c081c86d098cde51ab9a29ce0e859ffc093c491281cbc223172b69c8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304363, "uuid": "b5267318-02f5-4198-8944-751e6de32699", "comment": "Malware payload (Mirai)", "value": "edcd26527fea8332c425180813f89fe344236add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769304363, "uuid": "089452aa-73f0-4c0c-b8d8-ee704ea4a454", "comment": "Malware payload (Mirai)", "value": "723cdf8bddc26abc8b4bdce9eea85912b3bbb802da5d1f7e640901cdaffb9533d468ec115d463c80fb05fa0cd0511b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304363, "uuid": "4c836c63-f30b-48bd-add1-809f436bb59a", "value": "T1D8D2D09A80E7E1B8D0BA65F5003D56C5FC767226C22A27B708ED6066DF171D81E31EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304363, "uuid": "4fac6fc7-673f-4984-bf8c-dc1958c99cb1", "value": "768:bYSoXdJZETc51aBfdNRQkHy3xWEMcw6qB7p6WSx0st:bYJdJZiy1aBnQfTqB7p6ptt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769304363, "uuid": "c13cfb36-1c99-436c-8934-ee50ff10b34f", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769304363, "uuid": "2e35282b-a465-4dd2-ba09-ad6b13f20ef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769304363, "uuid": "3e24ecf8-bdb6-4f36-8d17-f8fa190d9bb9", "value": "cosmic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b31b91-f9cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769331583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331583, "uuid": "f6df719d-61b0-4968-836e-3b540ab3cc09", "comment": "Malware payload", "value": "426485b1eaddd6a2c47f106ccfeacdf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331583, "uuid": "561c9dde-42bf-453a-9a7e-39d119d8416e", "comment": "Malware payload", "value": "fc4e73426643c89b7047cb0a427e068960a9f432da8dd231282e30dd29fdc9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331583, "uuid": "9458dd52-df1d-43d1-826c-d875d8aad4e0", "comment": "Malware payload", "value": "fca74549040545767eccc9b34b88cf6faa6e5fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769331583, "uuid": "bf8cd788-ce93-41d7-af6f-31e7f341b0cc", "comment": "Malware payload", "value": "9261325f1e23be849f3b960d9d8f48082df92646abc733ac4d706ac611632f5b709d879e1c419030fb1f6640f605cc50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331583, "uuid": "b553b1a4-ab8e-404a-876d-f0c44e0b582d", "value": "T16A18330006D00407D424C630AFEE95DAE32150A6E96E7AED954163E7E7EBFC5AD8B4CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331583, "uuid": "cbc57d25-8a60-4734-a831-df5d6ce3bb43", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331583, "uuid": "685b1deb-022f-4673-bf73-7a9098728ae3", "value": "1572864:LXf5w+S6vped1Oaq/Mxt3dxyvB5kGnTa2T+Kw6Vo/E+S8SSLpvmv5/7Ow:LXfyWxevOG/NxyvEGn2pEd+0SLZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769331583, "uuid": "e8dc0491-fc01-473f-bc61-010eec017fa9", "value": 85555130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769331583, "uuid": "4857abe8-ab5b-4a16-b068-8663f68a7011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769331583, "uuid": "415aeaa1-a91a-421f-a0a1-968f3daf965f", "value": "vvvv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173f3a5-fa14-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769362588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362588, "uuid": "2c0fb42a-48d0-44ff-a8c7-6ef8bea3ccb0", "comment": "Malware payload", "value": "aba178432573bda2177a2ab1a83a520b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362588, "uuid": "03cd071e-b84b-4706-a28c-f649b7dd7a15", "comment": "Malware payload", "value": "fd36a1b63204c1cd42a0d5db3bdbbe4490ff141d02cf0863a59bd237798d3b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362588, "uuid": "27e8e667-3250-42c1-99f4-3643645708cd", "comment": "Malware payload", "value": "f4aeb796cb0c8587ef602499042615d0b971f198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769362588, "uuid": "8aee704a-3086-48b4-90ad-4a39d213a122", "comment": "Malware payload", "value": "bf5a682bf259c7db3904e6879eb41cf83dbde3a1c06ed61d538240d4655623735b212ea435d750012a73136ba5489e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362588, "uuid": "3562e508-0568-45a3-b583-dd70e5492e74", "value": "T1F664232DD9A4987D623C676FDBEE09FC71C15ADB40775BFB0B5E00CC48368D49A00996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362588, "uuid": "8e0387f3-c43f-46bb-becd-94c0c4fddb47", "value": "6144:hjC7BFtUmQNgHEXKhgznwMEJmDjHGKCaTGbrGkrWPmD3QRlpX:c7BFA7X1zwME0DjHGKCwG3Gkrf3GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769362588, "uuid": "0bafa56d-b823-4a70-b19c-2738350da844", "value": 331953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769362588, "uuid": "1b1740be-fe23-440d-a0c4-0acb30e177f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769362588, "uuid": "9ed2cee0-82b1-4a2a-b9ac-1439de74d832", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d34bda-f9ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769330833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330833, "uuid": "4fc68b18-0a7d-467e-8635-5ac18df7f28a", "comment": "Malware payload", "value": "160316567406a4485334a0f52c4ee3d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330833, "uuid": "e990990a-5eab-4ce4-989c-13631773cdf3", "comment": "Malware payload", "value": "fd3dc87d8465443c0a1e7f818950dffe405bf6cbbf82968e06f1944adb75d850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330833, "uuid": "37734b07-dd3b-41c5-b3d3-7428e98eb1f1", "comment": "Malware payload", "value": "9f41a224beebaab3f5632da8e088cda306169b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769330833, "uuid": "9fd9be5c-3668-48f6-9df2-c6b7ab3ba1f3", "comment": "Malware payload", "value": "429a0fd79ff8843420ed11385db2765600408bada4ecac3c47710b9a88042e4d2b1f79cd5bffbfff664e2d2cecf6a61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330833, "uuid": "462be7fa-6dec-498b-9562-2965bc49a27a", "value": "T1DE1833887EB00979E4FBA7F2C40ED951E6A17C674A51C16B17D802256FA31F2BB31723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330833, "uuid": "b93f6c43-143e-43a0-8b79-0eb30c2ce9cf", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330833, "uuid": "7e1f78f3-bb46-45ab-9d43-fdff8a2dcb33", "value": "1572864:svRAbeTLgkg1GoojGJosd7o1a+KN7x1mQmk4Aq4S9AbGbZIGP1dfRp/XAFq:WRAbILNgLosVo1oNXX4ecAil51Bn/Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769330833, "uuid": "41b667c5-3034-46a0-ae70-335eb0119a63", "value": 92748078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769330833, "uuid": "8bfced29-25e8-40bc-b25e-ed9642a4ba2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769330833, "uuid": "f323dea5-f4b8-453a-a6d7-0d6fd3926ebe", "value": "Hlong1LMpoinfa2Uiu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a5c61d-f988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769302484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302484, "uuid": "489bb87b-8a4f-4406-bdd8-80823a33e5e7", "comment": "Malware payload", "value": "ca171d830c223ad944afcda4981407b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302484, "uuid": "16818ba7-24be-42bf-b34a-69568edf4abe", "comment": "Malware payload", "value": "febae7eb78dd08b8ed22f7ee8f8c72c54be12e4e61f95972eb310f0c8bf0051f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302484, "uuid": "e5ed7fee-8ed1-486b-b51d-4b5e25160e9d", "comment": "Malware payload", "value": "09074bbbbdf9697512f67fb04cf58e2e4a2ff1ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769302484, "uuid": "4a8a5e96-5f6b-4ef2-be46-8ba273054bce", "comment": "Malware payload", "value": "5d856686a9ce595fb590e46316b5739996842d5ab55327c3a0fc1cc2c43320c13e538a83e9409dd037aefeda43329e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302484, "uuid": "60da6874-0543-48e6-b6f2-0e84c1ad83cc", "value": "T14503E0535782B6FCDC39D53699E70281C31F38055B2F9BBE08A8257A2C76381AF23B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302484, "uuid": "72d1d8f9-4f62-4b55-b257-b306a4544f45", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302484, "uuid": "b6e9c41e-cc44-4075-915a-d51bb8e66867", "value": "768:MnyJHubAUnDU+QA7EhPdkvSe5vSQE3gncL7KgXLbKwwVmusqhzLYrqgH:MoObBZQA7Ehlkvh0bgcLGobKwwSAOPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769302484, "uuid": "7d277ee5-eed8-43a2-a07f-c2f862edac97", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769302484, "uuid": "1e23c320-63ae-4b78-be98-21a549c74df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769302484, "uuid": "04d55b67-3776-45b4-ae02-aa135fd94696", "value": "SecuriteInfo.com.FileRepMalware.54526356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }