{ "Event": { "published": true, "date": "2025-11-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-01", "timestamp": 1762041782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "691da0c6-a17e-4adf-aa7a-6a27aa163f00", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c818e8c4-b6c8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761963391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963391, "uuid": "7945afdf-936e-4d22-ae39-0cc566b18e92", "comment": "Malware payload (Rhadamanthys)", "value": "2c363054d9fd9c516b056f68d3c79bac", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963391, "uuid": "b6cde510-195c-4a2a-94af-86800247e3da", "comment": "Malware payload (Rhadamanthys)", "value": "057ab7dcbd03786d234543ced23a4fe58f2d0d29d2aa28ad8f73b78270d5c5e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963391, "uuid": "f7c7eb8e-2568-4f00-b2dc-9873db786057", "comment": "Malware payload (Rhadamanthys)", "value": "04843a481250f50dab65dcadf55b3e5f5216f878", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963391, "uuid": "89d93d1b-487a-44cc-8757-dd28638af557", "comment": "Malware payload (Rhadamanthys)", "value": "821cdda22fa6d9b04a47e7bea2a205de70ee928143167fc66f0a7fd51217e712c956606933ce479798a1a46f20748168", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963391, "uuid": "dd526d04-4e1e-4dfd-9e95-791670b844fb", "value": "T1C186332CEC620FF6C70595B388A2722441CACEC4622614FF3555B5294AF9FB35EDB728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963391, "uuid": "8377c46a-4ae1-466c-be94-e5df5b2885bf", "value": "196608:jiubkYQGixjtnjDGtyN/bHP10fAvQI/SgkDSlEI1Wgm2a6CK:3XrwjtnjBN/rGodwm1WgSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761963391, "uuid": "30cf0cd7-c916-49aa-b4f4-6122d5a4e350", "value": 8261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761963391, "uuid": "cccab0a2-b1d5-47e9-8fd2-59a7d22d1282", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963391, "uuid": "abf05aa1-87d2-4124-9df9-5458aab81767", "value": "SecuriteInfo.com.Trojan.SuspectCRC.9076.14023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f4ef73-b6ea-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761977725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977725, "uuid": "0956847b-4893-473a-b41b-99b54aba209c", "comment": "Malware payload (Mirai)", "value": "bea29a6522f35dd4ac16dfeeaf4f8c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977725, "uuid": "f0206e10-f334-4299-8576-dace1cac50a6", "comment": "Malware payload (Mirai)", "value": "06c159b6ecc61501ba54ef8951a3b5b204527e51373812caed9d32664bcc9d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977725, "uuid": "a00e79c0-e981-44ed-b987-5bc26f446729", "comment": "Malware payload (Mirai)", "value": "4ac6123c3896aaf1391f0da27684056d4c92b451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977725, "uuid": "1f27e59b-d180-4678-bb9e-31f18979bcde", "comment": "Malware payload (Mirai)", "value": "ced5d1a55c828793cdbd385cdfecb7bde47e2f290eed73a9408edb28d8dee844b3cd0af4eecb78165f8b34b02b295904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977725, "uuid": "f1c6ad28-2339-48e8-9e66-1eeae44e848e", "value": "T14743F17861013ADACCF6C47C79A207914FD212217805ED6AEA17F6679C011B839BBDFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977725, "uuid": "d42d8dd7-94a8-4b46-8724-91e3548e3402", "value": "1536:KFQuLJYfZHcFWUtcE13FCdPC8Q+n2VJu1:sVicFttceiPTQ9VQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761977725, "uuid": "04a49ee1-ff91-4e34-b150-fc8e57b92349", "value": 57300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761977725, "uuid": "cdca8b15-7ead-4d01-8cb0-801109f1a548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977725, "uuid": "d21d8c38-d9a0-456e-9366-e13fc80b0565", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52b4e7e-b77a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762039837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039837, "uuid": "ea67787f-c68c-4b83-a936-8bd017adc26d", "comment": "Malware payload", "value": "3b16d7c21611a63b12aebdde371d9ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039837, "uuid": "223bb475-82af-4ce9-98e8-00865d68b92c", "comment": "Malware payload", "value": "0a43d8e665f0a59f298ef0f8dcca153b9f4a16ada8cda793e911d28bc783ecd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039837, "uuid": "9c977c3c-8357-4f06-9897-2db899d16451", "comment": "Malware payload", "value": "16b72a2477205612b625140ac6f7d839a46f3c82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039837, "uuid": "8c8ffee5-8096-4af4-9d73-1170ccf1a90b", "comment": "Malware payload", "value": "6e0d61f6a7f96ae704c59d9fa2266c9f8662effc9449a40eba3b521b82fb0ef81a74620d26f0c825551da94868f64e27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039837, "uuid": "3a1d2119-844b-4d55-86ae-c9c7620da2cd", "value": "T10924638ABFA03FFFD81ECD330295DA09129C490A5298AF772A34D518B65B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039837, "uuid": "0df73a01-f287-4100-be74-0db8df03c8cd", "value": "1536:r8pdG0WYmf5ZaffScABXGERwyVBIobtIbDrDM6Hxvsdx3BArnbEElvnzPtrn:rapWFRgERwOBIWb6ZsjBAr9nzZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762039837, "uuid": "57eaead6-4d52-4734-b981-3ffbc7f3f5d7", "value": 219316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762039837, "uuid": "00bf419d-c87e-4bd8-99f6-030864a45aaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039837, "uuid": "d8a990ac-aad3-4c9f-9dc0-4c4d5b82ebd7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99abd7d2-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989083, "uuid": "15e705bf-612b-47d8-a53c-b90e2effa221", "comment": "Malware payload (Mirai)", "value": "aae382e03706b40483d5a6aed331ae56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989083, "uuid": "1d139f94-4905-4c06-b210-9cf89f751660", "comment": "Malware payload (Mirai)", "value": "0a9dc369371ed7cf77f6095e2b189758579114a7f095ead0ae0774157e0cc3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989083, "uuid": "71f73b62-a8cb-4db5-a4d2-fc41a7f2f1fe", "comment": "Malware payload (Mirai)", "value": "0b39af85a854ea9b3fc81383cbbcc8f7c82c72f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989083, "uuid": "c35f05d6-ad56-402c-9a5f-ac21e080da5a", "comment": "Malware payload (Mirai)", "value": "4f6726e0b1afb6b7d03d2e2bdd46f008bb800218d4808a48e3116f19706a12cb3c02c2406b246589c7003ef855c0eb97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989083, "uuid": "022a0a26-6d11-4b98-9dc2-cea71373c656", "value": "T159438D75E42A9D54C08502B0B8A48F750F63F5C8C3625DF76BA943B1904BEA8FA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989083, "uuid": "52541b21-d30d-4b4b-98c2-3d7533730680", "value": "768:4SFgLrK7Gp3KLgd7V/brU2gBHDlm0JDfx7c4CAoRhY79CCW2wJZY10Ux:dam7It2BHDF97c4UjcCCWvJa10g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989083, "uuid": "818e289e-66ee-4e5b-8282-1bdd4d11e985", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989083, "uuid": "2944b747-83a7-487e-8ff7-355c2ca86d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989083, "uuid": "c6c24ec1-5d88-4ae5-a279-3d9eddceb4bd", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078c2457-b744-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762016326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016326, "uuid": "ef94bf5f-2c8c-4f42-b95c-cef38454178c", "comment": "Malware payload (Mirai)", "value": "f5a8e1a8131169ced641c4d881ab353f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016326, "uuid": "686ef7b0-7654-4034-9b3c-6dfb281878af", "comment": "Malware payload (Mirai)", "value": "0e9ea4bff63ec8674c9ddac1667c83a0480fc67198411a75c9a1c0f88d80c044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016326, "uuid": "25d7a56d-2c33-4847-a4b1-541251f788fa", "comment": "Malware payload (Mirai)", "value": "3392b8294951e74d8ba4822511827a7c55e4dea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016326, "uuid": "4fc37c7b-4bdf-4dd9-a3e9-777faca8b02c", "comment": "Malware payload (Mirai)", "value": "55c85d2e5f5ea1f13b5b0848482119d917e37e4484a714e3fd1e0a623d196696e451aa98d3fafffa6086ef1bfb37cb1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016326, "uuid": "b0d858ef-edbe-4782-b1cc-ff9eb0af7da4", "value": "T19B533C42B31C0957D5B69DB0253F23E0D3BBE95020F4B688255E9B8A9371E3255C6FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016326, "uuid": "eff98c90-ea15-4289-9775-defb4831b2aa", "value": "768:5zct1AHrk2di4xBqmW4M9mrIkKVRkQi5FNitSqWHqZXKIO/:xct1X4dimWXmkkKV+QYigtHqZXKH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762016326, "uuid": "ed557df0-2e00-404f-a69a-afd5138082bf", "value": 63584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762016326, "uuid": "7dae0030-300b-4cd8-a90c-187adeef6a3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016326, "uuid": "41a2617e-9892-422f-8429-b60e9d529d31", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5beb76f7-b703-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761988550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988550, "uuid": "7b2b80b6-acb5-4266-9044-66aed0851e59", "comment": "Malware payload (Mirai)", "value": "8ae27a966ecb02f5f3d1cb108e563862", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988550, "uuid": "b9bec16b-e69d-42c6-b894-6c88517dcd94", "comment": "Malware payload (Mirai)", "value": "0f32c96813478ff74c9bf51ac376b156dfe9e722c2354ed5af183d75dc8c1381", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988550, "uuid": "94365b31-64f8-41e0-aff5-122e652c66dc", "comment": "Malware payload (Mirai)", "value": "f680c27c8966867f522a934aade36f707f534009", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988550, "uuid": "7b0d2505-41a1-45b6-8b15-5d43a58cddff", "comment": "Malware payload (Mirai)", "value": "b011382e6e78572a0c51a0c971c70f700f19efa53a6e5275f75af86ef2581a5ab5882a5d69869782ed5c7afefc17a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988550, "uuid": "3113c33d-06ee-4aeb-9737-83477d42acea", "value": "T1CC51FA8645069E701EA76E17EA7B411830D2E0D329E1EF99EDE7B5E0077EC583380B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988550, "uuid": "19a2f761-5da9-4555-b837-eb16f308914a", "value": "48:vsm79m7N7hsmmm6GsmgumzPsm2mKWsmQmoUsm7Qm7o7UsmfTm3bsmtm9Rsm0mcgz:vV707N7hVH6GVgvzPV3KWVxoUV7x7o7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988550, "uuid": "6da9cbd3-1d57-493a-95cd-5e27b6859819", "value": 3000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988550, "uuid": "23f67eda-2824-49bd-abf5-41f10cff702d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988550, "uuid": "826d06b2-098e-436c-ba0d-fb20a0350d24", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2971404f-b71e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000062, "uuid": "0bfebf68-5cb8-46bc-ab3d-48b5624965db", "comment": "Malware payload (Mirai)", "value": "21f93118f8354f9b63b7dc72290f9237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000062, "uuid": "4ad8e698-1977-4c88-9605-5d5624d62745", "comment": "Malware payload (Mirai)", "value": "1095a9c32e870543bd5968db9a96058d475f5afba67994a895f9a5d5c78a9d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000062, "uuid": "08b2a416-d697-48df-bb27-8a853b3e356d", "comment": "Malware payload (Mirai)", "value": "c3a08f9fd770fdd6d503445cde4d1b8a15ff3843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000062, "uuid": "d70d85b3-8d45-49a0-b336-85da0a62dd59", "comment": "Malware payload (Mirai)", "value": "760f655d58d8a4a40f4f8d599ddd1c4a0a6cb9a77911b0250e449a84c41e9cae000b66e496608fa31b811e8a83dd42f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000062, "uuid": "aee37eb2-b425-414f-914a-281de0198e74", "value": "T17CD2D08521737A15CB2DBB7D25491C9D2364F81AC23D0E65BA60BFDE0CF088C9528FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000062, "uuid": "1dabb3aa-dc2b-47d1-ab2b-26f518c11885", "value": "768:LPCevwb/4UcppbR8eaG5fLwnhB0z+r5csEWylA:mL/4lTR8eTiwcfyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000062, "uuid": "eb8bcd6f-11fb-465b-90f1-0d88be174134", "value": 29896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000062, "uuid": "ec991cb8-d546-40ed-be52-6ea617fdedb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000062, "uuid": "a42f5494-8bf8-4e8b-ae59-462faeea8641", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba10b4af-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969380, "uuid": "51931c02-796b-45ba-ba64-25e1f71a45aa", "comment": "Malware payload (Mirai)", "value": "fa1253def33a06e0f6d5050704aa1334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969380, "uuid": "5f4facd0-df70-4716-a39c-1fb7874215b7", "comment": "Malware payload (Mirai)", "value": "119df3d994ea01cccc3751df3a7e674eee90cb2d1dce492f1e027542e9a544eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969380, "uuid": "9aceda84-2d0d-40e6-a841-0e940092f075", "comment": "Malware payload (Mirai)", "value": "3ea5e58cadcd03e6ca95118571d191db1cb2ebc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969380, "uuid": "e3b096e6-48d8-4e07-b825-9154f4c43298", "comment": "Malware payload (Mirai)", "value": "4cd24da0d01d1e9e5bb695252a2ebbc2f170369d7cbfbcdb1f85345a754090af523264592ad51ce4a7afc3dff52fb081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969380, "uuid": "4aaf7713-9608-4adc-b5c8-dbe2674d9bbe", "value": "T177A2D0A2D29396B1D2508936EB7C88926ED0CBBDF3FB30B3103141D611C5A9646FA1D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969380, "uuid": "c202af5b-49ea-4b14-b842-529ad13da22e", "value": "384:zOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvjhymdGUop5hX2:zOizQq28CrGxKCP/ky68Ls3UozJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969380, "uuid": "f5cf3ffd-85bf-4bbd-a07b-84771cf7df9c", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969380, "uuid": "76545b98-783a-47a4-90b6-c823fb459981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969380, "uuid": "0cbcf0c2-8c13-4cb1-83d5-dd58bc2caa03", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c65fe-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990173, "uuid": "e699b65f-0207-4962-a1f1-810726ca684d", "comment": "Malware payload (Mirai)", "value": "9f7a79f5805217f794f90a5c70ab8b28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990173, "uuid": "2b0a1f73-2091-4d13-9041-eaad588aa061", "comment": "Malware payload (Mirai)", "value": "11bbb6d9db1492bdc765604e5f541117ecc58a48aa6d84d49b6274fe052882a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990173, "uuid": "6d16d981-44b7-489b-8a04-df9809265183", "comment": "Malware payload (Mirai)", "value": "cfa76f709c4f157ad29b75c2cf2505c89288ee6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990173, "uuid": "a386f26e-fc55-46a2-a9a2-2d4f794011a9", "comment": "Malware payload (Mirai)", "value": "ebf56f15bcb09dc9881dde4b4aed1216cf158a22e2753d793ef64d26c33a5589cef0b9d46a5e88febc8de652b4dcb4c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990173, "uuid": "0a406f77-fe48-421b-a1fc-e6ecd330a6e6", "value": "T1E4631955F8819B23C6C1127BFB5D428E3B2613E8E3DA72039E25AF21378791B0D6BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990173, "uuid": "dad48115-6e8a-48cb-8458-89b399aa4c92", "value": "768:u+VZJfWAdprC6McKKHHfCQohYlIkQYv2ZZN6MQpIsqdbvMX4V72QQBlJ3Nq7Tv3W:zrJpdjTHfCiSkQI8fQpBUvMIV+BMHv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990173, "uuid": "8a44b176-22a5-4755-9bf9-f963ea31b18f", "value": 72640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990173, "uuid": "8c0e615d-6950-4031-98e0-0eb4ed891ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990173, "uuid": "9acb2ef5-12e1-40bf-973f-5634773afea2", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9793d4-b6eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978164, "uuid": "f7dc53e1-73db-4279-8f4a-e59ddd495b8c", "comment": "Malware payload (Mirai)", "value": "49eaa9885d3b4e822d7bf9a1a06aa355", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978164, "uuid": "c0d5fe79-9784-4a64-bde7-f576a612a209", "comment": "Malware payload (Mirai)", "value": "14302cc445fd738f085a57597dbfe06bd6ee8114145c10b3dee47886ced3a443", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978164, "uuid": "8e28d454-a76e-410c-a1e1-b89bb0ab5d94", "comment": "Malware payload (Mirai)", "value": "478b903280bf634fc7b246d780d7bbcc59bf6793", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978164, "uuid": "068f9840-9b10-4fa2-9abe-1dbe2c3251b8", "comment": "Malware payload (Mirai)", "value": "b9d5b3f7edb7dc8463a01052eaeb0eb6e91b8412c67fccdaa4f61250d743a83bc9c44666981c02c082105115573a48aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978164, "uuid": "ba4dbd3d-6230-4995-aea3-40f327bc2601", "value": "T18901CBD9D681D7A08856246DB1C3C109F46B83E81BE10E18BC0C6A747A4C5CCF832A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978164, "uuid": "8d99c1bc-eaab-4ed2-a5ee-7cae7e999d95", "value": "12:7u6oRYB8XOp3dKU2hCUKAMk8QdqxoXkp/A5VE+/I/PN7RnC9:ToWBGhBh9Mk8QoWkp/A5VE+/I/V7R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978164, "uuid": "d2c49d88-9abd-4a69-9edd-b02721d41b75", "value": 687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978164, "uuid": "b2cd2c3c-86f8-4234-b676-1f0a5aa5347d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978164, "uuid": "00c503cb-8f9e-4ae2-ad7c-ee9609c95e6c", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42d76b4-b771-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762035943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035943, "uuid": "9550999e-fd5e-483a-b7c3-c75ebc6fb8b6", "comment": "Malware payload (Adware.Techsnab)", "value": "e246a217dae38c4026cac1e5670ded36", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035943, "uuid": "8d31eb80-20c1-45e5-ae76-bc14a1fd68ec", "comment": "Malware payload (Adware.Techsnab)", "value": "14a6692aee5a2b4336d0688f785c4757e27c98b01aa235a3677d16de366ec92c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035943, "uuid": "902b227b-af85-4f8e-84bf-ee8d7e1b5b22", "comment": "Malware payload (Adware.Techsnab)", "value": "9a9567e35648441069f5792f0e97a487e77e6ca4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035943, "uuid": "f49aa39f-c425-4b59-9a64-42b2b12f4f44", "comment": "Malware payload (Adware.Techsnab)", "value": "eaa2a0a874b0b99493f9e4b643044a7f2a41e4320e38d1b454eeb01021622f3105ef7e7848d576950e4bd57c152d0d31", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035943, "uuid": "8a7e3385-95ae-45b4-b723-9a0c193f4f98", "value": "T148356B12A3F84A61F1BB6638957297169B317C44AB31CBCF02A0D06D2DB3BD09E35767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035943, "uuid": "29382323-07ca-4daf-a56f-b0456df33673", "value": "12288:MvUZAyeKAoScRH+s3zWx0jGfTuoZ2rciMxJM3TwO8dm1GuTicT+uqWMf3lk2C:M8ZAy3AoV4x0jGfTlici2tiGuTDMbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762035943, "uuid": "a456d62b-f327-4837-8adf-7d5c3aba8234", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762035943, "uuid": "f274fe8a-36bd-41a7-b37c-36eb7ff336e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035943, "uuid": "65ec319e-1794-4208-8859-45ab246ee6be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f713cc30-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761986663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986663, "uuid": "279c741a-69ab-4c0a-bc8c-eebe5c3677d7", "comment": "Malware payload (Mirai)", "value": "9a417030e53978beef4a09723861fae9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986663, "uuid": "0ee57c5d-9e80-480e-9e89-c6562889cee6", "comment": "Malware payload (Mirai)", "value": "156269ce6bcae047125b6babcd6b20374e8f3186e3ed2e392a0670d2cbc3f874", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986663, "uuid": "be0c4b36-d97e-4d97-8164-e14c0cea9bf0", "comment": "Malware payload (Mirai)", "value": "152b7dfa26e6361d5088cf752587825153748850", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986663, "uuid": "c856493d-68f5-4d4d-afe3-897a3ff960b8", "comment": "Malware payload (Mirai)", "value": "e37e85e2d158f773d81fec1f28339b236f2f48b36240215eae2918a90be6af90e486d92c9f441411b84241a78bd67219", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986663, "uuid": "12d73f3a-6f9d-410c-8310-4cd978901c65", "value": "T1C311BA9DEA8197A68446152D71C7C20DF063C3ED12E10A08FC4C2A353ACC989F835B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986663, "uuid": "ad8a909c-54f8-44db-a8a8-2ab3497f1c01", "value": "24:ToWBGhBh9Mk8QoWkp2VE+/I/V7NvXXplHp:ToGGhL8QoWJVE+wV7Nvnptp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986663, "uuid": "7b7f1723-6d51-47d6-b685-c62035926dc0", "value": 908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986663, "uuid": "1796cef4-2fea-4d7f-b9f1-b3d3d308b0a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986663, "uuid": "febb4995-7a69-4c77-aeca-75390b5647e5", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b8311c-b711-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761994692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994692, "uuid": "bbedd454-bb93-47af-ba49-b5269911a7ea", "comment": "Malware payload", "value": "cf7d899372ed8f8fc1f5c2a5b5d81ea1", "object_relation": "md5", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994692, "uuid": "501a4fc6-3868-4cd6-b964-d02fb9848073", "comment": "Malware payload", "value": "158abe39ff73e2ec950f4bc783020eb1f41be0dc89c0a6b8032a3438edde9dfd", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994692, "uuid": "ecbde502-6634-43c4-98b1-b403409a8f7d", "comment": "Malware payload", "value": "d1012f9e7a06300a9ba9e12c7bd7ed5f5f29d599", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994692, "uuid": "c73c37af-f00c-49df-b5bd-675bed24dc4d", "comment": "Malware payload", "value": "67dd692d809c1863d3e7dbd1845cdf593e8dbe0f74d986db6aeac1cd82a4bfee5c975b77a5704b846ac64df2aa50b71b", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994692, "uuid": "54fbf574-8b4d-446c-8ac9-934475109ecc", "value": "T12C763363D2BC690FD923BE785098E9D707A8A700B4D9253E79CC12956ECB4C17F1B82D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994692, "uuid": "4094e6f8-b5f9-4f99-884b-1e890144ed6b", "value": "98304:ZG3psuTztIBY6ZxsHAbQx91ryPDmmUh8xF//yeit9CMS3ykffm8KIKhFkvmdPugK:Z2psozt0mOQ/1mdkiMS3q8G0OdPTzLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994692, "uuid": "ea5fb48e-d06a-4e27-bfa9-466efd0669c8", "value": 7187329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994692, "uuid": "78f88da3-78e9-4eda-9565-7a53b7d008bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994692, "uuid": "52912d00-3dcf-48ce-8168-44a23393bdd3", "value": "ZalypaGyliveraV1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1792ca5-b701-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987834, "uuid": "b0273339-4dfc-462a-aa77-5d204acfb896", "comment": "Malware payload (Mirai)", "value": "c66a4d0074413221cffcc1bf43b5d184", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987834, "uuid": "79de8552-d029-4aab-a961-1d69847e8f93", "comment": "Malware payload (Mirai)", "value": "164654591db02337aad3ccc6d44f4aba92d3402ffb2d13241a365690c5b9d7ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987834, "uuid": "c1e93c36-dfb0-4d1b-a73d-a35614bd7afb", "comment": "Malware payload (Mirai)", "value": "d10b18a2fbdead8ea1e4b75fad0e2b25b35c1ace", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987834, "uuid": "76f68e0f-6369-4860-8a2a-5dd21774aaea", "comment": "Malware payload (Mirai)", "value": "4cf3d5f0791b288af83b6f2203ae7c4d23fef152de05ec67a33dd8e3924e83a2c3882bdac806b8cb41d4b9468551b3d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987834, "uuid": "818b8ac3-ea90-453f-aeeb-8552d28f1b28", "value": "T11501448914F3D773D9A4C740BA9148685D04E29193C11F66FECF957344C9E58B13970E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987834, "uuid": "da8aa4c2-84c6-49dc-be27-e65f4d831a6c", "value": "12:784H0d4HDTd4Hyd4HId4HX1d4HWTd4H7b3Td4H7k3Th:oSwSdSmS8SLSWxSvBS43F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987834, "uuid": "10765904-f71a-4d36-9698-1ac95b81f42b", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987834, "uuid": "a0d48cfc-55f0-44d1-aef7-c14d831e776f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987834, "uuid": "8ab0d681-cca6-40cd-8cd4-9bf1ff3b7151", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd84c773-b715-11f0-91c6-42010a9c0006", "comment": "Malware payload (ScreenConnect)", "timestamp": 1761996445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996445, "uuid": "56add31c-c207-4bc6-aaa7-156352564032", "comment": "Malware payload (ScreenConnect)", "value": "70636e3162809520738cd64eb4820e15", "object_relation": "md5", "Tag": [ { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996445, "uuid": "a2d025de-c2fc-4bbd-a7f1-40928b4dc1e0", "comment": "Malware payload (ScreenConnect)", "value": "16d219bf805b87558798ebff2246de247a010de7baa7fe3058daeaac1ffc3fa7", "object_relation": "sha256", "Tag": [ { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996445, "uuid": "b58a171e-cbfc-42a0-9d8c-77733eb1888c", "comment": "Malware payload (ScreenConnect)", "value": "c5930708bc3999e80e52d62d80ede66a4d0d07e8", "object_relation": "sha1", "Tag": [ { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996445, "uuid": "7ccbd0da-8f59-48d0-9b85-86582113f63b", "comment": "Malware payload (ScreenConnect)", "value": "500c5d12873bd89fc7a2ec049f6b33d8f3dfef5899236048dceefb3d9329ed9f52f19ad1b1d9cbb5b26159716a3d9230", "object_relation": "sha3-384", "Tag": [ { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996445, "uuid": "11f2bc34-41a9-4a76-95d3-b862d38563ea", "value": "T18C31118F84E485B02A0711F7A7DA5C188BE10C039948CA565843D6BD29BD2DEDFC6E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996445, "uuid": "ed45ae8e-2a91-4c99-8526-2891ff5a2462", "value": "48:4pY9dPRWbEZ9XZeRLl/oLtWLhLNpyLgKvbQL5dZhSQ4PobZuEk6WYp19:F9nZkrTwbSSQxl19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761996445, "uuid": "6df8e2cc-8e59-4bd8-a72b-c87fa8eb54c4", "value": 1747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761996445, "uuid": "02296163-a689-4370-a119-5839b25e64fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996445, "uuid": "f303997a-841b-486a-ad0c-aeec53c86b75", "value": "NFL-098807723577326YUI-PT12.Vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51e4ef7-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993048, "uuid": "4b26ba12-2b0e-40da-b695-57d45b5e0800", "comment": "Malware payload (Mirai)", "value": "4f214639e82779b623d14bad7856e646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993048, "uuid": "dec35321-22d6-466d-8a70-8986bcefa48e", "comment": "Malware payload (Mirai)", "value": "17549999fb97824090a1c69e7b6a5926ea4f6ae52b84000ce097ff042f286b98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993048, "uuid": "97ca8e74-f2df-4fcd-96f3-039c64fb533c", "comment": "Malware payload (Mirai)", "value": "8ff92d4a4084dce96795769cfc85565a31d3fc0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993048, "uuid": "68708fd3-cfd7-4e7f-abad-b1cbf1321e15", "comment": "Malware payload (Mirai)", "value": "b179ed5ea6b7e2ac843237c5c7542baabce24d6c684cd6cc6eb73747599a13af7e373863394a743c1434f27ac1d5bc6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993048, "uuid": "248cb275-cc05-450f-ae14-8771c3a62c2b", "value": "T150D2E1DC1E2A52CEDDE5A77B90A40CBC17B1D431873AC5626FC8D34986C2E9C32D81E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993048, "uuid": "9eee3c37-0300-4367-8ad6-f657d28af87e", "value": "768:zB9OPA1dr+XpBiWoB1QO91i7kfs5EVyDp+rly:oOPR91a0s9Dp+rly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993048, "uuid": "7097cad3-23ff-42a1-8dda-6a16a3f40611", "value": 29916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993048, "uuid": "43842aa4-17b8-4445-a7f9-b900d51101a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993048, "uuid": "a32d7e9e-2e8d-4c31-bdab-383a0d10e6ab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0cde5b-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987159, "uuid": "f9259e5b-b5a2-4e85-a421-812f43647d2f", "comment": "Malware payload (Mirai)", "value": "b60087caed6f16ceb5663f6910a5e60f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987159, "uuid": "fad70c6d-55a7-4e26-9e99-1580bac125e9", "comment": "Malware payload (Mirai)", "value": "18b891cccca61ec1b74907c52eeaa31faa3951af70e745049adb6ef78c6d5a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987159, "uuid": "951893d4-173f-410e-b105-2a2d7bc48e9e", "comment": "Malware payload (Mirai)", "value": "5c67b1fc7d217dae93de7a4317958194b7813349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987159, "uuid": "7854be82-33fe-47c1-9f30-dcee5e1d9662", "comment": "Malware payload (Mirai)", "value": "a03d453dcdec09ca1290bb9bf60b1027005a00a40d67b18cb5e3d8e97b4a740ef2f184934883aaa820756d29f833027f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987159, "uuid": "36aae20e-0e52-4c83-a07d-1d09bcd0ebd3", "value": "T1FB042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987159, "uuid": "d22031e6-1b7c-49d6-afe9-abce98d90fcd", "value": "3072:OLe6vhWZQIvuCeeuaMuTuRez43IVIL3ZQy38YhTfYo+M/RgDlplLn:ee6vhtIv1ruaMuTuReErL3738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987159, "uuid": "b64d96c5-ab67-4d9f-b744-453243b64d25", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987159, "uuid": "a5f69514-b62c-4059-89b3-47063dfeb93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987159, "uuid": "643684ff-e418-4e32-b2c1-7d98aff9d69c", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc0cf2e-b74b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762019507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019507, "uuid": "bcd243b0-a611-483f-9262-96bc783d8589", "comment": "Malware payload (Mirai)", "value": "ee7663ee430a0d61daaea9a54818bbc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019507, "uuid": "6ff12674-b7f7-4035-bb9f-beab39e6390d", "comment": "Malware payload (Mirai)", "value": "19f9d1c88599274ed1cf38e86d3a037056d4adda5d529b349f89f45e8525bee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019507, "uuid": "d322d849-dbea-431b-9361-0c5ae7e657b8", "comment": "Malware payload (Mirai)", "value": "1c301ccda73c44a0451f6ce7ed2fa42006f94a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019507, "uuid": "0b64b8dc-8e3c-4848-aa75-84fe262b3c2e", "comment": "Malware payload (Mirai)", "value": "35b3484117fb07a1762abd2ab8a138c9420cc233bb006da8dbfcaf21c1bb45bceca111c9886d0713a2855f067f64ca84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019507, "uuid": "29385043-c7c9-4b0d-82f6-ade9d27108e3", "value": "T1A6F2E1AED5354952DB6A2EF6444D0272622D0E8587D0BD3B7A30FAED392019061B1FFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019507, "uuid": "2d1930d1-2e6d-43bf-ab49-da54dffec8a3", "value": "768:UgbRqOHA3VNnVZzrejbjQ6uU7luvqeollh0Ve3X1iUavy94SlkSDPre/vEIFLO:DPA3VNnvzijg6uU541+rSeMJ69VkqK/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762019507, "uuid": "21828b52-8c7c-47d9-9987-ddd0e4b05786", "value": 34616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762019507, "uuid": "37660c50-0550-4002-aac9-f3d6f50947d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019507, "uuid": "2c741d4b-08c5-4b8e-80fb-3ed5793e41aa", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768118d1-b750-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762021666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021666, "uuid": "88a20451-1bfd-4447-8d8f-dc3c6579a0b9", "comment": "Malware payload (Mirai)", "value": "98b547abbb1dd23a31fab2490864f153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021666, "uuid": "125b7317-4448-4676-afe9-a17d9ad128c4", "comment": "Malware payload (Mirai)", "value": "1aaf787789decb7cf5c5db77a590bf32534b3961d7f447c418404ad0830608c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021666, "uuid": "d68a9853-5402-4f3d-a01a-dcc441d48229", "comment": "Malware payload (Mirai)", "value": "ea9245d42cb5ffcb902f968407da04779508a1d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021666, "uuid": "e5a341b9-80ab-489e-9685-fe655c7e6f36", "comment": "Malware payload (Mirai)", "value": "b3128376944f7ad419df0189bcff6d5c530fcec5be87b9929ac6cb402c1ee7d1dce46a8fa7b514525e9a60dfddc824a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021666, "uuid": "a5c82e6e-d11a-4a2e-8b41-a2c0ae81ffcf", "value": "T1CA63E746B891CA25C5D852BAFA1E11CD331317B8E3DF7213DE106F647B8A82B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021666, "uuid": "97bfc4d3-bad7-483c-a8fe-85ee5d9f9c26", "value": "1536:9tnkC0T6oWLUs80k8yqqulOU/mOmGP9w7A3fMCibTF8Vd8oYuybVR:v0mo2878yfaoO/UTF8Vd8oYuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762021666, "uuid": "6eb16238-5f02-4555-966d-c9163fde5daa", "value": 72260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762021666, "uuid": "30013ec8-0f75-4d40-b277-de65747ddac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021666, "uuid": "59b1fa7f-6fc0-41cf-a3b1-1366990183fa", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bc8855-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990172, "uuid": "f9de460d-4081-4561-b212-a16740ec7e4d", "comment": "Malware payload (Mirai)", "value": "44c030a688ff200d03c92dbb3905edb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990172, "uuid": "0de3fc77-ce76-4d85-a9b9-ccff5c228f98", "comment": "Malware payload (Mirai)", "value": "1b4daa53e96ee79e719a6b5765b2f29eabcb1f1e6b4241bc050c5a451fd91535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990172, "uuid": "ee5e1b3f-6f6d-461b-93e9-afe2e08759c1", "comment": "Malware payload (Mirai)", "value": "703dc0a756092de0a27c84e7443a6019b9fd4cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990172, "uuid": "32a4f5d5-1bae-4247-9c46-8c96f4069a06", "comment": "Malware payload (Mirai)", "value": "c8564d6ed2a4f9f38fbc4614f7b427adca3cf3638a40caebd689c791e46f05cee62b9bd8a0d747347d87124615b236bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990172, "uuid": "33e69d22-cf22-4de7-9371-9a09ce4eef09", "value": "T181031985F8828A6BC5D0133DF76D5A1E3720B3D4E2CB7707DE694B5136CA60B9C66D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990172, "uuid": "639a59c9-19eb-4b7b-92d8-24a5b20b2279", "value": "768:X/TtS27lR63z6/KwvIsTAPRq8z7m4ovRrrQcKk:Zl0zPa8z7mdrrQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990172, "uuid": "ec5e2df9-d807-460a-ae89-697440f3869c", "value": 38256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990172, "uuid": "6bbd17c2-c3e0-46e8-ad6a-7f923745b071", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990172, "uuid": "2dbedda8-de5b-4332-87a4-688d0f6fee4a", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5e7539-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989084, "uuid": "06e4384a-f499-448a-abeb-d20e3f564064", "comment": "Malware payload (Mirai)", "value": "ece697dc17265a076f7e164bcb925281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989084, "uuid": "3ec87009-aa9f-4087-b6b0-ed995b0ae6b7", "comment": "Malware payload (Mirai)", "value": "1c3445a2c9d457a7be968417f8afe34c7994fcfd92a383a89fb0c3739d5c8cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989084, "uuid": "589dda6a-3e5f-4d79-8fdb-516eea09eb01", "comment": "Malware payload (Mirai)", "value": "c684071df007cf9b59e15f2bc4410d919e4276c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989084, "uuid": "2516e7ff-a178-48c5-9c4f-613bfd9966bc", "comment": "Malware payload (Mirai)", "value": "1c5f750657f1df04ab66e26ae698f8107ac2a8ccd56c0bafade92126c4f5bced4c5d1a456e925a28b2bec00ae9cfe69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989084, "uuid": "c2d05da9-44ca-4b05-b157-635baec7273d", "value": "T17D4349C4F143D9F9E84701741026FF37AB72F1EA115CDD87D7A8DA22AC92A12E44AD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989084, "uuid": "17aaee41-4e18-4ecd-87d4-a141a7a9257b", "value": "768:q13SCx0c1gpzsQV5vY2tVo3TmcaDjpgkNvGXzIYehn+IsToQLDxv:23SQ0cKpzZDV6mL1GX0YGn+NNLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989084, "uuid": "6ad54661-18b1-4f3b-882b-ebbbf879739b", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989084, "uuid": "e522db46-6621-4d91-929c-c13118808ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989084, "uuid": "d0b9630a-264c-4736-ae44-b6d3f5f70714", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7856b2d-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761989214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989214, "uuid": "93d9645d-a108-41de-ae41-49655ee442d5", "comment": "Malware payload (CastleRAT)", "value": "6735b1741a5ace826825b66bc626d0c0", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989214, "uuid": "0c126bde-64a2-4830-a092-bf5e313dc1d4", "comment": "Malware payload (CastleRAT)", "value": "1ca8b15684a1143e38ef87f31d8a89c7b25a1107aeaf03d43ad9fd611c4a35ba", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989214, "uuid": "07882c65-b02c-4c32-8985-a21a15677ab8", "comment": "Malware payload (CastleRAT)", "value": "a96c1da9cc40ac214ceb1497fa4fd211e91b665a", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989214, "uuid": "cc5e6866-730d-4af2-ad27-ce67bb51665f", "comment": "Malware payload (CastleRAT)", "value": "103113a780463fc43bbe3a6d9b8a48d699324846da238ffb9ad590575d8b7dce7f22fc5233916a87b8ffab5e101664f5", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989214, "uuid": "fcb71680-afee-4e51-b4b8-378ff531a94e", "value": "T15D446B117686C937D4620BB32A9E9375412CBD359B2165CBA3C82F29ED344E25B38F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989214, "uuid": "33aa55cb-ee5a-462e-a608-3214fcafcfd5", "value": "a759d5edea0de4bdd334cbc11514b61b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989214, "uuid": "af783686-bacd-4847-bc63-6a699ee1b1fb", "value": "6144:xp8aaMbGbnt6msQISCE9ulNxCx5B1XLHRb+cQbZy/aNo:xp8RMbQnt6msdvE91B1XDo/s/aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989214, "uuid": "7765f107-4c3a-4f9d-95fe-0a95458d0c2b", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989214, "uuid": "110e0550-46c7-4e84-a247-205c30c0c155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989214, "uuid": "cdcfcba3-6c1c-4c33-bcf7-799d2312a524", "value": "1ca8b15684a1143e38ef87f31d8a89c7b25a1107aeaf03d43ad9fd611c4a35ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998dbf0e-b6dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761971903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971903, "uuid": "85d162fb-6523-497f-a702-3a6782454f63", "comment": "Malware payload (Mirai)", "value": "204bf062f3d385859de1ba9e840aea0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971903, "uuid": "94a441cf-5166-4cfb-9614-19e120d77bcb", "comment": "Malware payload (Mirai)", "value": "1d562df76fb3041941562e8b99aa38d5e596d3c613b6961909694bd462a23947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971903, "uuid": "92d3f46d-7820-4055-b2fd-1dc657d6fbd7", "comment": "Malware payload (Mirai)", "value": "49ee589ed1d0f4bd8860cc41b2506cf0a2380e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971903, "uuid": "c763140c-b666-4608-8347-5c5bd06cd5b1", "comment": "Malware payload (Mirai)", "value": "bea37b4597fa9fd850d75a808455eece32fb3373818ec6b463763b8290b0bf5e52cff9a70729b9e250ce3f3d20b92582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971903, "uuid": "37a1bdcf-39db-4dd0-8a0d-ffbb8f62105b", "value": "T1FAC3E099BB2369D1D1A342FEE4C41AC387A16E728F931208018DF6343879DF61F69DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971903, "uuid": "d75bf32d-5ed0-47a4-8413-3241180efd55", "value": "3072:OBa76K+CypnHjY1d3uDXYSA28LlFyrkWAdMMTnU:9ADEEXYd287W+xTnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761971903, "uuid": "62083495-b791-46c2-8f8f-b5a831e8ae97", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761971903, "uuid": "c1cc9313-04f4-461c-86a0-46e6f9f3917d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971903, "uuid": "23699a07-a56d-48eb-941c-c41d494b3fed", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1541925f-b70f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761993585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993585, "uuid": "8f7c06f9-97c5-497e-8c43-6017ff753444", "comment": "Malware payload", "value": "e9a6cec1f8bae7bf2fe924c7ab7b5474", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993585, "uuid": "1e46bd4d-6625-4361-a350-b3b06aadbb21", "comment": "Malware payload", "value": "1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993585, "uuid": "0af2b7a7-5eda-4384-9f0a-7f9ccae51334", "comment": "Malware payload", "value": "3e23870c4e7dc55b70b9512fcc14f3795f7d739d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993585, "uuid": "c2591633-d0a9-4c64-b1dd-9a872cc7496e", "comment": "Malware payload", "value": "7ddc873bb835e6e148bffa2a4f39fc31ecb04836488042b50e52354ef1b04c7c71fc40718287725779ae488a34a7e27a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993585, "uuid": "0fe0def1-a5df-4c27-aad1-c0ab3e145d29", "value": "T17DB3AE6EE74F0955DF55A67B034A4E4A09FCB33DB28100B179AC973437ADC2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993585, "uuid": "41234ad5-991f-4fe0-a453-98133ecd0e81", "value": "3072:bQEEgMe/V2qUJIVZNwDjekszeTjGtHDiynQQwae6e85xaIfpPbp:bQrTe9ToIVZNwGkweTcHuynbwaeX85x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993585, "uuid": "5cee1267-4579-4420-948b-2bc1c6dcd57b", "value": 117689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993585, "uuid": "35e56278-0bfe-4aa9-8957-da9a252f5e63", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993585, "uuid": "2a3a5657-e1ee-48b6-a073-ef5c709a4330", "value": "ojo090iui0ewr0d0dfsd9f032iue0rt0ter0dfg0fdg0ert9eterfdg90dfgw9e0r.dOc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fa7497-b70e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993159, "uuid": "30ad67c4-3922-4d62-b18e-b73899ac7523", "comment": "Malware payload (Mirai)", "value": "1920c810b6b7fd6c7629ec53ca3db160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993159, "uuid": "eafe0b1c-924a-48df-ab92-29558c3631b8", "comment": "Malware payload (Mirai)", "value": "1e71eabf6d3b231b31e63827e8e7a1ff9f4b34a2edc602d19ab4aaad59e800c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993159, "uuid": "a11f6ad1-610f-4c34-a8e4-9ca8cf9ae5d5", "comment": "Malware payload (Mirai)", "value": "0c1b32fd6b4ff18a542b2df033038d30e2ed2156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993159, "uuid": "2bac51c3-db8e-4379-81b2-e229be65caa5", "comment": "Malware payload (Mirai)", "value": "e8e5a82498731badc5c0864d97b0b3d2c9f4eecc43cdbf4d28e8d64ab31fb74378920079d4ec97572d7feca7d873eb60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993159, "uuid": "01b4f3fb-2380-43a2-b38b-8e8a3867048e", "value": "T1E9435CC0DA53D9F9E85606B02076F7338A37F43A501DEA53D779AA32B893E40D61629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993159, "uuid": "59ef188e-ef48-45fb-bc57-66a65b4b570a", "value": "1536:XbP6L8TBGGhoRisUC1DgqEtaEkgN9Nwj4FcF6nOpCdR4Yj9sjs/0Sn5LeZg9iKTY:XbP6wTBGGhoRisUC1DgqEtaEkgN9Nwj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993159, "uuid": "e09fd9f6-96fd-4a09-aac1-4b8779eeca5e", "value": 58388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993159, "uuid": "e6d44b35-84a4-4455-b18a-52108f0a0f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993159, "uuid": "8c2a0210-dce6-46da-9b6b-3acb2fe412ab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66cde14-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761986662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986662, "uuid": "a99221c5-044d-4285-a1b5-6be52dae981f", "comment": "Malware payload (Mirai)", "value": "1b4e6b601d53d96b6f1d8da931e321ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986662, "uuid": "c2005797-a8c3-46b3-9a30-6970cbaffa38", "comment": "Malware payload (Mirai)", "value": "1f4ba999ed238cb758217feac09ae3753ef5f931c737fc65bad13164e83b73b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986662, "uuid": "6241f91d-ff74-4f0f-a709-f8b6656b4eaf", "comment": "Malware payload (Mirai)", "value": "950cfc5312f9751ea1077374201002e5287dafa4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986662, "uuid": "bb76c3e4-e288-4128-a9e7-86486cac9931", "comment": "Malware payload (Mirai)", "value": "d8a50b0cb8ad45ecaf50cf8dad9330222c85ca9dcd609cb4532f5240daef82e8958f3c283b9a20a5ae3a406f98d53fc6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986662, "uuid": "1af7a569-6ee5-4e6a-bfb1-cfedbe32aa4c", "value": "T1E33138D912C2233D82C68D3EB1D3DE2E905D91D95AB02B84F19D29B6EB80E90B404F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986662, "uuid": "66f3683b-5c50-4af2-beee-5f81196d9025", "value": "24:ZKM66y2dei6p9U+VxvBYr1npLOc3liAfqlDoJkfbN/atkkbhvj:ZKM692UieU+VnYr9pjiAZkp/at/Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986662, "uuid": "33eff488-ad0b-40cf-9724-140a00af715a", "value": 1614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986662, "uuid": "64c33ef8-cb22-4248-950c-3a1953f08375", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986662, "uuid": "7d30b116-8596-40de-ad09-58c027e57113", "value": "vac.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa40aa6f-b74d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762020598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020598, "uuid": "ddd97bcb-1efd-429b-8deb-40cf88f1dbf3", "comment": "Malware payload", "value": "67fef92f67b39c1edf1751f4e97f2797", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020598, "uuid": "8427968d-a07c-4e81-b987-d30b9c2c7b5b", "comment": "Malware payload", "value": "200eea3051d4c0e3761d12a178e8dd6a81b1ca99dc3a14326a14e31f0c689df8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020598, "uuid": "7068dc8f-e7b9-40ca-b890-8c8c8d9851b8", "comment": "Malware payload", "value": "2858b11ee39fcc3299ad7f3aa390f12240b2f045", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020598, "uuid": "996f2b5c-f3aa-47db-a992-2df56c366d37", "comment": "Malware payload", "value": "97093f577a51fdd35dec0e834f1ee0d29472e556b253e971481e1763a799fa63579f09da00e30ef64cbbbb3894506f68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020598, "uuid": "4a6247c1-6ae4-47f9-adab-082a34b9366a", "value": "T1AC012DCE0626B6B495A5CA40FCE2CC64541CD6C220810F70EACF5AA7488BA18F13270B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020598, "uuid": "c66a9e4c-e7c2-4efb-aec9-87a5e992a7b7", "value": "12:784HZCok4H/ok4HGok4HMok4HX1ok4HEok4H7bbok4H7kb5:oSI1S/1SG1SM1SF1SE1Svb1S4b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762020598, "uuid": "72f5c5cb-855a-4d60-88bf-4764456e3b56", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762020598, "uuid": "22041cd3-19e0-4e6c-b90b-e73352d098ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020598, "uuid": "04a822a8-e62f-46fc-821d-bd87cdbf1d62", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227e16ca-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761994896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994896, "uuid": "9eb956da-9454-45a8-96f8-2e4484214e52", "comment": "Malware payload", "value": "c794662abc7792ac90200f14cf89ce24", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994896, "uuid": "966d6f18-0d83-4a6c-ab40-d402562ef7c3", "comment": "Malware payload", "value": "20fd54ad99f84a389b8e43ed3352049fd07243c52bb4890e397a27865170ce27", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994896, "uuid": "301c2476-c32a-452b-8c7c-914c6fde3106", "comment": "Malware payload", "value": "439afa13675fccd6bc68d36ec8658aa0efdb2877", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994896, "uuid": "4482ba43-0cab-41d7-97d0-cac660398724", "comment": "Malware payload", "value": "ac90858850b1485da39a03738e412282aef706ef25f7b886055f0afe65668d820c1b352fbda723978fc3d95aeebb27a0", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994896, "uuid": "e18dae0c-49c2-4bb6-b4fa-5439820b460d", "value": "T1A8E0EC1EC20985FFA416885FAEB839CC710EA34D5ACA2E05AC389D16B481C5C81C0025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994896, "uuid": "cf461c12-5402-4f7c-afdb-65396bae875a", "value": "12:/bwgVE8+HS7Uy4gZesFrFBEGgbu+yfuT+JF8EpASLye:jwgV4HSOWrTBEGjTuyLpvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994896, "uuid": "6f12f9c9-1a05-49ef-9775-f13571d555fc", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994896, "uuid": "f90e61dc-963c-4b8d-8194-49d4c44132f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994896, "uuid": "3700f4b2-0d40-4e18-b1eb-32babd906066", "value": "20fd54ad99f84a389b8e43ed3352049fd07243c52bb4890e397a27865170ce27.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b085c15-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989085, "uuid": "4f68a318-d105-473d-925b-4864c36b88e9", "comment": "Malware payload (Mirai)", "value": "e950db694bfa3f964c298ba0f7e89c4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989085, "uuid": "cf8d3f49-b525-401b-b234-2e56a4504da6", "comment": "Malware payload (Mirai)", "value": "21cca51838cac75eeb345ee1abc5fdcec939514d2dae30270c1c84ecccdf089e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989085, "uuid": "49607cfa-2463-4ce2-a814-3cef6126a798", "comment": "Malware payload (Mirai)", "value": "abc5249eb1dfd88809a855b7a1f675f9efd0b4a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989085, "uuid": "628666de-4310-43ee-82bd-5531ee77fffe", "comment": "Malware payload (Mirai)", "value": "b8261de627bd65cac12e8d8096e3e6414c2eed41556de45218f853b334adfdd5e8ea83392e4f963a990e521a5ea1d24a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989085, "uuid": "6d2dbbe9-9a17-4a6e-8ab9-68473a613844", "value": "T11D435B52721C0E17C4A31A70263F5BE08BBBEAE021E4B685695F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989085, "uuid": "87d514e3-2c14-4167-90ff-5f06a6a00fe4", "value": "1536:eF+8ccTEdgkHUon9k1dP9RT0bI666hJa108:Nekph9k1dP7gbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989085, "uuid": "ba738cd1-6d67-4a21-803e-9a1f814fcb38", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989085, "uuid": "9f97da53-25fb-46f9-ae2e-8c1427aa96ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989085, "uuid": "7c899dd7-b96e-46e7-bcbb-2e8f6b7354d0", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd36bda-b75d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762027157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762027157, "uuid": "2703b685-8b6c-4327-83f8-c34a260c096a", "comment": "Malware payload", "value": "e282e41c419917337fb0204432e66d04", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762027157, "uuid": "483bc618-8279-48b1-bfb9-0295bbfd4ba6", "comment": "Malware payload", "value": "22117b6abb48808c3c99ae25311396b43b62ae5e30bea76c14a7ce686ca1c1c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762027157, "uuid": "9ae57e2e-ceb5-4b67-96fa-cdc40a1fde28", "comment": "Malware payload", "value": "f8e13f3a0d63fbfb53c19d9faf61fb3817bcd43f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762027157, "uuid": "bfd7aa72-177c-4287-a9d5-273ab0ee4f41", "comment": "Malware payload", "value": "f1f0977b39fd92d966023f78f85b7038896a65a7608ffb7afdd838211bb08313c81a42adedcbcbfe9c7ddc1b98df53d7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762027157, "uuid": "ab4da6de-aca6-46d7-a63c-39d66c41336d", "value": "T18825234543D4217BE5B85378A5F30067B3B178E40B3A4EBF22C5AA7A2F136C49632B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762027157, "uuid": "d6864449-c7ec-4cbf-9a66-34ddd5dfb84a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762027157, "uuid": "699a799f-e277-434a-81bc-b31afcabfd3e", "value": "24576:bjzfgk2Vr4N95EG4PVwV41Zgny7UEUaVRGJJlwulMZo4M1x95xzrRx:bjuk90GNnyhGJJlxq1M1xvxzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762027157, "uuid": "2f46d715-75ea-4aa1-8dc9-9ac15dabed6b", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762027157, "uuid": "2d9c8b0c-904e-4fd6-8f59-bbb2cbf226c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762027157, "uuid": "6ba603dc-def6-4ee6-99c2-406dcbb668c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1665c17-b71b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761999001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999001, "uuid": "6f90f883-4fdb-4a5b-8dad-424e48713410", "comment": "Malware payload (Mirai)", "value": "816f53bf0b32970b3d0129f8f653a4c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999001, "uuid": "6aa98ec1-0205-4320-aa61-5f7f5afd0619", "comment": "Malware payload (Mirai)", "value": "230904fe6bb086257e0407324e5153af1992c87a98a2f8fa89204a587621e23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999001, "uuid": "82fb900a-2070-48dd-ae2d-41d9aa072f95", "comment": "Malware payload (Mirai)", "value": "716a12635764aec9928c2555d9ae5554fdb15027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999001, "uuid": "6b72f7c6-0775-4e8f-ae4d-148e0acf61f2", "comment": "Malware payload (Mirai)", "value": "2b8b34285591c242267d04a7e6864d1a2d9cc40953b843b0ab51c37232baeff714f9917a0f8b0ca68739541d462d5008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999001, "uuid": "50d88ccb-e948-417e-a29c-e4eaca6a180a", "value": "T101F2F29A1EB84C8DA8D56334F7B89DC9AFB51B1B6C71EF447060A56D02A43430BD0F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999001, "uuid": "f6df0d5a-7e62-498c-b5d2-c55becfd9571", "value": "768:ZY+s/qE2c1RNlWMv2jovNGScn3oAuhBu/LuYJuhXZrUGG:ZpEDDllnFG7xAguSuHod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761999001, "uuid": "584292f2-d050-4cb5-b93d-05b394536671", "value": 36148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761999001, "uuid": "58e3f5c3-9005-49af-98a7-e8fcdc643173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999001, "uuid": "0b032a8b-86d4-4e94-9cf5-20202565023e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038c0e64-b6d3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761967786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967786, "uuid": "48fb8e76-8346-4b5d-a108-144687b2434e", "comment": "Malware payload", "value": "b0f1b3bc55781a424f3f2fbbfb52f184", "object_relation": "md5", "Tag": [ { "name": "Aimware", "colour": "#B97D96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKnow", "colour": "#51DF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967786, "uuid": "abe894ad-d9c5-4bed-adbf-877f0438eee5", "comment": "Malware payload", "value": "23586030561388baad38bb98df972243ed2679c5c325eb0fdc719d41cf3b4de2", "object_relation": "sha256", "Tag": [ { "name": "Aimware", "colour": "#B97D96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKnow", "colour": "#51DF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967786, "uuid": "e3e374fc-45fb-49e5-8b4d-dc7ef02f7d88", "comment": "Malware payload", "value": "a783f647258d2a9d2c5592f6a8c26b376e0af487", "object_relation": "sha1", "Tag": [ { "name": "Aimware", "colour": "#B97D96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKnow", "colour": "#51DF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967786, "uuid": "939db719-d73d-49bc-bedb-4a334a234cef", "comment": "Malware payload", "value": "7302e637e8e401889bd9dfb65abda32e7af31c096071a5c89fbb7c84c8615bc0d4a21786694bae87d95040a12bd8b334", "object_relation": "sha3-384", "Tag": [ { "name": "Aimware", "colour": "#B97D96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKnow", "colour": "#51DF8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967786, "uuid": "213ddc77-72e0-4551-9a63-44658df24a51", "value": "T1DE7722D679D5E2D48BD30454624E11DE22C098FA89ED9A287BC64C039B30EFF495DEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967786, "uuid": "624d9446-7c5a-4b10-b779-27174cd70ecb", "value": "1fdd925593abd8ec489ed4fb243e3da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967786, "uuid": "b5b78d22-cbea-4a9b-b790-321c6f464c16", "value": "786432:+QLK7bIBRyLioKJghaFQW8BkpfeobYHMGQn9SI4uMoY+:BLDBcLBaFzz9+Cn9j4oY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761967786, "uuid": "a1d06b50-5e04-499f-aedc-8cdffa1b6074", "value": 34786816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761967786, "uuid": "5c526aa9-c3b9-4ba0-858c-6209d2e38941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967786, "uuid": "9a5edccb-26dd-41f6-b532-c2f93abfab57", "value": "aimware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b928e91-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987153, "uuid": "7f81e007-6878-403f-b47f-68e00cc1c71d", "comment": "Malware payload (Mirai)", "value": "e2733d21492dd949c7a169b6a0e79170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987153, "uuid": "a928910d-2984-4a84-9203-1c3d4a217b6c", "comment": "Malware payload (Mirai)", "value": "24c1ad8aa706c196b31bc46834b3bf5b8661d38e01513633a75b12d9c81c66a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987153, "uuid": "36519aa5-c0b5-4ff1-88ed-ab7c6bdedf96", "comment": "Malware payload (Mirai)", "value": "c522d1341303ed07503be365ffbb2078aff87e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987153, "uuid": "8bdb9cf5-8428-4cd8-a77b-87e0f3c73464", "comment": "Malware payload (Mirai)", "value": "b72dcdcfbcab46fd63a3c4af7e9ca19e6931e0d2f75a87758ccd65fe70c2fc06c24eefbfa5f15f62de1cc56afdb92602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987153, "uuid": "a62ca222-180e-495f-8574-68fb386ba8dc", "value": "T15904881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987153, "uuid": "2fdd0120-2db1-4e11-929e-0b870bb99591", "value": "3072:jg57Rj7LHZwbq1YSBan1yvbysxr1uGS0I:jglRj7LHZ0Bqyy1BS0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987153, "uuid": "2e2ee024-5d03-4715-81bf-418643eb95e2", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987153, "uuid": "87896f09-3df3-4e87-b080-cc16e3d26e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987153, "uuid": "f2d0447c-9ebd-4b58-acfe-fc96a859a912", "value": "main_main_main_c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee0d531-b729-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762005144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005144, "uuid": "fbec1be3-0728-453a-b580-976eccaea1b4", "comment": "Malware payload (RustyStealer)", "value": "ce3f7e4235c89e9cb09fbd74f44575b9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005144, "uuid": "f5bb28fc-08fc-43dc-8892-f59cbcdea153", "comment": "Malware payload (RustyStealer)", "value": "24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005144, "uuid": "a19b421b-69a3-4673-a1ec-03cfea147db4", "comment": "Malware payload (RustyStealer)", "value": "6bcefbafdc4346c943546400f8b0df62b787f4ad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005144, "uuid": "3afa7c82-deed-42db-8e3c-89a72e8e5aae", "comment": "Malware payload (RustyStealer)", "value": "2c29c2709b0c6890cffd8fe75c73d0f2fa2e3764b415572498e4d50d6d29bf4eaf18e06a0ce2da9872f8b204fd3b8bc9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005144, "uuid": "c8b81263-c399-4a56-90c1-4016ea29a45f", "value": "T1FCA65B03F69580E8C0ADC5B8872BA637EB76FC890524B29B5BE44F212F66F505F1C359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005144, "uuid": "55c9cfc6-b6ed-42f7-ad11-05701f179e2d", "value": "c7ed81876c9d12e4d4be2bd1e67e331a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005144, "uuid": "7739d5f4-efd1-4e07-bcc1-810aaf4c3e79", "value": "98304:+xS5jvqgAwz5cu0fwmfRBwW7UwBpwLBDSAnMd//9YWFn+P:W2z5cRwmfRBwUOLFn43OW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762005144, "uuid": "9ac97fa0-6b03-4777-8f21-e9725e883598", "value": 9642496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762005144, "uuid": "e04f981b-6f8f-489a-9160-bbd666af276d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005144, "uuid": "2cea0d6b-0233-45a5-89dd-6294cf4df3db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b20acdf-b6eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978321, "uuid": "fe918869-73bc-4370-b401-aa8d1ef7d3fd", "comment": "Malware payload (Mirai)", "value": "d00056dfd9cea801268aea90a9091ec4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978321, "uuid": "8b8b15cd-b058-49ad-9dd8-19002819c20e", "comment": "Malware payload (Mirai)", "value": "299d2727808a0ec608730f65c3d06c4a74a47c370170a635477db2d06d50c668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978321, "uuid": "2843139d-721c-47d9-80d3-f81b9e56f9a4", "comment": "Malware payload (Mirai)", "value": "134016276e5addce876531ac1e32b4231d6542f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978321, "uuid": "19c9c1b7-4b04-47c3-b9ae-0b1e35868459", "comment": "Malware payload (Mirai)", "value": "8e635b10d08eabd9cb95582243758773f264bc8f1588ad2866e2467c5795bc408142e22a2f48d2dd0d8a638f8d6bd949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978321, "uuid": "0133ffea-00b9-4173-8dad-3845825685b9", "value": "T163B38DA86A4E7D92E2CBD37DDD084F72712B75B1C66093F17E02A35DC1DB99AC9E0801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978321, "uuid": "6a2ee112-1f7b-431b-b8fd-d9badcd5ee4a", "value": "1536:rHmMUFnq8EE0jXUpPvYejWE+tJT5ZtK+b7xjanlceT6fZ5:9Uk8EEdYejWE+tLbF2nWeU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978321, "uuid": "755efdb7-5d52-4cd2-998c-811bf052e73d", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978321, "uuid": "4c39ab7e-6fdd-427a-abc8-64d6304e45f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978321, "uuid": "da107fab-6be4-4e19-bfce-689597787764", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e719e0f8-b6bb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761957860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957860, "uuid": "9b2fff1b-84e3-4e06-b6e3-1d2318370b49", "comment": "Malware payload (Mirai)", "value": "d0c20914a5c4e7b4d58c12223f150df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957860, "uuid": "3cb9a44a-3eac-47a2-9e5a-a4820600ccdb", "comment": "Malware payload (Mirai)", "value": "2af5e7e567c767da08cfcd7feb27a86c8b4dacaf44f4e7964ccf037705770a86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957860, "uuid": "20b2a507-4b35-4b40-94d1-de43616f837f", "comment": "Malware payload (Mirai)", "value": "c1e0dab2feef20062ef371eb05bfb37c8358f582", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957860, "uuid": "4799c2e7-3626-41e6-854d-70df562bcf42", "comment": "Malware payload (Mirai)", "value": "c7140edfb617956742607357742ea5f797dacc327937f4e15da751372a3fb78794e529a9a5f4b9ed519a20fae0db6bf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957860, "uuid": "0547d832-cc41-4f54-989e-7dfdb3e28306", "value": "T1B7630855F880CB22C6D5267AFA5D418D33231F78D2DE72029D24AB3577FBA560F3A842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957860, "uuid": "29c17811-7424-4942-9e63-556c9ca449c7", "value": "1536:z567az/6ZKSQuKv4pXOgkNOcd6+nBRInnJtDOn9P1Ir9:VcagKSQgk89+Y/eG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761957860, "uuid": "5f2da0e0-0f6c-4ee9-87e7-bcdf0f3230fb", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761957860, "uuid": "73e3ac1a-7e9d-4c39-be8e-0c0c0f0051d5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957860, "uuid": "cafe48a1-207c-4363-93a8-81f297e7e031", "value": "frost.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fdfb11-b6f0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761980431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980431, "uuid": "3346c592-3320-42ba-910f-55fd4cff4102", "comment": "Malware payload (Mirai)", "value": "edcfa226c8533f0037f5588b40a3a4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980431, "uuid": "4a6dfad6-29f1-445e-81f5-2276f8f8f8f7", "comment": "Malware payload (Mirai)", "value": "2b16c4387c309c475d60ebbe782f021522718ecfacf2e662e3f05f639c7a985f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980431, "uuid": "0ef2286f-0900-40b8-b33d-aa5ac3f40a38", "comment": "Malware payload (Mirai)", "value": "161e3205c6e2b65b6fb4a3ba66b5cb5924f47680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980431, "uuid": "dabdfa0c-4e7b-4995-bfd2-d8745581e5c9", "comment": "Malware payload (Mirai)", "value": "a507caafbe062beab8ae83783d9cb5aaaf25546670d19b16e777438a1bef63f4e8e70bda3d9ec20f1ea1a160814be672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980431, "uuid": "aef098d5-77a7-4120-9243-9e692e1c1a2b", "value": "T151D3530EAD219F3FF22CC33547F7CA64A26527D723E7E24AD25CD5201E5438A582BB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980431, "uuid": "13323ba5-75e9-402e-8b80-b5da8853f988", "value": "3072:hM1tskxwTT38sLdSs2r1CVS8CQbqWMYxLcdIhy:AskxwTT38sZSsuQqWxIes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761980431, "uuid": "e153f622-3ca1-49be-babb-4903fe47a547", "value": 142636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761980431, "uuid": "5bbaee44-0be1-427e-b334-671aaedc957d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980431, "uuid": "41617ec0-d4bf-4cd4-8fe5-0858de9a7960", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4df3b3-b6ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978622, "uuid": "0bd307b7-d1e5-4578-a8ff-c15051d2c53e", "comment": "Malware payload (Mirai)", "value": "84758e87497da56ee16807a50f0d168b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978622, "uuid": "f9a12754-e1aa-4b4d-a8fd-fcc9a731c107", "comment": "Malware payload (Mirai)", "value": "2b9678a7a45d0a3b06d2624103fd18f6ea13f4456a94c19c3aa17953fafc1248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978622, "uuid": "eb7e9e7f-8f9f-4b68-9ad0-404dc6226c58", "comment": "Malware payload (Mirai)", "value": "b285605225d8a1472e3f915f313a77d8b806e51b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978622, "uuid": "c1bc781c-d020-4e8c-a73f-cf3e665b109a", "comment": "Malware payload (Mirai)", "value": "0c81aec5f9b33b1878f865316fcb2f8bfdab00709385976b90635fa72ce443b7bebedf14c620e6100859403b32c3c2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978622, "uuid": "5ac8c7ce-b791-4573-ab68-2d5278f06569", "value": "T118C3F996B881DB22C6D556BAFE1E41CD33231BB8E3DA3207DD156F2037CA95A0A7F441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978622, "uuid": "7619c783-197e-419b-8e38-c8684d112c4a", "value": "3072:jF7HJ1kutFGm3K2b3DkYl5DNcLGsOFra8I+kKHagR1Xn16:pXkutFGm3K2b3NDyi508RkKH1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978622, "uuid": "fe13e674-04c1-4f48-a51d-96047a08d11e", "value": 123636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978622, "uuid": "246a48f7-1cae-468f-a947-61e6dfaffd61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978622, "uuid": "3d088302-7e26-4036-9a8b-649494c934a6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2570429c-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990176, "uuid": "e806581c-8d83-48b5-a136-88b232060627", "comment": "Malware payload (Mirai)", "value": "29d7d4ef4d912956280e8af7b52b824a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990176, "uuid": "be2e9261-987f-4f29-bbe1-7801812b992c", "comment": "Malware payload (Mirai)", "value": "2c1a5762544ccaa9ed3de5cb37144a0c2f7dc14a9a824269b0532f735c202155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990176, "uuid": "9d92f26b-4e5c-4f8d-869e-f9b2fc255acc", "comment": "Malware payload (Mirai)", "value": "e46e7d4297d0ec02f19eef29f18e1b92e32c1fff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990176, "uuid": "7d1c2448-dd2d-4647-9b77-a74d4ab57024", "comment": "Malware payload (Mirai)", "value": "665683206b87b814d78f190d69337fdcf0780217e0028281774e50c8bf914eebb2d95a80400a320068619738867058f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990176, "uuid": "18b05737-3a52-46ba-adfe-b699198232cb", "value": "T149536DC8F583C4B9E85309711036AF235E72D2BA33E9D983E3B8D535E952201F56AA5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990176, "uuid": "cd61cb81-d3e6-4a36-aacd-f8ce35e3d79c", "value": "1536:dMnCJhagxtFWMeVxuu5bCtnueLcxfQVeOk6emOSS:QC3xtMMun5+tnufxIRkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990176, "uuid": "963aad27-1c69-4030-a0b3-cf5de03e4ede", "value": 66704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990176, "uuid": "d45833c6-7b64-4fe5-b542-718d9c7204e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990176, "uuid": "123ef1b5-f738-405c-b4d8-95d133b7d970", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98b2ab3-b703-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761988680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988680, "uuid": "5f528fbf-4645-4976-99d0-56771ef1a4dc", "comment": "Malware payload", "value": "01c62807f62829f997a15bee1a33a433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988680, "uuid": "0b6d0b82-38e1-4cd1-bc25-1a73ce8311db", "comment": "Malware payload", "value": "2c4eb0f3b6e79debf4e75222ec771d9c28d6bfc6dcf090d807c435d26594f8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988680, "uuid": "bb93196b-0ae6-4201-b7f1-671fa3b7ea5d", "comment": "Malware payload", "value": "cfcb5af08c5b910968537fca9178b38f422d86cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988680, "uuid": "f9eb3531-b888-4a1f-8f11-af8c8e914ed6", "comment": "Malware payload", "value": "62e77479f1cace75ad51ffc77f94a97db954ab7d0b07ace289008d5d00132bce8eae620b0ed2cf7a2cd5eb87e16a04ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988680, "uuid": "653433e9-cfe7-4c3f-aeb5-f47adf9b2da5", "value": "T1EDB6334D95E019FBE8F3923DEAE2D94AE335786D0F72CCC783A441625E231D42939B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988680, "uuid": "61795aef-f11b-4be1-99ce-ce4a96c8edcd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988680, "uuid": "8786ec4e-cb65-4acd-a654-206999ffa307", "value": "196608:sa85DbJrte6wMO0Qz+KnXMCHGLLc54i1wN+wV0cSXl74w4XeWaSqaGSn8gT8N8O+:F85vznwr0Qz9XMCHWUjYVg74wiKaGStJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988680, "uuid": "c3a94785-aca8-45f2-953f-939b2c2e1403", "value": 10581941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988680, "uuid": "52f553d2-39a6-4648-b041-2a6148fe5468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988680, "uuid": "094115a3-0f70-4efb-bcaf-5c195f324be8", "value": "SecuriteInfo.com.Python.Stealer.2340.31922.8851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08e92ed-b6ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978921, "uuid": "e3e430a8-7125-4d38-a1d1-bad9aad65938", "comment": "Malware payload (Mirai)", "value": "96a995ac9e9af9ee56b45a2c847f5467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978921, "uuid": "bb8f3138-ed0b-424e-95c8-bb2ec9bf31bd", "comment": "Malware payload (Mirai)", "value": "2ce772806911edc3221c7dcbc1d1848fa86c1130892bbf04bff2d69b2ba6eeb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978921, "uuid": "bc1ae412-186b-45bf-9c45-bdd562f9f07b", "comment": "Malware payload (Mirai)", "value": "4b31f87bab9977146548af0c1615ede535c5f284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978921, "uuid": "ec51c37a-ecff-4df3-ab9c-9917b86093f4", "comment": "Malware payload (Mirai)", "value": "ae0d5b904bfc88a1b9c7aff6387a583291fe0fe4ed575950dd9f2e1afa0c1d54a107f5f2784c5fa346ce81ac93a4d637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978921, "uuid": "1a89bd52-1455-44ac-8fd6-fb957ce3f5d6", "value": "T17D03F1B487EA91ACF2D51579A5FC3E8861321058F240C0B52ED5253C9C9DFAF3605EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978921, "uuid": "d8485828-0152-4557-bde7-f1e9a4f5d15d", "value": "768:qn3t2V78Lh/eKzKD35EzKuIjcOOT40hkp5xyGUc3RnbcuyD7UoQRjM:qn3e89C6IjLOFkXxMc3Rnouy8oyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978921, "uuid": "2a51701a-4857-445e-b237-62f38770aacc", "value": 39000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978921, "uuid": "442a3496-ae79-465a-93ad-ded64d820d47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978921, "uuid": "787c9481-0fa2-4904-b687-66b3f42226b4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0969d5cd-b713-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761995283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995283, "uuid": "92b87a7d-393b-4ae2-9af8-ab261a0a6164", "comment": "Malware payload", "value": "2569051af1e7c9c574cea2952ce90608", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995283, "uuid": "1f45fc78-7cd6-4e70-86de-0fa9b325b665", "comment": "Malware payload", "value": "2d15851461525775fe1470c2423f7fca1b36275d44bcb920b6ccb982e94f41d4", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995283, "uuid": "f6003c1e-5f63-4b73-b10b-126c7e739bf8", "comment": "Malware payload", "value": "2b028f49ac2f80c9a2ce33df436d85f10778eaa0", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995283, "uuid": "005bbfb5-ab9a-451a-b50d-dcbad5745a7d", "comment": "Malware payload", "value": "c01a6550ccefbb13618d08105a2acbdb83e3cdb5c5e900350a66cbdaa266a99aa494ed1d7f92acc684db2cd6ce5c249c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995283, "uuid": "80ad9079-0a8e-4a83-8415-19b49cf2c807", "value": "T16791B866FD431C415716034E74EE66EC1EADA30A121A62D75F2CA780858F85DB1DC8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995283, "uuid": "b1ef928c-c31f-4721-b7c2-7ac39379573a", "value": "96:9du3XgJfcHFH4RuCr3tNo3eovGJjUbt7Dmz9K8dOfUZI73PWN:90ngJMB0uArIeovAQbVDmz9jdOf8C3Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761995283, "uuid": "e54708ce-98bd-4836-b653-c5bd5f554eeb", "value": 4377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761995283, "uuid": "b5ec1746-1500-4ae1-adb1-ce3207eb8fd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995283, "uuid": "a5767902-206c-443a-9d69-476e75745fc4", "value": "2d15851461525775fe1470c2423f7fca1b36275d44bcb920b6ccb982e94f41d4.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbe1fd8-b775-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762037675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037675, "uuid": "119d30f2-955d-4cca-b34c-34960af29903", "comment": "Malware payload (Mirai)", "value": "a89df0969180d5f9e7770fd57532fe34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037675, "uuid": "b7d529f9-72bc-457f-95e7-dfb669effce9", "comment": "Malware payload (Mirai)", "value": "2f774e472182d428e784122d4401c1df7fc5dbec1e9ac30bef96b33a45648f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037675, "uuid": "9b16e416-f305-418e-82fd-8bc7ebcf3358", "comment": "Malware payload (Mirai)", "value": "2f972833138d4955f769b9bbef3961a95312179a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037675, "uuid": "8051b770-4698-40fc-a5f5-75c38a25a471", "comment": "Malware payload (Mirai)", "value": "b4790d3c4fe3d879aa054403a7e2eac6e8ef3b9766acdfec3953d431b13cf080dc0ea163cd6202ee5a25fc70831af6e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037675, "uuid": "9cef6e7a-e822-4f2f-9d52-0ce462333809", "value": "T162C31A55FC405B13C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B96B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037675, "uuid": "b3493585-c078-4eea-b1f4-450f9251d9d2", "value": "1536:J9v+s43G5bUWkkRA1Sh71QAFMxK4VIGUT2yNKtO/G8A46nztplk2wyw1FrR7TVIJ:Dv+XQnRWg71QNE43UqyNKtO+46zdtb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762037675, "uuid": "eca3be34-4cea-4d2f-98f9-1a53561a1de2", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762037675, "uuid": "9842084d-d6d8-479a-a96a-7ba13e884c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037675, "uuid": "9b5fc6aa-c3ba-43fb-8fa9-684cf37b002e", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1616587-b6e4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761975352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975352, "uuid": "238e9885-7f60-4579-9924-67a46fef3ac1", "comment": "Malware payload (Mirai)", "value": "901ce953d0f8daa42e30fcb702599b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975352, "uuid": "5e41f00c-3489-480c-bb62-95b107c0fcae", "comment": "Malware payload (Mirai)", "value": "2fbe56889db2b739aff212221593d99a430d1dd840f984cef50f324e45882bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975352, "uuid": "d05594f6-d055-43ea-af36-92e03b53de50", "comment": "Malware payload (Mirai)", "value": "76463668e4e258e54e7f8d2d160acc75c8a57156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975352, "uuid": "3a09d8de-f9a8-438a-9a33-f6f6393d3ec8", "comment": "Malware payload (Mirai)", "value": "9a186e72920713bbf536a2dd071014727ff4300cd64c6e8d2db1d2652aa0ab5db24d819d762ee9a35b1aed22278cdb9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975352, "uuid": "c7ae2fda-f11e-4c74-81c9-1f6cbcf4b986", "value": "T1B6145912FB0C0463CA935CF08E3F0BF6A3621A9215F99115250D7F5A1A32D77A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975352, "uuid": "9b51fc0f-9110-4415-ae3a-9075b6f832f1", "value": "3072:m+iEaG7SrgFt3XeSYqjOSsqBHnFcMxHjFUa4:2EjWMn3uSYqVN6MVS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761975352, "uuid": "f622f71c-9dca-4e8c-96a1-57a05e103199", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761975352, "uuid": "f7217bd2-9206-4594-98dd-d162f61ffd81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975352, "uuid": "6de4bc2d-3144-4a3c-b0a4-0b40665704a8", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3cec46-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761988878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988878, "uuid": "92938d6a-6374-466f-9ecc-d87bfa04ecc6", "comment": "Malware payload (CastleRAT)", "value": "c51a8192f84bc62b343df185974a277d", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988878, "uuid": "98db70fa-29d0-4261-9dbc-c8f20bbbf628", "comment": "Malware payload (CastleRAT)", "value": "2fcb76dfdfcd390658bbc032faafef607804d5d4a2f1c0005f274ab2e06d8af4", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988878, "uuid": "a3a086e3-d3ab-4159-a76e-938e6ad32f8b", "comment": "Malware payload (CastleRAT)", "value": "2d7a22eca132448be2174c0d2317ef5f6b650a56", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988878, "uuid": "73c4622a-bee0-4ac7-9ac4-f0914a398dcf", "comment": "Malware payload (CastleRAT)", "value": "50f788061d711abfa6efaa9aa73f9000ffb566895de9d5f822bb0ce479c4ef63d5ffcb9ef5817c98226b42d8dbcf337f", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988878, "uuid": "c6d70c2c-7876-4e54-843a-208f6a8f2ab0", "value": "T1FED65B6F76A18568C15DC23FC0A38F05E8F371B91733C6EB83A403686E569D45E7EA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988878, "uuid": "786b5c71-919f-47da-932a-59e15c9aa037", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988878, "uuid": "f2ec3312-3dd2-4736-b56a-4a33bf29aa21", "value": "49152:9ZF0/5ltUaJO+xkgB0dDjdNGSQZKG67KugVtOHEp+9U0aAlxIhrmlqD/oWlNve7N:sRkyhrOHMsfh0V238li6S78QmwdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988878, "uuid": "e5b3cac9-9dc7-48c4-b1e1-157772e17fdd", "value": 13263360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988878, "uuid": "6afbf49f-0bb2-4067-b78b-c5b7ed3e2366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988878, "uuid": "a3f1fb9a-ad58-46d1-b788-fd1c563fca75", "value": "2fcb76dfdfcd390658bbc032faafef607804d5d4a2f1c0005f274ab2e06d8af4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf7ccfa-b6eb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761978163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978163, "uuid": "80525f58-14df-40d2-97cf-e3ff10021d02", "comment": "Malware payload", "value": "81ca9fd444956175c94b43828ff0a9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978163, "uuid": "4f540ac2-3f71-476d-a6f5-f402bd6585cc", "comment": "Malware payload", "value": "316b0dfe8a4b4776688f7f8a869484e0e25ad98688a4f9ac813dc78494488338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978163, "uuid": "855580a3-4e73-40b2-b5bf-334218e9769a", "comment": "Malware payload", "value": "8632f9f94405b9a4bae4fc0edfb9d0e9dffd51ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978163, "uuid": "d48d4cae-f83a-435c-8500-11c39de1aae0", "comment": "Malware payload", "value": "287a99bea69eaf3a026590f9cd3f9adfb567760c5374d118c4281a53fa97e856ed65b31c8019669000095c146f282c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978163, "uuid": "28dff351-8765-4e60-8bd0-7058895d7fc4", "value": "T15A246386BFA03FFFD81ECD330295DA09129D890A1294BF776A74D518B68A10E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978163, "uuid": "425eca3c-b76e-44ed-a701-2c9800eba836", "value": "1536:rr0zX9YQtqf3eQSzxicK+b1CAM9OxbDrq1LWeiJj2TRGZTg8El0ctmn19rX0R:rr0JYWqfyvM9hxWHgRGZXn1BkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978163, "uuid": "1bd35420-2643-4a6a-a979-2b18628e5e83", "value": 217720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978163, "uuid": "c90c261d-0745-4b4e-bc24-bb751b010ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978163, "uuid": "1122c9a5-a099-46c1-8944-b208e1b8b35b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c04d61-b750-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762021725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021725, "uuid": "52ed1771-34df-4b4e-9f93-304580eaba02", "comment": "Malware payload (Mirai)", "value": "fb495456f716af5ff4f5b566d866e0a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021725, "uuid": "db4d54ac-0093-4727-b568-131aabd4ed92", "comment": "Malware payload (Mirai)", "value": "3193e4768350d565664b4422a6286e8bc4c9bb97c9fe781534e90774334f5b05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021725, "uuid": "a9d09b79-c13f-44cd-bcf5-480954def7fc", "comment": "Malware payload (Mirai)", "value": "146b4df2d2fdfa652c27c1e5c16ec616443694a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021725, "uuid": "81187d5a-db1a-4849-b8a6-1634ee26dcb6", "comment": "Malware payload (Mirai)", "value": "86e7424a051a2d5d36e479816d579beb98c4e23125effe76e4b0d6b62bc0b33912f594d2ffeb17e662cb6be4fabc867b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021725, "uuid": "5af33f81-ed46-42d9-9d7d-0f0062cdaae2", "value": "T1CB631890BD81AA22C6E12376FB2E418D331563ACD2DF7217CD226F147BC695B0EA7711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021725, "uuid": "c4a454e0-5099-41b3-b627-809521e6d3a7", "value": "1536:p3OBuO49zPFdl4XFP1xlU67W6lm8w50O+62OkB7T8emDqXyNTmH:p3kd49PPl49pJpS0rM2XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762021725, "uuid": "886ef708-83e5-4fa3-8308-4d5ee2cf3463", "value": 66792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762021725, "uuid": "708e2b86-f14a-4624-a94a-cd59c2cdb574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021725, "uuid": "fd720f6e-64ed-46b7-8486-2235c2b0bbde", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df6ad8d-b71e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762000177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000177, "uuid": "3af1c596-c255-4466-8847-e40a9d440e72", "comment": "Malware payload (Vidar)", "value": "49399934701a452151f942a03694c45f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000177, "uuid": "f3551baf-2f32-4a4e-b18c-3a8cb926d457", "comment": "Malware payload (Vidar)", "value": "33aae69948da0543e1fd4327c33040bf671d7b0b24691e9dc106bd40d8dfc4ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000177, "uuid": "ce1be1b8-162d-47b1-b7c0-6617566fc11d", "comment": "Malware payload (Vidar)", "value": "720f3f1e01e8c6ce78c7610315a5e6374dbad1df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000177, "uuid": "d7498c76-eee8-4b10-be98-bb798046f28c", "comment": "Malware payload (Vidar)", "value": "6d99b823b357865fecf909656a0a2476fc889920637c15a426de85e31e2b118f084cc6164c77429e7e746abb2455b717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000177, "uuid": "75e3f68a-29f2-4b81-922f-6c9369de62a2", "value": "T1F7D47D39A190D147FA18C0B514F2672DF531707586762AFF09A086A2D95BAF08FC93EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000177, "uuid": "f041c2e9-f618-4066-b904-6ba24f48c1ed", "value": "8b5b4c53b93d60ef91e478905d3fbdc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000177, "uuid": "8fc7e71f-415d-4356-a491-fe5ba88d43e9", "value": "12288:7/+7mApqCVWVy4ozM3EIHCzaDbQxSd35MJWoF5GHu2b0uKjQDMHrO:7/+7mA8CVWVzoIUubQM5c+X0uKjQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000177, "uuid": "7c047fb9-8a09-4355-8ac0-331ed414616a", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000177, "uuid": "7cfc448f-cd57-47bf-baa1-359066e89004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000177, "uuid": "2857faa1-687c-4a94-80e4-79fa44983279", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7072a0-b6de-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761972743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972743, "uuid": "339e80b5-0901-45df-8233-64003337c96c", "comment": "Malware payload (Mirai)", "value": "feb9715b179ff9c00f3d21d0119db023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972743, "uuid": "4107183d-5fd9-4ad8-970b-fc0f8ab9332b", "comment": "Malware payload (Mirai)", "value": "3729d836d1d52c72cf070f719d69ac8686d07c47257d122c4cf1060c0fab9727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972743, "uuid": "ad64a86b-ecf0-4243-82e4-6ec8acdb496e", "comment": "Malware payload (Mirai)", "value": "087001a0b1ff4c75f4c92872a151f832268d8686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972743, "uuid": "84f7f94e-c3ae-46f4-8958-70f0bff544f3", "comment": "Malware payload (Mirai)", "value": "48cbe81e8372393b51b71be5fafe850003746eaa934b5ce27494b07d00ebcbbd081f45184c6f2c7e6ff22ea6f1e8ceeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972743, "uuid": "7662805d-df09-4941-8ad0-9b49b41963b3", "value": "T126B3AF877550B9AEE0A85D7FC4134F3AD7359FA019831B2D21BCFA905E7A3907392E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972743, "uuid": "62cce276-3c84-4e52-9575-51fc8de3085c", "value": "3072:lr4VDYRg7+WzfyQp/GAx+L7pX5gbax6IALy2wajXW16iSaWqu621J+C8tl75gZ6w:l4Dug7+opuTpX5gbakIALbwaC10aWqun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761972743, "uuid": "56c9ccac-81a5-4e08-80b4-65b820df4da0", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761972743, "uuid": "89e62dab-a079-46c6-b793-afd995762bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972743, "uuid": "837eccab-5458-49ca-8db4-93ecf70eae5c", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1aa3a7-b74b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762019558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019558, "uuid": "824f54b8-4668-4b6d-8212-f5f5448be9b1", "comment": "Malware payload (Mirai)", "value": "8ce9ef22cba6441f189c6ef92c64d700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019558, "uuid": "8b25896b-616c-4146-bba9-50fe948153e9", "comment": "Malware payload (Mirai)", "value": "373c9615fa0e3cb0999e89ccb15da563373d19e714795492a419b3bfe1ba9254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019558, "uuid": "58ac3f9c-b753-47d7-a149-6de4451e36ac", "comment": "Malware payload (Mirai)", "value": "3561233b7e29f8077f4ef125f1711daf8acbd193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019558, "uuid": "641ee115-7632-4943-a19d-adc7649604f7", "comment": "Malware payload (Mirai)", "value": "43c0b262e72616979a15cdd6c26e77ff72ae9924ab21c41d70f22ed76836276fa98ef94a52030651f62ae7cd00311c7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019558, "uuid": "68cdb20c-2b6d-4492-bd95-cb28e0909ef2", "value": "T17A83C61B6E219FADFBAC963107B38E21935C33D627E1C685E15CD6011E6028D646FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019558, "uuid": "9ca1a925-6a66-43bd-927e-781f06a08caf", "value": "1536:OZibUpZUpzhmxQBBFijd+WdMYmXvsa3eeHsaOmtR:OZ8qZqzEiBFijgWgXvsaGOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762019558, "uuid": "bffb91e7-9b51-41a4-abf8-2b68c628efd3", "value": 84432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762019558, "uuid": "72d6aa66-b73c-4a76-86fd-c031a3da9000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019558, "uuid": "ab19d665-f996-406e-8126-af816ab54975", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0597de-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974321, "uuid": "1a201242-e0e1-4be2-bc75-e70618160d10", "comment": "Malware payload (Mirai)", "value": "ce9987718d4b5e948b88719685e4578f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974321, "uuid": "163d0acf-1aba-4724-bcd6-b42f6e6d68a4", "comment": "Malware payload (Mirai)", "value": "37a091ce204d23d7465375a54ee37a6f22b863397d9e6475db07d404b0894063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974321, "uuid": "45f1e59d-601f-4f48-ab9b-cd38dad35803", "comment": "Malware payload (Mirai)", "value": "8ead2c687da7de87cff43d31690292d73ea0c4db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974321, "uuid": "9850e942-95c0-473e-82ef-0707cf7e438a", "comment": "Malware payload (Mirai)", "value": "cc85ff577006e4d9d7b977d8db0701b68d24601a2fdda067d551a43cb36165efd54f7905a457c041d2f0ec87693bbeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974321, "uuid": "8cc55e26-1161-44d1-8265-61d2dcc45448", "value": "T1C4D35C46FA404B13C0D51779B6AF424E3322A7A5E3DB730699249FB43F8675F0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974321, "uuid": "e0b2d18a-d1c8-4778-b4d2-186edff29d14", "value": "3072:1BjYCRV2AuWr5F6jfwWERCCdKTjgM/9I5hf4:1BjYCRV2FWr5F6jfPEXdKTkM/90f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974321, "uuid": "d21fd7b1-e21a-4646-b6f0-c19860fc01b4", "value": 139353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974321, "uuid": "42e6ecf0-5cb6-4a44-8232-503fc603f26a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974321, "uuid": "de1b3cf7-8a3a-4855-a7fb-6f22e052c24a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9b6674-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761990165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990165, "uuid": "ec5f96a0-83f3-4763-9733-43ffb9e7edff", "comment": "Malware payload", "value": "2d3dc23c96eb977f613adb3491985c20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990165, "uuid": "cd30a725-382f-4da2-8b56-9f5aff0d377f", "comment": "Malware payload", "value": "384bca5ea8ec7daba762251d5e88e6e049e346ebf2b684db2380c2143971eb71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990165, "uuid": "fd1cb57c-b844-4c9d-a92c-700959ad36aa", "comment": "Malware payload", "value": "e97f6db1c1ef5ad101859155962dc1d15d41606d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990165, "uuid": "4a2c0146-369a-481e-a388-e4f5d788d3f8", "comment": "Malware payload", "value": "1592715bf9aacb2a81f2d2a0b124dd2eeb80291846fbc82a7d5f498913acc6285b8f3676fb1662c2dc176829bea4044c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990165, "uuid": "98690a5b-dfa5-484b-88e3-66a6f696e0f6", "value": "T103E63359B870A5B2E261943067A28F3AB532F1D8D367361F01C6A3E43CB7F79562D870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990165, "uuid": "a0d052c8-2504-47c2-8f60-3c4b883c5dbd", "value": "393216:G3cKBia5YbXHUTnRcaBlSCx7eZS/WhLdkUbahpk:7Kj5YbETn6nCx7eZS/WgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990165, "uuid": "0ac0d26a-5274-41d1-b4e9-e2c9eca4342f", "value": 14315232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990165, "uuid": "ed5e18e0-b6f1-44eb-8b48-9484759a3350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990165, "uuid": "d5954e68-1a72-48f0-94b7-10a6d9878c7c", "value": "whatsapp_stealer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d9e34b-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761989055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989055, "uuid": "0afe31a7-b9f0-4510-b832-b80ec7b6cbb2", "comment": "Malware payload (CastleRAT)", "value": "52ecba80f6b8474761c3dd7436c978dd", "object_relation": "md5", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989055, "uuid": "9c74e97d-cfc9-4da7-beb5-4317480975f2", "comment": "Malware payload (CastleRAT)", "value": "39b40746de01af66c0e5ce5888df4c42e474adcdb4301275b1474423d7a0ff1f", "object_relation": "sha256", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989055, "uuid": "6ea40208-8a40-4d8d-9f7c-927923e36fbb", "comment": "Malware payload (CastleRAT)", "value": "9dc6671610808cbc542c35a9807818bb784c06b3", "object_relation": "sha1", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989055, "uuid": "e13aec03-dda5-4082-9efc-1cea55a77e46", "comment": "Malware payload (CastleRAT)", "value": "188bb8661276ab8f170792fbe115f6d600ce255b75b766d8304e0c46b804f25e2b2206ca3b3c34837b4933c61cb08150", "object_relation": "sha3-384", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989055, "uuid": "d2c62366-0d8a-48fe-b109-87a090ad7572", "value": "T15FD64A7B76A18669C35DC13AC0A3CF05E83370B91733C6E793A412686E569F45E3EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989055, "uuid": "31a57538-1cf4-4722-8c19-17f70002bf0a", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989055, "uuid": "d678f9ba-eafa-4c0e-b788-2a3c53c187ae", "value": "98304:0RkyhrOHMsfh0V2Scni640+RQphefdQI:0nhr/spC1ce0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989055, "uuid": "b0f8f053-2932-41e6-b807-a52feff54b2a", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989055, "uuid": "2d595912-fa9a-4106-8550-70e9f2702d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989055, "uuid": "b28838b9-7a54-4321-8165-4c677cedf0f7", "value": "39b40746de01af66c0e5ce5888df4c42e474adcdb4301275b1474423d7a0ff1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400a20e6-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761988933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988933, "uuid": "ae21d179-75ab-4c47-a426-08be5983fae2", "comment": "Malware payload (Stealc)", "value": "2a12af4791fbf981a6e0970a1f0aefe2", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988933, "uuid": "29a0810f-d400-45dc-9095-f2de0af19b20", "comment": "Malware payload (Stealc)", "value": "3a439af990e46cafde39967a53455741ee2e36c862ce63551d77f33a44d7382d", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988933, "uuid": "e4d64327-3575-4f7b-ae8e-774c37aec7a4", "comment": "Malware payload (Stealc)", "value": "53a4e23d5503ada11f9ccc36cec029f6f4298259", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988933, "uuid": "d967540f-dcc5-4308-b529-7a00d86a94ec", "comment": "Malware payload (Stealc)", "value": "9d15cc475bc446346c742128803c9ecd72c0e1fd75666080907375f661340d60e218e0ff90ef78a7b9cc1ffd3cc593e3", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988933, "uuid": "0b69f91e-8e4c-4f33-a746-2f08ddbbc4f7", "value": "T194963360699D7FECE4969273653383D25224DD303380D48BABB07F1579B12F3BEA8952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988933, "uuid": "0e4d8581-8e1c-426d-9f88-c892241fc7a8", "value": "196608:RRvJ1sSYXKL8epFULaF6RxtOR20eMR1E0uJgEXH2bVBr:DvTYXC4La64751E04cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988933, "uuid": "c4a1b274-8214-4332-bc05-9288b389450a", "value": 9289728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988933, "uuid": "bb31a8bb-a5ee-483c-a127-671532b06994", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988933, "uuid": "d289fba0-4e2b-4aff-8b0c-7a3252d172d7", "value": "SocialGuest_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d976393-b74a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762018966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762018966, "uuid": "f68b0fb0-3826-40a5-9394-9415b792856b", "comment": "Malware payload (Mirai)", "value": "d9bc7cbd6b3376e643ead9573022b2fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762018966, "uuid": "170fcef3-b95e-4913-8716-5ad081a8fef0", "comment": "Malware payload (Mirai)", "value": "3c9a9bb3ff0bb8567ef626a0822f78bc10a31124b882aed4cf7dc8fd45aba252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762018966, "uuid": "dd764f83-a675-4dd1-9cf1-176df43439d2", "comment": "Malware payload (Mirai)", "value": "53baa348e7f901a921a676dbc9cd97024f88e90a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762018966, "uuid": "d2ac1014-ac2d-41e8-bad0-c3a69a891edd", "comment": "Malware payload (Mirai)", "value": "4dbe96b288670f8be257fb08f29e1304947d3f8361e56751c9fe5b54f96463ef3babd826f7eeea9ea8f5490d9d8c8cad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762018966, "uuid": "e5d3c5ca-d1a4-426f-8532-337e4e490b8e", "value": "T1CF534ADEA400CD3CFE4BE67A8C1A4B05B625731566920F27E7BAFDD39D310A48D1B981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762018966, "uuid": "2504343f-aae1-4193-8cf5-d3a8a8c8e857", "value": "1536:145l43Mxo3B4OU8xtJdOYDDDDDwwCRCGSJYv9qDxny0b8eMHaTPm:1cl43lBfxvdOYDDDDDwwCRdiYoxy0aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762018966, "uuid": "abb9c1fe-a487-4ed6-a148-1e0622181517", "value": 61664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762018966, "uuid": "cbcb8aec-7d9d-4769-ab7a-ad9ba0e4b4e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762018966, "uuid": "204baaab-1759-449b-a322-3b9c655dc2ac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25cced2-b714-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761996104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996104, "uuid": "87d89105-e30a-43e8-83c3-bad6a640a1c8", "comment": "Malware payload (Mirai)", "value": "084b32058e3a29abc7b344bf7b7f2142", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996104, "uuid": "c3234e78-85c7-401c-a3a9-d7b6d99b6cb0", "comment": "Malware payload (Mirai)", "value": "3da260c33a5ad5fa723becc8d4b6f5105ab06118d78d501999d8851e588444b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996104, "uuid": "6588f0fa-3ab1-4bed-a53d-56ecc585dbe5", "comment": "Malware payload (Mirai)", "value": "6de95efd1260f2fa017bd39b3eb4074cb7ef85c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761996104, "uuid": "8d143e7d-4492-474c-95f0-64bc5200acce", "comment": "Malware payload (Mirai)", "value": "e59eadb87cae6d75c9d38973f16fa2cd9fd5c32dfcc60217d3856aecc06dbdd0656e374670f7a95ad7d734ee17612f16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996104, "uuid": "a342ff79-54bd-4532-93a4-9eb6994b00be", "value": "T170012D461870C6E1CE45E7AA7C700D5AAD1CD38161811BD6F68B1FB5A5CDA14B133F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996104, "uuid": "fdcc2d5a-0ad3-4222-b4a4-7d8af8906c93", "value": "24:oSbx+XSYx+XSJx+XS3x+XSux+XSfx+XSvsx+XS4sx+f:dbQiYQiJQi3QiuQifQikQitQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761996104, "uuid": "5a76e318-dcc3-44ca-b540-ecd6128b6249", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761996104, "uuid": "e6c759ad-6974-4fe9-b01d-24ff892f6c6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761996104, "uuid": "adac924f-35de-4da5-868c-86bf93664fac", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c59b42-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993046, "uuid": "2bf76718-1571-4599-89e0-42407687e357", "comment": "Malware payload (Mirai)", "value": "d5bc55a88e3192a836d44d8160cfa610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993046, "uuid": "e6a2051d-2f6b-4549-850f-394f6a6fbed0", "comment": "Malware payload (Mirai)", "value": "3dbe21f61d6f1107563508b130e9a66bc257053bad3dffff14a44a77f0965f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993046, "uuid": "2e840c1c-e0a3-4974-9beb-7d31b1786fca", "comment": "Malware payload (Mirai)", "value": "8613d36ee405cbade5ad94c164cae35ebda48f9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993046, "uuid": "4bf11ea7-fe4f-463d-930a-c45dda2192a1", "comment": "Malware payload (Mirai)", "value": "2e8f6fda951375f7a0e0f147e4f6226b7fa3f993933afc6760532cabfd9430a15847a6e9eddad8664c890fde372c2609", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993046, "uuid": "ac20fbea-143d-48c5-a16a-41c2ddb49dbe", "value": "T1AF633926BD360D17C4C5A87A21F34768F2F1538A26ECCA1E7C620E4EBF2465071976F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993046, "uuid": "638867ea-7b71-486a-8161-597db4e7a379", "value": "1536:n7pjgMiNvIou4hfpJDd4zroklinrntF5VjotUt0tb:7mMiTfh6N0rt3ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993046, "uuid": "dd00affa-fcc6-4229-adbd-9e97b09ab04f", "value": 72740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993046, "uuid": "8ce4049d-a98d-4ffc-ad79-c6073994d374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993046, "uuid": "d3beeba6-820c-4ae0-b802-4f52c1bc99cc", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5834015f-b6e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976518, "uuid": "d959c67c-ffcc-403c-b4d1-94501225731d", "comment": "Malware payload (Mirai)", "value": "69ff01bad7ab2ef6d65e53cab220398d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976518, "uuid": "e8103a8a-b2e8-4491-b661-00553f68d16f", "comment": "Malware payload (Mirai)", "value": "40f61f609505c6410faec1fda78dc9b43f3d4f9fa7f648ef95d925caa0d4d69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976518, "uuid": "7725f012-be2f-422b-99a9-1c6d0fd5efe4", "comment": "Malware payload (Mirai)", "value": "7779661706a7c5331fbc49d01ce15f6fa3065cec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976518, "uuid": "6c91c351-f79e-488c-b3cb-2cbd4f07f7fb", "comment": "Malware payload (Mirai)", "value": "9119b7261f3bf8b24ca7863330bc65bc2e32dde4d7870b00f7469ff3f74267c2891173406ce95d279d78c363e954a9b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976518, "uuid": "29fee0fb-232b-48dd-9790-0a667133de80", "value": "T1855312E612B17725C5500AB286A953FED54E408AFF63A0613B88DF02558A32373CDFDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976518, "uuid": "75db60b2-7d39-4910-8292-73284ac635c8", "value": "1536:STaW6Kc9+blp+H30XQghA0jUpjoeyciD5/Lkg4azHA:STkWDu30XQE3UFo5V/LGazHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976518, "uuid": "ada5cd87-d6bd-4d51-8170-cb1beeacf4dc", "value": 61712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976518, "uuid": "2d5eafc1-247e-43e1-a7d4-776fe18912cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976518, "uuid": "9e5f4814-c651-4eb1-8837-58929522f5ac", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e4e5c3-b713-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761995272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995272, "uuid": "1a385b9c-e223-4aaf-a515-ad362d6277fd", "comment": "Malware payload", "value": "5775679744492f27af80445e7a8794cd", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995272, "uuid": "0b9828c8-99c5-4cda-8c0f-10ec47ea5207", "comment": "Malware payload", "value": "413340b933dfb987b46a0780eb9ecdc1689f50070b5da818576eb36064db4e49", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995272, "uuid": "d9125994-f08c-4b7b-aef3-54839a0352ec", "comment": "Malware payload", "value": "578f914b200d0fb20d427102fdc0c00e5f9cd4d3", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995272, "uuid": "f1a378e7-afe1-40f8-a45c-a3146c4b47c8", "comment": "Malware payload", "value": "705ee65d7bf80dfd2134532e8b4d60fcbb3a2b1a7562d7e246cde0997adfeff105020ed2952763c2e59a1452fb7650d1", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995272, "uuid": "c64aa6cf-31a9-4a6d-a655-7686a59bfa15", "value": "T19931C919CC861498F930B4B582E3C4E1DF30B15F16886DD69442AE07152D87869A9F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995272, "uuid": "b923b325-8030-483e-850d-53a441e0d970", "value": "48:95+Ds6pdR58rq+cmfEkNwNHtVBi8orOMzO1+Dr:v+DJt58rqR4PNwNHtVtmOMzs+Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761995272, "uuid": "d356d65d-2f8f-4a0e-a218-d31860cb89fb", "value": 1798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761995272, "uuid": "b5623309-6ec3-4b55-813d-ab80b561ba45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995272, "uuid": "7d98ab0b-cac3-461d-9a70-b918409a352f", "value": "5eab8e18eef5a2eb476e0bf998b7dbada9f000705ffad541d3f929aad48b0f67.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a5a496-b6e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976238, "uuid": "dca14ca7-df48-4d5c-82df-73698d044787", "comment": "Malware payload (Mirai)", "value": "b80d34c096777a27887aa124df4b1086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976238, "uuid": "1ded5322-7427-420d-aa7f-3aab2d0af2d9", "comment": "Malware payload (Mirai)", "value": "418742d0e8d092f307b9225a83bd87c3fe3f3aea53b8beb2f5eac1e1c65088f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976238, "uuid": "2a898816-823f-4810-add8-c33f5121df6a", "comment": "Malware payload (Mirai)", "value": "419f93b1ce935f5df231c19e7897dcf45bbfe1a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976238, "uuid": "5a577b24-4668-417c-863d-9fefa886b30b", "comment": "Malware payload (Mirai)", "value": "40c4c40af6c0e2687b6eb1e9e6387a4b5a2a677a7e3acd5dd73240fcbe7631a093c4837a504712280aa2b55033fa25e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976238, "uuid": "fe0988ec-356c-4d89-8f57-f3cb1101e6d3", "value": "T1AB14D60ABB510EB7DCABDD3706EA1B0138CC641722A57B353674D918F54EA4B1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976238, "uuid": "ae82906f-e3e1-4cce-b121-3acb2bc1d038", "value": "3072:Ynv3ZBnajAfWwroQ5f0uTGztyp3/iSF880ljA3:Ynv3ZFajAfW7EfnTGzqviQ88GjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976238, "uuid": "a24d0198-793b-4561-9ce2-50c8d1c0aab3", "value": 201820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976238, "uuid": "89780af1-2dee-41c4-8d85-a988816f1067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976238, "uuid": "1bf5b426-3ff5-497d-9433-c5473e9be059", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cf7abc-b750-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762021665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021665, "uuid": "cf0b0fe5-7552-462a-bbd1-03d458390379", "comment": "Malware payload (Mirai)", "value": "423914b0864fadf5004a3e8c3cbb776c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021665, "uuid": "9ab7e25f-90b5-4ccb-801f-53929addd0e2", "comment": "Malware payload (Mirai)", "value": "42070f4fa57f635b4a0d8dc5a6a3587521f67370bce1b3b2e510225474473107", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021665, "uuid": "60722b0f-59f1-4257-940c-2624adc5a3c9", "comment": "Malware payload (Mirai)", "value": "aaf603c73480f11e783c101382079c1d2506cb82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021665, "uuid": "2288f13b-0fae-4984-b6e0-b83f68ba5700", "comment": "Malware payload (Mirai)", "value": "d83ee46a93aca57da93b563173cf952811d90988904b8de0baea35c2c3aaafdfd527be0d1f84e4c5b7fdc9db563bd66f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021665, "uuid": "ac65b795-4f68-458d-9bb3-0ca235ffd41d", "value": "T13EE2F178728A4980FBCC6AB73C49EB4429038E6B96E9885688E7DD057D374D4F72CC71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021665, "uuid": "28aa9f0a-353a-4093-b1c1-c648ae1d65ff", "value": "768:GXukRhsI63wGtGCAAbSRt7EN05Lei94DgXYOTyByXSdZNS:rjwG8CAAbSXgN0liOlXufS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762021665, "uuid": "4e879ae6-2c16-4985-9b97-723ee9968d7d", "value": 32052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762021665, "uuid": "d33105d5-5257-4d27-8df5-06104dd63303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021665, "uuid": "370df08d-c3c1-4ea9-8693-698c4b926e02", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6bf384-b771-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762035931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035931, "uuid": "e801d947-7bda-41c0-8971-5f9597172f9a", "comment": "Malware payload (Adware.Techsnab)", "value": "19cec488170000e2086f0ba3aa3c1572", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035931, "uuid": "0aa763cf-7ee8-4f06-8261-04800a784714", "comment": "Malware payload (Adware.Techsnab)", "value": "432c5cb8f3698c91cb5b86e5d949861dbfe9b777561eed114080da62d1e7b971", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035931, "uuid": "d989f3e2-d0c4-4295-ad04-7bdf60aa6d61", "comment": "Malware payload (Adware.Techsnab)", "value": "ef0fbefcabdf850260354e57d7e3a4786ced7e03", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762035931, "uuid": "c92b5857-961c-4801-ac66-1d4fd942194c", "comment": "Malware payload (Adware.Techsnab)", "value": "356ae1cfeb5810bf90754064b9e9d89c442def167684a63bb1b5bff7d51bf6fb65d3b38bebce2624f0e40986608d039a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035931, "uuid": "2f32f155-a433-48c7-aa0f-674d005a50ee", "value": "T147267D06F39481E5C5ABC2B48A634217E7B07868473097CF1650EB662FBBBE1693F315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035931, "uuid": "0a25b684-0326-4a07-bdd3-2423eb848f98", "value": "49152:qV6aOk2W3AmsPwVLo+UzmUYzfdVZI5IP+lB4YtevCOWQ4ivPC6kicc8lf2q4vLsp:qV6BWw1upCOW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762035931, "uuid": "4fd84ebd-a6fa-45e4-a8d7-4486240a599e", "value": 4485632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762035931, "uuid": "0df3234b-d8f9-46d4-9a83-76779183ed1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762035931, "uuid": "411ad855-3d7a-43e5-afe3-1bdffa354b64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d494174-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761990163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990163, "uuid": "9d467c92-1290-448a-904c-5ed0a7e7dd00", "comment": "Malware payload", "value": "a292aa86e3e26bd8eaf9d18cda9733b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990163, "uuid": "ec2be1c0-debf-44fd-9117-7066bfd13f73", "comment": "Malware payload", "value": "43ad3d21e60499d0bc68768df7955ea1d95e98d6b56fde90c608ff8e74861d4a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990163, "uuid": "5135724f-74fe-4a43-887b-86e5681c5652", "comment": "Malware payload", "value": "c1a3c8d1c402125dddf4b84d46596ac7fb7bcd76", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990163, "uuid": "ca885071-d393-4bad-a41c-84bf0afd9bd0", "comment": "Malware payload", "value": "c57013af27d333b409c04d87493863b792651b6884a434c427f68905e3e771a3725cd8b5504ad5c5db396481af58a8f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990163, "uuid": "609d8cc8-b022-496b-92d2-bff47510f52e", "value": "T183C08CD1443DC072923A0A5EB361E2F4DD82A8380FB038B2E4198684B1B40702C8F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990163, "uuid": "4a15c153-61e1-4394-8fa5-5f996924e023", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfkE2LItUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMf8TebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990163, "uuid": "ba7af927-7274-4c00-b5be-37c18db3aa0c", "value": 171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990163, "uuid": "bc694a26-7279-4ebb-b1db-de7ee60f1b54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990163, "uuid": "7a8c2076-2668-4434-9de0-b8a39e82580a", "value": "2n48bg1bgb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfea4217-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974598, "uuid": "da03a9a9-e636-4c49-88f4-6738f9345f07", "comment": "Malware payload (Mirai)", "value": "4c84e36d6e70c852f383e40096955719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974598, "uuid": "3618727b-5334-4ad1-a2a1-2a2cdc2c9443", "comment": "Malware payload (Mirai)", "value": "43c0bb55c2a13c2bf5ce2ea07e2f22da0c6d04a84d67700c1c1310fa916c9e2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974598, "uuid": "37a89748-d66d-4a96-8d0a-ccd71a2a1ff8", "comment": "Malware payload (Mirai)", "value": "8291f1b972923d26f17ea90304bec851561adf62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974598, "uuid": "38a8698d-3d56-4f2e-b2ff-5d5e7417e85c", "comment": "Malware payload (Mirai)", "value": "f5088ec36f2f757e08eb622ab6ac1f9c7cb7b1e5f4fb4f31480cb866564a235d1e04e3f74b370c6cbe2d3a595514bf9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974598, "uuid": "7b73ba0d-114e-4290-8300-48898a336a38", "value": "T1B7330132B61239F481535A339BB9C10E73931D6CD19F1188E17A4A34F7E6C1E0A7A5A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974598, "uuid": "0665f2e4-6bea-4c32-9119-f58eba457f4b", "value": "768:X/xTtw8rhquZ9x4/l+Zj/F9zjOFmM9pIMmMhH2aVzs0VRpROHyCA0LdtT4s3Uozs:JTtZUGK+LysM9pIMAaVzvRp4yCXDzksU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974598, "uuid": "ac4bb548-7411-4839-8b50-8e68d496af27", "value": 53100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974598, "uuid": "8807bf20-496e-4ccb-b07c-cf40e8d9a0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974598, "uuid": "b6f33118-b067-4f0f-a035-27452d815f26", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18362e19-b70f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993590, "uuid": "189e3718-016b-4de3-90fa-d0c5b68c959c", "comment": "Malware payload (Mirai)", "value": "6426b49d5cfd1b45dfe85a54c107a432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993590, "uuid": "8296eac4-b80d-4335-8d56-0baf8c8d3d64", "comment": "Malware payload (Mirai)", "value": "452fb0bf900b2abfad9b3ddbec4b6f4a46dc0f7305043d5a18514359d5fdc21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993590, "uuid": "c869d1e7-2188-45e3-b0fe-1b7a4238913d", "comment": "Malware payload (Mirai)", "value": "4098e177d63d7f9408b463f6cc902344925a9874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993590, "uuid": "3caded01-0b2d-427a-9b7c-709ed754e707", "comment": "Malware payload (Mirai)", "value": "a286088d8a24a908e8eef33a48682d671b610ef9075aac8b8229582e3b36ba1bc70d7ae2af4b80bc1a19ad2020e114b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993590, "uuid": "1d195885-cd7b-478e-a75c-9de639e7a348", "value": "T115B36CC2F743C0F6D85305B1507BAF369E33D4BA5025DB42E7689A31DCA2A05D71ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993590, "uuid": "c8bbfa8a-33f7-478e-94d7-816c0a3e709c", "value": "3072:EPian1DTlim4EgPg1dRP2V2Zsv1hIB18eJ:Eqan9GSukZsvoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993590, "uuid": "ee0bd50f-dc93-4373-a41c-2a15ccb3f954", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993590, "uuid": "cb44d355-d6c0-4d3f-910c-16eb28af9bb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993590, "uuid": "c7a82d42-0169-422a-a329-36bc733a202f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93afe03a-b6dd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761972323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972323, "uuid": "8700a36b-bf2c-4b9c-a4f0-4d9c89edc8d8", "comment": "Malware payload (Mirai)", "value": "046ec9fdd0b7b473613157f3a534cc7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972323, "uuid": "33e75bc3-5ccb-4422-9db9-c912e3bf648e", "comment": "Malware payload (Mirai)", "value": "470e62d240068b8cec2654aa37f6edcd7cc03522b7dab8f177549d242498512b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972323, "uuid": "d08bdfed-5e48-4529-a016-bcdb0e008a7c", "comment": "Malware payload (Mirai)", "value": "3b63154396d531516d7ba9d7c88506c0aabdc262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972323, "uuid": "7af498d2-cdc9-4c00-bff5-b8e854a740bb", "comment": "Malware payload (Mirai)", "value": "c7417e36d702fe0d4b46570c3897824d2ca26e3a7ed38825bf26ddaf60d63849315b3e420469bd47b32e954634c1a002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972323, "uuid": "d714b614-393b-42fd-95a4-7ae4967b79b6", "value": "T175B3F194BA11FF56C42A22BCB0870A40A3F15EBA5B96550B5463F6742DB8CD43F0FEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972323, "uuid": "c9182230-eb66-458d-9e7c-571d2ec81920", "value": "1536:h957Qm1qyQgWRGY77OVP1xVPqlMRNl375eepYjZKDJ5SVabSRppGpcwgFluXJFQp:xnGgWTOVPqMRL375doct5SoeGqwuYQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761972323, "uuid": "e431e60f-a96b-48f8-bad0-2471e37f72de", "value": 111776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761972323, "uuid": "48520439-a7b0-4c11-b0d0-e65c1fcf224a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972323, "uuid": "126cacc9-8bce-4a6b-8bfd-ac4122cbbc8f", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb847dfd-b729-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762005058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005058, "uuid": "ac64be40-1654-400f-bfe1-bc37bfc988df", "comment": "Malware payload", "value": "64614fe0e98a36d6d202079a56f765cc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005058, "uuid": "bf86391e-1e11-44c7-8fc7-d0ebe476a90a", "comment": "Malware payload", "value": "47ca2f708cc34ec618bf492a887508826a12a2c23a356905999f5ba4a3ff9b4d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005058, "uuid": "4f042749-ec3c-4d46-9091-5d304ef0277e", "comment": "Malware payload", "value": "560f8e49565048cda926ff7bddacf3b53f3a9365", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005058, "uuid": "19600b36-0bb6-4349-b1a0-39d3a542dd59", "comment": "Malware payload", "value": "7c9a6f33176d2eccf03141185bb72c97642f611d33c0fa42423b466a2cd93f2da74918edd5433762d0cf72ee2134c1b0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005058, "uuid": "3e3652b8-78ab-4f71-b09d-6b99b91b7170", "value": "T17D57238BF3C9A55AC4F79332C5366BA150474C268B43EFC36964363C29B76D45F0AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005058, "uuid": "cef9b9fa-2909-4d88-a130-94b968b943df", "value": "786432:YaIsjO0B9JAtVHz1IGTmBr4lwwIp4+HrytRzgCWBzPqrwVCI:HzjOs9an6UiwIp4+Lyt5gBBIw4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762005058, "uuid": "84aee8d1-75dd-4a25-b6ae-ee8f74c9959b", "value": 27275961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762005058, "uuid": "dde045f6-c03d-4f6f-a478-c0c1c2e78088", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005058, "uuid": "048e0be1-a9ff-433d-8d80-e7cf5c165aea", "value": "EngelVoelkers.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4567045e-b74c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762019865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019865, "uuid": "27bb32f5-e655-4e7d-baa8-e6d1db42f990", "comment": "Malware payload (Mirai)", "value": "5e1c523615ce065d1e38dd1589bf52e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019865, "uuid": "015ff593-bd5b-4ac2-9a75-88d3c46498a8", "comment": "Malware payload (Mirai)", "value": "47e7b9e695931160567400a7c2082a87bd545b1fb110574b7db34251041e195d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019865, "uuid": "4dcad5c3-5f96-4c7a-b042-3499b7ccf94e", "comment": "Malware payload (Mirai)", "value": "7064ba2ba0dc1a7096577ee12ca17f1d259d31db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762019865, "uuid": "d27aa44b-f3e7-4694-a6e6-d3bdd33be8af", "comment": "Malware payload (Mirai)", "value": "255efbbf1728f978b8af4bb1dc10749469d9d8390832ff4a961f7c70a70807c9abdb39a0b05d80e3173e335ec320ab9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019865, "uuid": "628dcc83-0a62-41f0-82c1-43121dccd7a3", "value": "T1F7438DB3C415BA54E49445B4B8308BF55713740082772FFA5AAAC5B6A08BEFCF2453F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019865, "uuid": "e3727b7d-8401-4004-bcd5-7eef8d957967", "value": "1536:3aloJFOGDdysgtioyKe4n6FXFyCBCU8H:30sF7sise5XdBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762019865, "uuid": "4117395a-2daa-40a5-bd0d-b21a9bff5c59", "value": 59540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762019865, "uuid": "be13fbdd-7d77-4db2-a73f-fbe179d5bae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762019865, "uuid": "69af33f0-982a-48cb-af4a-aaee7e8d37d8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ed9065-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989078, "uuid": "a64471dd-f388-4f50-acb9-26203c80b4b6", "comment": "Malware payload (Mirai)", "value": "51b16b786a16704ae57c26154d715134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989078, "uuid": "49f5361d-a638-4764-a70c-4cb3d516b8e2", "comment": "Malware payload (Mirai)", "value": "4977228b7511a1e01d4b572329fddace5abaf2796716db1996c8db5a0334a4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989078, "uuid": "401ccddc-4644-440a-9008-7207399fb299", "comment": "Malware payload (Mirai)", "value": "90c870a944476146b5034f0e8f02451b66063c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989078, "uuid": "d9a6aefb-c6a9-4f29-b4e4-b7a0cccf07f5", "comment": "Malware payload (Mirai)", "value": "8c47a2a65e817f5a05a952eaebb81342f76863131115573d649c3eacb79475d63f641cb4531a44d61b56c583c2d11917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989078, "uuid": "ede8b634-f473-411b-927a-92c0e88e905c", "value": "T102431B95F802DE7DF80FE67944164D09BD3063C261830F2727ABFEA36C720A66D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989078, "uuid": "c75a2d63-0e9e-45df-a214-464b2d54349d", "value": "1536:/+dosTdnLbVuv5tQjaXnb7f98V8TWl9ouSQy8fNLsA:270QjobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989078, "uuid": "ef98e37e-91ed-46ce-9a2d-313e09332ec1", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989078, "uuid": "5792f9fa-709d-4d27-9a9e-d39bce58c5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989078, "uuid": "349f0a83-2390-4564-a3d3-5a2f8c9d337d", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b64488-b6ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761979359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979359, "uuid": "a57f4a17-64ef-45a6-aa48-978eb0426b74", "comment": "Malware payload (Mirai)", "value": "83554d0add3be62da15ef426ab2e1ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979359, "uuid": "903089ee-0145-4f58-84b6-bfbc41153930", "comment": "Malware payload (Mirai)", "value": "4c03fb3c4b33d8d2b86fe63a9d2a7bda49c3314f7395e68ee9e93a9347db7a18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979359, "uuid": "95fda772-0ddb-460f-91a4-2fdc61ae2810", "comment": "Malware payload (Mirai)", "value": "d7370e0ec1ba16c47e20d68b066106b22239d586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979359, "uuid": "eff2bb41-f35e-4aa8-8376-91ab2503f176", "comment": "Malware payload (Mirai)", "value": "048076bbf7db2badbfa15aa2da07610bf60a5bc6b565663363bbb104a791e30c839a63d18ec47999d0f3a03070293c1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979359, "uuid": "21adb7ba-1e78-4c82-b72f-0b803cdb881d", "value": "T184D3530EAD215F2FF62CC33647F7CA64A36523D723D2E64AD25CE9201E6434A542FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979359, "uuid": "66b274df-a696-443e-918a-5b3c92a9908b", "value": "3072:aZQw51Om8cUZ2H8VDbbdWfYvJQl4MdEjA022l9BaH+Mqx2Wk:aZQw511IcgVl6ZOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761979359, "uuid": "f7185531-2db2-463b-ab7f-cdb043c9559a", "value": 136312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761979359, "uuid": "a589a21d-979c-4037-a3a9-392b4803b719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979359, "uuid": "82adf6a5-e82d-489e-9f12-0923ddd7eb11", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1561c147-b6bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761959226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959226, "uuid": "ab6ada32-5ee2-4830-81c9-d7e6271d6ae1", "comment": "Malware payload (Mirai)", "value": "36707c2b200efe9497c02734a16b9b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959226, "uuid": "684211bf-a6b6-40e2-8c7b-3245a25cff54", "comment": "Malware payload (Mirai)", "value": "4e997f03c9b5cb2d5f7dbf5c1867954208a1b098fc02ac402db8498018a5948e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959226, "uuid": "16b816c5-8dfb-4a3a-a851-5981ae72b32b", "comment": "Malware payload (Mirai)", "value": "959f5f1266879a8173797be1b558efb60279d0f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959226, "uuid": "54f1f910-8f05-4566-a3ff-587916acc812", "comment": "Malware payload (Mirai)", "value": "c24237b5f1b1f851990a7d2148c7e33ffa7b1d442668c5784bd98e839a67b51491050044e16ec566810d2dba157eae05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959226, "uuid": "612a1c6f-8405-4731-a476-2a7cd1525ac6", "value": "T17F532A51B8819A13C5D4137AF6BE428D3B3523E8E2DE3217ED222F41378A82F1D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959226, "uuid": "1d027d61-6013-4f7b-a536-ffa07b3a3358", "value": "1536:NOAE6jZvaFnGDFxk77MIQhPpuuDjJa10yr+:NOAEVQhPpbj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761959226, "uuid": "58e12b30-8da7-4644-9ad5-eb74e25e1a84", "value": 60776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761959226, "uuid": "ad463bc9-c578-4da1-b068-07451ce19b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959226, "uuid": "0aaead10-5065-426c-b81c-eb7a13053dcd", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e461cdc8-b6c9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761963868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963868, "uuid": "9ae84ded-1f63-4716-918c-084bfe9c79a1", "comment": "Malware payload (Mirai)", "value": "09d2206e0ecdd8e6a37fcd4ddbbc217a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963868, "uuid": "11f149d4-072b-41b3-95a2-5b579d6eca9b", "comment": "Malware payload (Mirai)", "value": "4eb5648bb92b5c724ee7d49cdc23580e0953a2a8aa9b0052b2b81a8574df6193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963868, "uuid": "94b3ca89-b4f2-49ee-8578-de2c3f25b0e0", "comment": "Malware payload (Mirai)", "value": "faba88bdc001d52ed243559388fb9650e30af6be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761963868, "uuid": "ddd0b309-0af2-4ccc-aa23-e90643f8e7d4", "comment": "Malware payload (Mirai)", "value": "010fea057dbe2465930387af01d4708ccd1fec7e7095ee818cc4b7174b203b340d3757cb82dcfdac4dcc81ad33c5168c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963868, "uuid": "b7ebfe0d-f966-4503-814d-a7fdd34bab1f", "value": "T115D3CF21E4049DC0DC2105F538BE9ABC0760EE7047DA6682EFFEE95A687BDD4396D270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963868, "uuid": "01b6a9b7-2642-4dcc-a36f-74fd09588b33", "value": "3072:oai6ib2kAg7jGXEaZfcTszZo8vsrHlNV5+I8rw:oLF9GXEaZU9hHlNV5oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761963868, "uuid": "b5557bc3-b720-4a2c-a029-ab51d7b25e21", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761963868, "uuid": "6c048931-aa1b-4ba4-8fdd-6466e3c6eb5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761963868, "uuid": "eaf37926-5f8d-4c5a-b4eb-cda985441926", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fac526-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990171, "uuid": "992f00e3-ca86-49a3-bbf9-2746d97b3d93", "comment": "Malware payload (Mirai)", "value": "778f1ca011906b2c400a6d134e368e71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990171, "uuid": "2fb4c408-e5d4-478b-8745-27a916657cb8", "comment": "Malware payload (Mirai)", "value": "50634eec9b8a84b36c2920394b0e4ac842e5019ef8b8e7953473273f1e70070c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990171, "uuid": "36b6f1c6-5ef0-4539-bdf0-cd3a6a4819f3", "comment": "Malware payload (Mirai)", "value": "648dd51b3d4cc506f99198c70ff9153f4dedea4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990171, "uuid": "5b489482-a826-42fc-bc7f-9e513200491b", "comment": "Malware payload (Mirai)", "value": "ad6b35e77a09c78556b9b214802fd19dae9051e368d7cd97ea484bfb3ded4c1e2297e4b19a34a3558823cb5001bc8b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990171, "uuid": "1fb33c53-74dd-4886-8ffd-f18fed3ef0ec", "value": "T1A293E909FF511EBBC8AFCC3706AD1B0228CC599726A53B767570C429B64B64F16E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990171, "uuid": "6ed87d18-b702-4995-a4ee-0c6386419a11", "value": "1536:khHp/Edw6vhaLOw+/qMY9Njsx+r9ZFalb/RMNhxvCoGO:khHudw6vhchvje+r9cqCoGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990171, "uuid": "25847bcb-2806-402c-afae-3c75c9b14e8a", "value": 92972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990171, "uuid": "aaeaec81-f6b2-42b3-bf3a-c798a5fe4f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990171, "uuid": "9bfc7b0b-7525-467d-89b1-b3ac8db50fcb", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb54b37-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987160, "uuid": "5928f6e1-3d57-45d7-8fb6-2910c37853a0", "comment": "Malware payload (Mirai)", "value": "8072da4a47aa5e5a6328037497875f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987160, "uuid": "3a738aa9-2934-4093-9bac-6fd9f93ff68e", "comment": "Malware payload (Mirai)", "value": "526b937508cb1ea284b7decbe23876594c5ef0694a55882ff266ec80d2358446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987160, "uuid": "2ae44d03-41ec-4585-899d-aa76392954f0", "comment": "Malware payload (Mirai)", "value": "42d44917c8ee5e5c3bd47d46fd2cbd7a1fb30531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987160, "uuid": "14236152-1c09-4610-bb97-6f5122175ef1", "comment": "Malware payload (Mirai)", "value": "46b742d34d2148676ac922d869b43db061110d8ed0ba28ef6ef1c46edb8c9e599fa006e9ed983456a022a39fbe79a863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987160, "uuid": "41d9206a-22d4-4024-9598-25c8f4eb0f08", "value": "T1EFE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987160, "uuid": "706dd58f-4989-4d43-a661-6dc9dc68ce12", "value": "3072:GmzTDH86JG78FenJljAX0Gidw+w9EEVvjbiQLZrEyqKYrf:G2TDH86JOHjAX03dC9EMLmyqlrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987160, "uuid": "5f9970a5-1b3a-403e-a56a-d1ba948a2920", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987160, "uuid": "112247ee-b67e-4c91-93f4-204b6a269c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987160, "uuid": "77066029-b8cc-4191-b5d4-21670e941375", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceed932-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987156, "uuid": "ea8f2663-fbe1-4710-b64d-781431022628", "comment": "Malware payload (Mirai)", "value": "6fff3091a817a64c41e8174f9974975f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987156, "uuid": "dd361611-a290-452d-a5c4-318b7e589551", "comment": "Malware payload (Mirai)", "value": "574223a2f85edc6bb3a425d803c479c2f1c8df4e60b29b516d33e73f5125853e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987156, "uuid": "a6ab4177-ccfc-40b5-a833-14c0b1aaaf75", "comment": "Malware payload (Mirai)", "value": "38bd20b55a3f3fc900a3203229fdc9091f2969b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987156, "uuid": "321e247f-7842-4873-b65b-e57923226a7b", "comment": "Malware payload (Mirai)", "value": "ffa9f7c7909f599d57f6872474f5623ea1e314eefa6fe852ea2b45746ef1b506e71fdd29b17eaa75919a741335c2a128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987156, "uuid": "299a51f6-f711-40c6-af39-70e423066e05", "value": "T10BD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987156, "uuid": "6dd57d9d-e4b6-4c2b-8b43-d4982a01aa43", "value": "3072:79eSuygEPjt6qkWqMdKmDnYMb0gBd/gQyVGsdqml6kaj:79eSuygEPjt6qkWqreH2laka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987156, "uuid": "a00f3ca6-ee84-4f76-bbb7-f5d6f3c9fcbe", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987156, "uuid": "f352d37a-d1eb-4cd4-91ab-406dab5663ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987156, "uuid": "5e5a3495-67f2-4eff-a353-ad87a6c2ce05", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f847ce7a-b72d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762006851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762006851, "uuid": "efa301ad-a636-454a-af04-cd433d6a0886", "comment": "Malware payload (Stealc)", "value": "dfb072d0824cf29caedac335fa67e5ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762006851, "uuid": "58b3712a-cdb8-4684-bab8-fe6e038cdda3", "comment": "Malware payload (Stealc)", "value": "5bfabf2d6fb295f2a958ab0b3d60913705ea44c2555e177ce58c0536a0b9b08f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762006851, "uuid": "47e42c95-d1aa-491a-b762-6a7a1110c999", "comment": "Malware payload (Stealc)", "value": "c2891ef5dca2ba1f55373fef12ab948eb533637a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762006851, "uuid": "fac01954-5355-47f3-a8dd-ce304c714054", "comment": "Malware payload (Stealc)", "value": "f1803a241a00c63fb6dd4e85096f72eb19a39d23a75b2e51baea9fc0ca5567147cc0bd63cd397a2729858115c3b75134", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762006851, "uuid": "1bec84db-3b47-440e-9c57-816d41dde04b", "value": "T1A496024761D497B8F0C68AFC30B5115D30E1DD9994F89A0CAAC6F82236B3F9E146E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762006851, "uuid": "b0610fa8-e297-45c7-b1bf-5c514aaa5b73", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762006851, "uuid": "7914b77f-bf56-4ccb-8369-41ca5b2df8db", "value": "196608:mSZbrPqq4IW2raJL3+zSRa7J5rR+5/uyBfJ7j7FbmGjQa:mm/Pqq9GJL3O2aDlyuyBh/BnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762006851, "uuid": "9d9b1f52-c588-4fdc-8008-937fde6b2015", "value": 9012784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762006851, "uuid": "85dd5587-6891-4588-ac8f-d11880e1d350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762006851, "uuid": "ba2ba229-28d7-47a4-aa24-09817f0ceadb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e585ebd-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987158, "uuid": "fc1cc6fc-04ff-43c5-8d72-f40ee58e0025", "comment": "Malware payload (Mirai)", "value": "a54b8bc9472da2c515dd50e110b339a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987158, "uuid": "c1c92695-f9c5-4544-9f75-1cc0d0ff40cb", "comment": "Malware payload (Mirai)", "value": "5d70d42f0f7d10f42b828df0dbcf49d70889e42c341b1d780bdc97be95ab0ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987158, "uuid": "ed76e3b2-bcb1-4041-85b4-c25a03f8117d", "comment": "Malware payload (Mirai)", "value": "8e332dbc166fdb2b063b9ac2a66d9d0737980c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987158, "uuid": "6913b27f-0486-4be1-989a-5c0f57cf6cb1", "comment": "Malware payload (Mirai)", "value": "47a699fd53f59aefc39db311cf0f512b8576d3e0003774259f4a93a93b9f89a1a9ca184b7f65bd002d91d025f2f7ca5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987158, "uuid": "88d287d4-9f23-4dbe-b90f-2994e3c56d9b", "value": "T1D4B35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987158, "uuid": "4f2988ad-78f3-44c9-a272-1a0bc3fec072", "value": "1536:OTW/VCxsHZusN2Li62C87mKjR5fvPVWARouW8j3W+gJH7F:OytCxsNx62NVjzVWxuWM3byB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987158, "uuid": "ee49081a-c12c-4f9b-a102-1e97068b9661", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987158, "uuid": "52cb59d9-a19a-4003-b2b9-f80a69a600c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987158, "uuid": "05ee73e3-6229-4d82-844f-a7bc751eccf0", "value": "main_smain_c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b846e2-b71f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000480, "uuid": "bbe5af11-6f27-4f67-8cd1-7351201b445d", "comment": "Malware payload (Mirai)", "value": "9442971d9868c5ab08c69ff6b3fbfedf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000480, "uuid": "40d9c3df-fa1d-43ad-93d7-976d0f633505", "comment": "Malware payload (Mirai)", "value": "5d82cfb22cba689bc3b6d96cd00ebd86634d4c80db6420c1a6c0ef3f72dab3fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000480, "uuid": "36b4e735-9bd3-4704-a621-8cd6b72ad60e", "comment": "Malware payload (Mirai)", "value": "13ce96cf6523fbe91249620be8fe718cee750207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000480, "uuid": "ea47cade-0eda-49de-afe4-46ac4627bb8b", "comment": "Malware payload (Mirai)", "value": "3ceade878fac73bb21c7ea0a0fc36fa86970d2a80fad4fadb92a5de87acf0f75d96daf57b3c3c634b853ea891b65a7b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000480, "uuid": "86b14792-a158-44fe-b672-7474624bcde5", "value": "T115732956BC819B15C5D5127AFA2E018E3323177CE3CEB2129D215F247BC796B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000480, "uuid": "cdf059b9-3902-4d61-86e0-d9dde4d0f357", "value": "1536:AZnHrSwJMwfk5NGrgwPGqKoVxuoZL37UIlaS6XWV7Util1VS9H8HK35NYQCx:4Jdf7UBEJZPU2ah6VS9H8HK33K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000480, "uuid": "af6b3ee0-c33d-4382-8411-996dc8a5b0f5", "value": 78980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000480, "uuid": "a8cd2749-eae9-4f69-8a24-62e9c6c086c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000480, "uuid": "1f338e8a-8a92-45bb-a153-8df44f1c2121", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fab7ba8-b6f0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761980261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980261, "uuid": "2b4b9067-9c64-4351-929b-8da010e7f119", "comment": "Malware payload", "value": "9dc7541b58aa425b528849e3b4b80cca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980261, "uuid": "48103c48-739d-49a8-bed5-565929c75f60", "comment": "Malware payload", "value": "5ec4d68eea64ddbf35d903f33ef7665317f74c6e5f342d65ca32e8588d6b6a2a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980261, "uuid": "6ab25ffd-d55c-4500-ae22-8c49bfc305ee", "comment": "Malware payload", "value": "8e8f55cbe761313ea26110a25e9b65c562f3462d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980261, "uuid": "b1aa8b73-ec18-4b64-a3ad-e61d18863d84", "comment": "Malware payload", "value": "9167694372dcff0f639dc5669360840f52ce396bca543fe791c150d422ec7e2b2b4b6dab049fa305062f18256dcd6a73", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980261, "uuid": "f5792b64-5457-4e2b-abfc-247529807e93", "value": "T186C08CD1443CC071523A0AAEB291E1F4E992A8284FB038A2D818C684B1740701C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980261, "uuid": "51f3939e-85c9-4236-9f10-aba5ac9d1fce", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfqDItUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfyebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761980261, "uuid": "22d932a7-c48f-4cff-930a-f15ed51b3665", "value": 171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761980261, "uuid": "b5575dd9-7987-4cfe-a5f4-74a3e693776f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980261, "uuid": "b9beeef9-ef57-4121-82f5-2d370cf67723", "value": "c8waavaeqo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb81d23-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969390, "uuid": "3628fc23-5b71-4cd6-a3dc-ee83fb12b9b7", "comment": "Malware payload (Mirai)", "value": "f827ebe9efa852eade8b32d9545e1834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969390, "uuid": "63478125-0fe1-43fc-91d8-a836e728f521", "comment": "Malware payload (Mirai)", "value": "619643c59eae861259bcb46e648b32e2df5f59e9dd51b8e7fe290786ac8d3b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969390, "uuid": "9e613527-0109-4975-afd9-7834036ae44a", "comment": "Malware payload (Mirai)", "value": "df57e85f22ac3ab3610e2d39c551e8d41c74c2b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969390, "uuid": "988d6854-bca0-4f64-ad88-3e341fe8fbeb", "comment": "Malware payload (Mirai)", "value": "2b612e5428eb457488a6a1702ba4db37269ca580f861d687c32e7027192338809de22d7dc0ac706f1bda9a917c745c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969390, "uuid": "3deb83d4-186f-48fa-adbb-906828a4b1e1", "value": "T17FD37B73D8256E98C621C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969390, "uuid": "f5a6e3cc-c54e-4fd5-af6e-3c011fd698cd", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1LZb6:QOucl0jNri9dSIP9dZb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969390, "uuid": "253d71bf-85c4-4d12-98c9-235521c2271d", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969390, "uuid": "19fceb53-9e31-43b9-949d-e61f8e0673a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969390, "uuid": "03f0eafa-4bc1-4be6-bb77-6436cc1437f7", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daabeb7-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987157, "uuid": "b07693cd-3ee4-498d-a01d-e6b3dc84dff4", "comment": "Malware payload (Mirai)", "value": "65da19823d858200af3131e0c3ffeb69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987157, "uuid": "785ad82e-4a84-4f7f-ba04-c28a51aea940", "comment": "Malware payload (Mirai)", "value": "61cee1c9cf98590e9dcf51a814960415e6c8de9cf3126e0cb3189b10dbc9da4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987157, "uuid": "02cb31b5-8eda-4bd6-89d3-bc65b40ea070", "comment": "Malware payload (Mirai)", "value": "b12118369fd7edb3617d1f74ca5184c9cce8bf90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987157, "uuid": "9b6d969b-7cec-4132-80fc-0ea72dc80f17", "comment": "Malware payload (Mirai)", "value": "0882f0957aab76f9140b3c5ec6287b8fa7104d7699738494a01c04963c8fb4bc05b31b39131185036bd404772dd6d34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987157, "uuid": "f5a60e8e-1bb0-4a54-ab45-eb4f1eec131b", "value": "T162E30B46F8814B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987157, "uuid": "ef4b3815-7173-4d3d-ba03-b9643c6329ae", "value": "3072:DHea4CTDUjnwJIXMb6kzz5aTHACdYV8P4eL+:zePCTDQ6IXu7zdaM38P4eL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987157, "uuid": "99de4dad-910b-46b7-829a-501470e61162", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987157, "uuid": "a8004302-b4ee-4eb8-860b-af00c70544da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987157, "uuid": "d5677532-0caf-474e-9ae6-94001eabc22a", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20997ab6-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990168, "uuid": "04dccd9b-fd12-4bd4-9e54-04b8309058f8", "comment": "Malware payload (Mirai)", "value": "41d8d19a4bf25e31f024de8b2399c996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990168, "uuid": "f7933654-0895-4f1d-a687-8888c2b40fbe", "comment": "Malware payload (Mirai)", "value": "629447ec35f303048a3fa1002e8fae04fcb32d5cdd2eba9dc40ff9c9e87dafec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990168, "uuid": "bbab786d-489c-4791-979f-9895439526fa", "comment": "Malware payload (Mirai)", "value": "dd8ba64ba6f40f565c66731b2140f413538b5076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990168, "uuid": "7164e734-99e4-4909-baed-c72e0938b358", "comment": "Malware payload (Mirai)", "value": "ee1b76b4e66694e32204cc39a51347e3bda8ddb6cc9a61db778ab3d676b1e6fbf9d7e226118790c774bc9fd771d76509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990168, "uuid": "2275648f-fbf0-4c86-a063-a0806b435b3e", "value": "T1FE73295AF8819B22C5D1127AFA0E224E331307E8E3DE73125E24AF7177C656B0D7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990168, "uuid": "aa1aceca-db78-47dc-98e4-dd98487d547a", "value": "1536:VQnNzp1qVkgcuKJoygwYaEkCVoahYfmQJMoilrhFaHH87lz5RYi:UlgcBIkCWahrrhFaHcJzjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990168, "uuid": "1145fa44-17f9-4d17-b736-fed58569279f", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990168, "uuid": "b731bcc2-1cda-44d7-85a0-e476a5c4c0dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990168, "uuid": "88fa7400-abcf-4561-b195-f990b5681654", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c92dfc8-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761994940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994940, "uuid": "b15a3864-cc94-4abb-8aa6-36013599e433", "comment": "Malware payload (Mirai)", "value": "134796eb42188770f9a9cf0c791dcfe3", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994940, "uuid": "e11b2a57-40ad-4db4-ab28-4a3895988f55", "comment": "Malware payload (Mirai)", "value": "65703e38b482033606407b43552533bc7ef3b142c9ea5041d8ba586fc06aabe8", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994940, "uuid": "5740b685-902c-455d-a3f2-dc5cf138db69", "comment": "Malware payload (Mirai)", "value": "5c40fb5be1ded7452d4a775702df8a2c41aaf1ef", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994940, "uuid": "7bdb68ea-ff8c-47ee-9771-83a289a0ca57", "comment": "Malware payload (Mirai)", "value": "ae690968fa0599b13ac630eb2bb039d42ffa8a24dbbfb14789c27af2b272c4ee239fa2e5d17f3b6269ffdf15c1c419b6", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994940, "uuid": "d6a602d3-0363-4499-a9d1-115f7709fd86", "value": "T1DA433CC8E943D9FAEC440B711873EBB64B76E4391128EA87D7D5E626B843712B1072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994940, "uuid": "2df37f1b-79a6-4059-9338-695b77de64ff", "value": "1536:htBFLgpJtpfrwhKTSLKF4MMzJup0EEZPFaDVZ5FObB06mQRH:htvEpJtpfry8fF4xzUp0Em8zOlvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994940, "uuid": "536fe515-a545-4bda-b1d1-242adc395bae", "value": 58920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994940, "uuid": "837c228d-4b0a-456d-b992-ec35de3160b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994940, "uuid": "f363b6bf-d804-4190-acc4-ba4a3abf2405", "value": "65703e38b482033606407b43552533bc7ef3b142c9ea5041d8ba586fc06aabe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa36115-b754-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762023345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023345, "uuid": "d5008ac4-521c-4b4f-b402-893a910bda3f", "comment": "Malware payload (Mirai)", "value": "c288e298c8d57750d74a9cd1874521ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023345, "uuid": "d6e7af2b-df66-4412-bac0-782b9613df9a", "comment": "Malware payload (Mirai)", "value": "65979f4e1c3e1b0552746b6e71a26e37b1b0af220b86969ede5e4b502a49b3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023345, "uuid": "93a6d927-1a29-45e1-a14a-785ca04ce332", "comment": "Malware payload (Mirai)", "value": "8d54697249c72bc4a18b18fa6b7ca44fb8db2d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023345, "uuid": "f4e13064-c81b-417a-ad69-ca2218d98f02", "comment": "Malware payload (Mirai)", "value": "73eae14df2a8220a8097c4d1a7e3ad67498f355373ddebed09017c91bde0b445c56b9aa4ad0afaaaa2b15d9ee8ab8512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023345, "uuid": "645c175d-9055-4f81-bfe1-3d6875041c10", "value": "T186632990BD816A23C6E52276FB6E418E331153A8D2DF720BCD226F113BC695B0EB7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023345, "uuid": "2387ad1b-a477-4164-b4f5-56811936b02f", "value": "1536:DfuUe8AEXKyHY/csj8pq96uPjAsme2AkD2gn62Of9DwLFx7N0vbmH:DfpLA8KAYEstHPjd42wfUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762023345, "uuid": "537474dc-b664-4cdb-9cd3-b5930461807c", "value": 70792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762023345, "uuid": "3fbe1aa9-9bae-49f5-a862-5424963d11d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023345, "uuid": "c56e523e-5c54-496a-a2d7-ee5153a41b71", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfab0083-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993039, "uuid": "9bed22f7-8a8f-4cc8-9254-2095afb63f66", "comment": "Malware payload (Mirai)", "value": "1664b52babaa63de465c7cc14ac5916b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993039, "uuid": "e07aa53b-7062-4496-973a-e2f45964c9f0", "comment": "Malware payload (Mirai)", "value": "661b156b5561fa89f3e09ff671a92de8020d6d786593f11e56c5d3af6ea35032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993039, "uuid": "f6a61f60-882e-4739-b5c4-541643c11db3", "comment": "Malware payload (Mirai)", "value": "f5565231845217a7f5a5f9693a72f4c3c996495b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993039, "uuid": "40667a26-2527-4e31-a127-c1c6d097844f", "comment": "Malware payload (Mirai)", "value": "58a3e17a7b59de8fa3302cf7d4c6bb5c061b9c243a43f34e857a94c5aabf9910e4f76679857f722452d208f59767e374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993039, "uuid": "fbb8b0fd-3656-4bf7-a08b-0e99e94a3064", "value": "T1D4E2E1AC46D09915CCE268B91EA1AD74717EED3B083144E4A3C33F58A831661BDD1EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993039, "uuid": "0fd36145-b842-4af5-8d11-7f4b3727146f", "value": "768:CJdtmPzv5dCvcCO/aTVjL5aDYPNooAdEf4yZGzmNY8lso9KyX:OET5svBO/ahxzloPKfXZGzKYyl9K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993039, "uuid": "c55ed29b-7e0c-4628-8393-33fbaedbff84", "value": 31928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993039, "uuid": "e79bb53f-65d1-4708-8ed1-34696515844d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993039, "uuid": "316084ff-fdb9-4db4-b6d8-f3a4691eab75", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec51c927-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993087, "uuid": "065b7056-3ee6-40fd-99e3-df2dc22a45cb", "comment": "Malware payload (Mirai)", "value": "45d7a47e7db1f647a3f2b05fa51ddcfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993087, "uuid": "488eaac4-ce14-42f8-8109-bff6af251f2f", "comment": "Malware payload (Mirai)", "value": "68e191a2cc8acf6469dc9c4a588ff8c753a79d4a088ff47b65d5be6935249919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993087, "uuid": "e98d1fca-98c1-4303-98e3-fb23cad01eb0", "comment": "Malware payload (Mirai)", "value": "20dd281c28aad8901090db0c69f9e8b117a47e88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993087, "uuid": "e1abde55-5e68-4aa7-9f50-4678e1a0fa5d", "comment": "Malware payload (Mirai)", "value": "f7f44aa54e13b1e13d18d4d5ede7801f4e81c43b6230a3be983fff638434cecc74473c2d54b1f7ac0a79da86f3b4bf9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993087, "uuid": "90ab188d-31b5-4096-b360-96178458dc8c", "value": "T1F4531890BD816A22C6E42276FB2E418E331553A8D2DF7317CD22AF157BCA95B0E77701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993087, "uuid": "bc521dbe-74d9-4238-8706-c415edba1106", "value": "1536:sv87WGgxDv2OQyo3SQBGOattyLNKs56mzOXJpuVfDUSiH:svk1gRvZQyxn1ygsAofM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993087, "uuid": "7526f2bd-c9d7-4ac9-814a-315c887bed33", "value": 66696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993087, "uuid": "25607284-3572-4d0e-be21-ba2d7ac9d82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993087, "uuid": "8b519e80-1b82-4fdc-853f-2513fb99be18", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff49cd5b-b776-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762038216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038216, "uuid": "edd8d330-279f-48b0-8882-b87cc7b8f27d", "comment": "Malware payload (Mirai)", "value": "bb82dcad1247abd0a42f432b20527927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038216, "uuid": "67748a3a-e21b-45a1-93bb-483ab57ce97b", "comment": "Malware payload (Mirai)", "value": "69727e5aa9ee80fb61d88303a84ea2e96ad8654d9ef279504ab72c3a45ef8cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038216, "uuid": "726f4f72-bb5a-4054-9858-a0d9d540c09c", "comment": "Malware payload (Mirai)", "value": "23355a67ce1c57d6a8d7e08313291766731ce0c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038216, "uuid": "9d1f8472-1b1b-42e8-83b3-36c6a594ff09", "comment": "Malware payload (Mirai)", "value": "107c4e00be3cc4fd4a02ebe74f08fe2c579cdae98b801f58aa76f984bcdd42adffc10f8fbef1b7a375308ef35efea6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038216, "uuid": "c48b0730-e9ed-478d-945d-9cc1c3eb7b84", "value": "T16CD3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038216, "uuid": "4a001848-2541-4cae-aa9f-7a212dacb286", "value": "3072:AHZ+XPAorxFOV48wlPJHQRTaPuU8RSON9LSoib8:AHZIAIAV48MPJHOJ92oiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762038216, "uuid": "342ab286-9154-4007-80ae-7557a27bb5c4", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762038216, "uuid": "81b693d9-35ac-4ea3-a8e2-9ba44c5148b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038216, "uuid": "3f765a1c-c0af-4640-ba18-72d1364d46e4", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cf2935-b70f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993588, "uuid": "74bf5a3b-0bc4-438d-81dc-ba4c3e88f44b", "comment": "Malware payload (Mirai)", "value": "0a6d20ba98424dde9ab001c623a0a9f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993588, "uuid": "eb89ba7c-5b77-48e4-986c-9b1937edc11f", "comment": "Malware payload (Mirai)", "value": "6a5c5e456eb68063fc86ee5cc43305c15f830d58dd2bc6941465e1df5c8817ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993588, "uuid": "36f36e8d-b3f9-4c13-ac5b-2f0e21b36585", "comment": "Malware payload (Mirai)", "value": "2a8403c09b7ca303868f655b35a7f4d2de638e5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993588, "uuid": "d556f903-6531-4f78-b611-26769f63c9bb", "comment": "Malware payload (Mirai)", "value": "823b64ecbf77c72de8223d4738d75cc8fe5a383c8f588f125ad24921ba0d587d2ae31509c8f92dc39700bd8db479471a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993588, "uuid": "fe146242-80f2-4846-baf7-76a153bcc4f7", "value": "T15BF35B07F5C184FDC896C1B44BAFF636ED72F09E1134B26B27D49A622E5DE201B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993588, "uuid": "4efdc3b7-1c99-4c55-ab04-90f02e3c4214", "value": "3072:JBx7hJMJdMjDGgzTYJanIZlbupbiik2AKzopC6FyqJhYx1Ha:JH7heXIpFp8BIba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993588, "uuid": "1b0fa6d1-8e22-4c30-bb9d-1d95db649f2f", "value": 159256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993588, "uuid": "a532c0e9-2c08-4eab-9cef-01e0cd828a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993588, "uuid": "650abca9-524b-46d6-b532-69344f41b210", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d063d9af-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993040, "uuid": "57b0da05-51ca-474e-9307-126e97a1d425", "comment": "Malware payload (Mirai)", "value": "bad93deb6f8c44f5ce00a0a419f54940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993040, "uuid": "76a75571-7895-482d-87e3-dae57ffe5f6b", "comment": "Malware payload (Mirai)", "value": "6aabc62420b1aea19de28a8447d50d3d0c08a50a97af8137d32045917b3407cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993040, "uuid": "9aefb8f9-86dc-4270-986f-37b1f0d70211", "comment": "Malware payload (Mirai)", "value": "bd7a2dfb23f1397bbd0571fce7bf7eb5552bc121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993040, "uuid": "e1485917-b028-4457-a03e-3f44741058e9", "comment": "Malware payload (Mirai)", "value": "37e1020be3f4c623df9a02646672cc7d90ae826b2555fd2f08af284118facef453326415f3b90135d2ddb67ba87af4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993040, "uuid": "48e89000-322e-43b5-a8db-bc4f60f81ba7", "value": "T1F7F2F16589C28CC4C43BBA3CBFD79A55FD597ECB502333B27895F2993EB02155884139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993040, "uuid": "ab24d317-6921-4d84-8698-eab6644b96d3", "value": "768:TOXs8NhR4pSx1X0qkaNlKJET2Vr8zHb9C6bFIRFHaAGQj9o+KxS2Gz:gPtD3VT2oP98F6A1jPKzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993040, "uuid": "c36bfdb6-d985-460e-84ec-3ee5221f7219", "value": 36016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993040, "uuid": "bbabaf09-0fb7-45f6-81a4-e09b9cbcd27b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993040, "uuid": "a151b4d7-4ee7-42be-8eff-6c9c671734c7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a37e54c-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987151, "uuid": "45b651d3-2c2a-402c-a59c-9fb225f8c4d6", "comment": "Malware payload (Mirai)", "value": "6a82bae593982247ba1e8e1d803cab0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987151, "uuid": "037206b5-c841-45dd-936c-08c510e7aad8", "comment": "Malware payload (Mirai)", "value": "6bba35fd9933b3e9c3e8f9b8944c0d365e48f052203a981487dc673743407c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987151, "uuid": "e1c50fcb-82cb-46d6-b3e9-998adb7c70db", "comment": "Malware payload (Mirai)", "value": "12ac0e8b3855dbf7c028f656a6339c3c2d24875d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987151, "uuid": "c61a0b54-770c-413b-a63a-d600021ce1ff", "comment": "Malware payload (Mirai)", "value": "952b42c9126034ed9d56e6b132f7cbb7337491685e62f4fee7fde4f99ba2c254550e952016661bc38b60dec8a8247743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987151, "uuid": "fdb00abb-8101-4b20-8ea2-5e719945db21", "value": "T1A8937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987151, "uuid": "f5e31ee6-5567-4cf2-8be6-ff36231bf32b", "value": "1536:W/QCZaxGdvts3i5JPhoRsxPu++4HRsUIKqI4FrS4LSH:WYCZa8dvm3oJPhssxP5lR+KfUmDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987151, "uuid": "26e7ae7d-cd07-4da0-9e68-27bd90210856", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987151, "uuid": "45e23dba-2be9-4ed6-b9bd-4c2c3d6f13a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987151, "uuid": "6467bddd-83f8-4571-aea0-2c7f92df4ff2", "value": "main_mimain_s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24198330-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990174, "uuid": "bdb2eb69-0efb-4373-8b20-6aa5983fab51", "comment": "Malware payload (Mirai)", "value": "de072ac35ec58a842f5f36038ae3dd81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990174, "uuid": "d0d0ed31-bb5a-433b-bba3-6b4e83bb7695", "comment": "Malware payload (Mirai)", "value": "6cd41de40aa4b627fdf9435091afe47f70ea807f38b0f3d8249465d493208e53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990174, "uuid": "843652bf-3520-4901-b10d-0bb50f7d2dc7", "comment": "Malware payload (Mirai)", "value": "4e6e50b44ce3ecfe2f6e9b885df60df6fb072f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990174, "uuid": "e3a5b34a-1d38-497f-a4fe-ba639c738e1f", "comment": "Malware payload (Mirai)", "value": "8fb2b8b474e3ab4e44ba1661a47b8d225e319a21149580021b563ff14d933030bee6ee337e00172754356c57d30e017e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990174, "uuid": "7e16925e-4f45-4559-b403-e070f770615a", "value": "T1DEE33A46E7418B13C0D61779B6DF424533239B94A3EB73069928AFF43F8279E0E67906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990174, "uuid": "da3b8b22-3ed3-4969-af26-2bfd53e497aa", "value": "3072:Np43I/j0/cayQBBHvhYz+Ia2Po8a8ZnQGrM/99li0:NQwg/cayQBBHv6z02w89ZnQCM/99M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990174, "uuid": "fc9511e2-9d43-43e7-8922-62b686cdf8e2", "value": 153036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990174, "uuid": "b66f6bae-fc0a-44b3-941e-03cec9f20168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990174, "uuid": "7e652be1-724f-4650-b4c0-2ac9a6731748", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fcec50-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989082, "uuid": "6cb7e9eb-52de-4699-bba0-736962c671e2", "comment": "Malware payload (Mirai)", "value": "78eb612dbb23409da8467cadd1faeae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989082, "uuid": "8e5e0042-a9f7-4ea3-829d-5a2f71df6b0d", "comment": "Malware payload (Mirai)", "value": "6d900a791d921edb6d57a6a3622f6f10594e3193b06e33a1c32d9cfc514a68d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989082, "uuid": "16bb7e9c-47bd-4a31-b1c9-d1455f22a796", "comment": "Malware payload (Mirai)", "value": "1d336af9ec13501fab90c2b90669066c33b32fd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989082, "uuid": "14c9cdd2-1429-4b0d-99da-50544606d4c3", "comment": "Malware payload (Mirai)", "value": "849e42763fe606cb1e8c14d05854b456c41f8f9bc661440bab945f0adda959b9e87f0e1ebd287997d371baefb3f46584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989082, "uuid": "f6833dd9-95c9-48ae-91c0-9da8aed444f4", "value": "T16A058E66B1E3B0FCC527D130579BDB226932F4A506306E3B41C89E352D66EB01719FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989082, "uuid": "12328b03-ad1a-48da-b340-554835b2d800", "value": "12288:2SZBV3Psu1Q+ENE8hKUdtp1KqI0Qy+3aqUY:2oBV3PL1HENE8hKUd3IR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989082, "uuid": "80fc9382-d62f-4357-9338-667e22473e90", "value": 859744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989082, "uuid": "dd14af33-2062-4e5a-bc19-0b0f46003fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989082, "uuid": "a2c35ad8-687e-414c-b8ab-1171c14d018b", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2f2ac8-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969384, "uuid": "e851cc73-3b91-4434-89e2-36fa75486cba", "comment": "Malware payload (Mirai)", "value": "76be997f0b9920c215e8238be7c4d48c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969384, "uuid": "bed52201-358c-407d-b522-97434ecc22b9", "comment": "Malware payload (Mirai)", "value": "6fb85707ec25d3e681c74f6f19d8fabaf927dd732b95d93d830f2777884d2cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969384, "uuid": "dde10b2d-66fb-40a3-bc24-9c31277a9135", "comment": "Malware payload (Mirai)", "value": "63ac4a6f0d77eab557ea5de8483292dd3c935f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969384, "uuid": "8184bbd4-3c2a-4d44-87d8-99bc8c0fdca1", "comment": "Malware payload (Mirai)", "value": "865f388ad24189f8e724a89272f8beb8792389b8f24c2a9aae635984282f8f810c999d1facd2f2e770bc991e8df19d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969384, "uuid": "4296ed51-a708-4b05-8329-d4497662fc30", "value": "T17D43F065FA615A87CCBA8C7481EE32315F5E621532DF87DC2B270A84B70910F757873A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969384, "uuid": "fdf66e4f-603d-4c91-8f00-2ca7dc40a1e0", "value": "1536:tlrRD0gn1aEVi15uooQJpP8LIYUK5xUSt/R:/dUEiOdWF8KK3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969384, "uuid": "0b2ecb72-9dee-44d6-b0e3-8109ba86307c", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969384, "uuid": "cdb3ad7b-317a-481a-9b9f-7bb72a831209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969384, "uuid": "7695081c-8ed9-418e-aa5d-ee4e4fea3792", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b30e1d0-b703-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761988549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988549, "uuid": "90c40f42-3936-41ad-946e-74cea49bfbde", "comment": "Malware payload (Mirai)", "value": "3833d22d883b8506c1e5d10c0888c934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988549, "uuid": "a003de00-7a98-4726-b3ae-0ff2c04bdcb5", "comment": "Malware payload (Mirai)", "value": "7381b9e62e698ea4a2861bbc0a14d0200e45ed37c7f35907577ea73663ed38ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988549, "uuid": "17536f2d-e4ab-4440-9dd8-03a0e6737894", "comment": "Malware payload (Mirai)", "value": "d9019c7f71eef1a9898d83525afd7f6edfefaca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988549, "uuid": "8cf03c31-deb4-43b0-a404-7a7db04abca7", "comment": "Malware payload (Mirai)", "value": "01b6f37fb04223702ee4b28ad7906fbe953f404caae58858b08e616cb0bb7cec05f64a9da3081c9fe512a8ce1204f670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988549, "uuid": "2dc5e08d-9f23-4e73-8933-80a74191f680", "value": "T10AE39FB3F30B1091C82306F417CB6B9C2E3315425F6B86D3BCAA313A2A765DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988549, "uuid": "dc14ff8d-23f5-48e5-bba5-96fa567a754a", "value": "3072:X/1HeTDitCaG9y+y0+Xk+cdLfSFztgQg5CvugQt5SPub01yQq:P0mGvy/aKFztgjCvattQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988549, "uuid": "6268c6fc-c2bf-4ae1-9a4b-cb6adc5da3b7", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988549, "uuid": "2cba8b9b-dc99-4d3a-9e3f-9609115ac33d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988549, "uuid": "f2cbf1a0-cc24-43ed-89b3-121ef0c754e8", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c05295-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761986664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986664, "uuid": "de8a82ac-77dc-4d04-97a6-f45877d9dfc2", "comment": "Malware payload (Mirai)", "value": "e8d0ede7432d73ddb9c0484372cd8151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986664, "uuid": "b794d42f-79a0-4dde-ba59-f70938405e32", "comment": "Malware payload (Mirai)", "value": "76c35e732c6e4c71a1a40e8ab1cf079d69e6f0b564324fd65d66efc27ecee62a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986664, "uuid": "6445dea7-e3bc-4f1f-ac3a-f319c51fb702", "comment": "Malware payload (Mirai)", "value": "a7560d39e77348305d422ac6ef3fa2c60e8c79ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986664, "uuid": "aa4967ad-2530-4c38-bc8d-efefc2e04299", "comment": "Malware payload (Mirai)", "value": "6e98d63e833263b2d0d8ed63d5ccb4932e8f4bc0c80ff7ddb20546610e532c965486e9a81d20dd64c8afd021b5672013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986664, "uuid": "4708e27f-ef07-4fdc-9d74-9b0bb4f52238", "value": "T146C38DA86A4E7D92E3CBD37DCE484E22712B75F0C26053F1BE02635DD1DB9AAC9E0541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986664, "uuid": "ca53a356-9bbb-4a81-b34f-5976d02996c5", "value": "1536:xwPQey1Z0Vf4dsSglGUUfLcS5E4QRPVwh5QG+BdV5lllce96fYx:KPQeWNWSDLcS5E4Qd/BzzlWetx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986664, "uuid": "fc7142a3-7f38-4dd9-8adc-70babe7b7744", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986664, "uuid": "3b3fc0f7-ebda-41d8-b04e-b1da5a044213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986664, "uuid": "d23e6313-4d11-49f9-8e37-d76f9c0a6f70", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d0b259-b6e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761975973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975973, "uuid": "8f5d5af8-f14a-4386-9647-e811e3223f14", "comment": "Malware payload (Mirai)", "value": "28bb130290c3ebcaa89c73a8f0cbef5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975973, "uuid": "b7a76efc-6098-446a-8c23-646ef052554c", "comment": "Malware payload (Mirai)", "value": "7a751f8eafd0ee6e306a70cdb278f0fc957812f360442e7a0088b9bf50c739d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975973, "uuid": "9636f73a-3b2e-4385-a7b6-2208dd802234", "comment": "Malware payload (Mirai)", "value": "ce4f74665a2e43ed26c8927a4c044da44de85731", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975973, "uuid": "2ecf9fc7-9ff8-4f27-a579-9cae3c2938f0", "comment": "Malware payload (Mirai)", "value": "4dfca2786a960c540f7b64f67eaa33e898f2335daa0c49b6c153a738fe53743a9210f0e37dfda49de5c50e25f1fc027f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975973, "uuid": "6541beeb-af80-449c-a6b2-cd73dd8a9eaf", "value": "T121D36C0A78D230FCC68BD17052AE9F61EA36B85C42183DAB93C7BE711D36ED05E15E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975973, "uuid": "1705a9fb-11fb-4a68-bc45-47c1cf83bbcf", "value": "3072:D+tAHmeqdL3dRlggvk9oIOcz+CBFFQ8zYjKhQ:iGPqdL3Fcz+CTFJweQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761975973, "uuid": "da8fc202-a856-47c9-ae18-24ea3caacea4", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761975973, "uuid": "fa15118d-4a0c-4ea4-91f9-aa2a8f7e5cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975973, "uuid": "485b8ab8-b821-4657-b5c4-e81cb4c4cb2d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a35f2c-b6e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973723, "uuid": "69dc060d-ee60-4273-85a9-dcf3a3bbcfb8", "comment": "Malware payload (Mirai)", "value": "68453fb4e982052aaa8230050f771a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973723, "uuid": "dd1a7e79-f708-4463-bc00-057715c8e045", "comment": "Malware payload (Mirai)", "value": "7ad8f7f7b3c11be4dcb9bc6c995d24e03c137bd036fc0f42be43e02f7f837553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973723, "uuid": "910f330d-1b5d-441c-b983-8c0d9ceb070c", "comment": "Malware payload (Mirai)", "value": "598a3e60acc6c3ac5dcac56d69d86b1576f248e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973723, "uuid": "2bf16fb3-93c7-4275-b809-f218261cfaf9", "comment": "Malware payload (Mirai)", "value": "230a49dfa28f2239fe60cfe1d244276d57ee3ba994abb133bc5752edc93e79d5d407e21e51040786b76a83e5f71c7472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973723, "uuid": "ee66f59a-418a-4da0-b735-31588fc9069c", "value": "T1BEB3F995F8C1DB56C6D656BBFA0F82CD372613A8D3DB3203DE18AF21368655A0A2F141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973723, "uuid": "2be228b4-36d2-4780-9c03-bf01f8868eab", "value": "3072:1o9z08KPp7dejCuCIKMJ38BVRbYNv74JobF3TTlvgDBdGJn16:S9Q8KPp7dejCuCINwVRsv2G1vgNdGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973723, "uuid": "e1895069-1468-4ce9-a1ac-69cd2e593173", "value": 111796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973723, "uuid": "a423b42f-4c00-4112-a616-449aa4f862ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973723, "uuid": "e597d2a3-b1fc-4c11-b9d5-aaa1d9d9e8c6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b003983-b77d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762040920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040920, "uuid": "9312fa97-c614-4373-97cc-12ad449c6272", "comment": "Malware payload (Mirai)", "value": "ae0a82ab8eb1c603258942974ace86c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040920, "uuid": "5222311c-58dc-45cf-8c9b-6748862fa1ce", "comment": "Malware payload (Mirai)", "value": "7b5432465888c4068beb6a5440140f2ae1819457c6d63539d06d287a29eafb4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040920, "uuid": "3e3483b2-1efa-4cc9-90bd-623a76d3104c", "comment": "Malware payload (Mirai)", "value": "3924038ffb669fad6d368eb22cd44048775a06b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040920, "uuid": "0d5ff032-37d2-4edc-928a-f8c9d2108597", "comment": "Malware payload (Mirai)", "value": "42ac7fdf0fad1a2386da1b5037c8c9c67bcf849e6ec5119031c8a4bd6cecb14eebb8f6155ab8c219018882c096203420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040920, "uuid": "977888d8-61a3-4ef9-869e-fe9fd08a8811", "value": "T177C31885F881AB14D6C615BBFE4F118A33135BACE3EE7213DD241B2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040920, "uuid": "d921be59-180e-438c-8cc5-8053d99c81fa", "value": "3072:Zjgxtez8WHgr1VvSQMWrVbLSXWN+u6ea5l2dUzvWUOOjQC1h8wUTnzvd:ZgxtdWHgr1VvSQMWxLSGNXta5l2dUzvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762040920, "uuid": "7a3e8db5-d01a-47bf-9158-5982afa09bf7", "value": 128496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762040920, "uuid": "3cd42611-1943-4640-a73d-8583391f854e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040920, "uuid": "e19bbc71-86af-496e-a45a-4de589d87722", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b29e91-b753-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762023109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023109, "uuid": "8f4a2dcf-ecd3-4071-919c-445ddf1aa067", "comment": "Malware payload (Mirai)", "value": "aa7782b376af1358023fd67e348cad83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023109, "uuid": "d1d9c2ab-824c-47d2-8b21-e345695fb2ec", "comment": "Malware payload (Mirai)", "value": "7b7416c28d85f4d42045a75ed9e83c489912b49425086e8b11da476c010d6c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023109, "uuid": "3e5dea62-dc8b-4688-a385-b1863f7b137b", "comment": "Malware payload (Mirai)", "value": "0f47e918f96d05042944e7b95e40d51b90a08744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023109, "uuid": "55e76b72-2c60-438a-8bd0-935d3d99bfe6", "comment": "Malware payload (Mirai)", "value": "b935b73ab5c4caa6673008b8fd63d07b2bb396d760e803f8e123119dc1662e5e6b9973917c95c9b048adef5988d369c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023109, "uuid": "39f6f46c-38cc-4a79-870f-06ff81f0bc55", "value": "T1F7B38DA47E4F7C92E3C7E37DCE444A62712B75F5C66182B4BE22432DC4E69AD8AF0501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023109, "uuid": "db1f864b-fb3d-4245-b76f-b33294e4ade7", "value": "1536:bv0D7rJXKWKpI9MY/rzsfE5QRER1u0KfZC7Oe4tmaygzxZlceUW:D0/hKvCHiE5QREDuPcqtnlZWeUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762023109, "uuid": "353c397c-97b6-4aec-ba4c-8b19fc2ec2f9", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762023109, "uuid": "891e45ad-1a39-409b-8a0b-a5e947b84ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023109, "uuid": "f4bfddc0-8cc9-47a9-b00e-8304daa3cea0", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac5cdb1-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969382, "uuid": "55e16f15-8452-47a8-95b6-b28e8921a75a", "comment": "Malware payload (Mirai)", "value": "ed683fac3b34093a9abb5d94d78a5f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969382, "uuid": "ed21cbb0-d2b4-4bfa-8900-965422ab3602", "comment": "Malware payload (Mirai)", "value": "7b81cbbefadd8ee560e99ec41a88b585852f37675e7ec213c15f9a2536e43167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969382, "uuid": "d2ec6aab-1b41-40ab-baff-3e7996b368d6", "comment": "Malware payload (Mirai)", "value": "e06c1b0588e3f826be50fc28bb1e3baa9bc949af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969382, "uuid": "bbac2e86-3192-4009-8279-b13769986707", "comment": "Malware payload (Mirai)", "value": "a06650a0cd6c723c98d8d4d70aeeaaec65891d118621a1f4fd7af7e4fae27183826bdec207b3551f3bc0ae03d30f8c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969382, "uuid": "2bed9b2d-b996-4545-a9ae-614dc8586653", "value": "T11633F1B599026AC0FFB3EB634C8EDFA877111AD1E39B87869246AB4025771B83114FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969382, "uuid": "1d5b003b-fd9b-416f-aea5-d635b19407a4", "value": "1536:gVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINncj4u+qgw09Z:+aovZsIRfoPaaKYaYcj4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969382, "uuid": "f2b8f786-9594-4829-afcf-f15ef0f9fc64", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969382, "uuid": "33ad19b3-3535-470d-b6b9-337f99f1c160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969382, "uuid": "fa154180-e314-4bbc-822f-33c2ec305029", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26dc8a5-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993044, "uuid": "1c96895b-5b13-4a38-8a1a-c4780906c49e", "comment": "Malware payload (Mirai)", "value": "9d83596c8f8e83790b878889eb39bc17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993044, "uuid": "0a0a88c6-3ae3-49d4-989d-7638373b64a0", "comment": "Malware payload (Mirai)", "value": "7b9ec25976fdd9aea04b5f7ba641d6c9f1236fe393e069dc7e1d32c32e701ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993044, "uuid": "73abda39-84c4-467c-a999-d997af20643b", "comment": "Malware payload (Mirai)", "value": "080fabb0309d0dd6325ee3680977f34cfba8c041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993044, "uuid": "a8d90fdb-b970-4575-9d1a-93b1fb6c3151", "comment": "Malware payload (Mirai)", "value": "2a5909615e7ad07ef3bb13999ddef87846c56516a3d4fbbfdb366327f66d150aa88abacadd0f4d87f45673c3430ac27a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993044, "uuid": "680f56d6-f695-4c86-ac89-9164ce24192a", "value": "T11003E10292A22CD7D2A72876D52EAED670342414B3FC395733A24A597B0DC384BF64F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993044, "uuid": "1133f688-1f2b-4ea6-9e0c-2ef04c68dfdf", "value": "768:5msz3dbjJEscgKY9n8kMN76tsgcgJC+d59gBRCdGTQMYUEZElb7BUh:5morFD8k06sGZ5azTQhQl6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993044, "uuid": "d71ae933-1e08-4756-bfed-a83d75d57882", "value": 38952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993044, "uuid": "add23a73-d954-4f0e-b238-6d3e7e80fcc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993044, "uuid": "87b04226-5c37-4f3c-abdd-8f681986c9b5", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6aa0fd-b6f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761981227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981227, "uuid": "aaf9e9ce-44cc-4010-b578-bef31425574b", "comment": "Malware payload (Mirai)", "value": "f459c9e77b4029c8e471dd88685cb3ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981227, "uuid": "109f1183-178e-46a9-97dc-6f05452f74c7", "comment": "Malware payload (Mirai)", "value": "7cc9b35898e0b64e6e544c7a3002356dc761199aac6b233359ac2509074919d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981227, "uuid": "28d78a0b-60b5-4ba9-9407-d5a74982cb21", "comment": "Malware payload (Mirai)", "value": "a6c7323ed56d1b18ca52f42ab333a98723f49805", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981227, "uuid": "db5e7cbf-a172-4d46-8bb9-cb3b7e53462c", "comment": "Malware payload (Mirai)", "value": "238aeb0eb72aa394839a5418917c70a8caf234dc9598c7205ba2da92c0793514c85732922780568cc49e0081553ced1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981227, "uuid": "b1a90c61-5e9b-4d2e-b6db-2962ccca9e94", "value": "T17D0152871830B7718548E777789C5B399B08E3D161C21F67F68F1965658DB1CB036F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981227, "uuid": "feaa44a2-97a0-4eea-b733-e831b4efdd20", "value": "24:oSX5GfSO5GfSl5GfST5GfSk5GfS75GfSvC5GfS4C5Gn:dXRORlRTRkR7R6RJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761981227, "uuid": "02cc0f50-ecca-446a-b081-86c6e0d25bc3", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761981227, "uuid": "53372b30-3e50-4ad0-b554-29c752555759", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981227, "uuid": "f7a49d83-ae16-4c67-b984-d130b6d30940", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d352bdcb-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969423, "uuid": "66f49cd2-f691-4353-8b45-44cb1e0b502f", "comment": "Malware payload (Mirai)", "value": "e7c29f8dd53b36ea69ac33e2a1973046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969423, "uuid": "c4787b9a-d624-479e-a15a-af0c8b7bbe77", "comment": "Malware payload (Mirai)", "value": "7d432e2fda0f2180d71d0ecab9f2228e6d05b7c298b6cc73b310fb38d5cf6cd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969423, "uuid": "666c8339-a2b9-4483-a66a-9f6fa72fb0ff", "comment": "Malware payload (Mirai)", "value": "9e963c807171e1e9e03253d7173730ad0149a166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969423, "uuid": "33bae55c-7ec0-4a62-a0da-739d07fd3c83", "comment": "Malware payload (Mirai)", "value": "a517c0642acbb7d35f5eafe37bac486a1c1d770a0d80cc15cfe1aa7cff21fd4d2840c073f0d94426a0776d1740839d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969423, "uuid": "520b6f82-3ead-4dec-b18f-0f3aa0943198", "value": "T105243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969423, "uuid": "728231ad-d24d-4d02-a704-b443fcbdc9ed", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKelxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMDyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969423, "uuid": "63c79bd9-e493-434b-90b0-effe3005006e", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969423, "uuid": "b6b279ba-4488-4f39-9c13-d4bbb39c8249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969423, "uuid": "990c1797-2b67-4011-94ee-6c28d90f9e11", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1123c5c-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993041, "uuid": "a0e22b41-2894-456c-bb57-b4cb950b4b36", "comment": "Malware payload (Mirai)", "value": "d106dcec300c20d9149d193dbd78b401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993041, "uuid": "fef66327-91d4-449e-ae69-08011d1625b7", "comment": "Malware payload (Mirai)", "value": "7dae031408f59c76bb265e40844badbb8bd2e9ff1f0bb5763d57d7e47c2fef39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993041, "uuid": "a9eae71d-c58d-40d4-a4fb-4b73638bcda7", "comment": "Malware payload (Mirai)", "value": "846aa6d60e495f0ed5572d3b357ab9849a998d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993041, "uuid": "f28e0c68-c4ba-4dcd-99f5-3b8d9c0d9ec8", "comment": "Malware payload (Mirai)", "value": "7cd21bc872bf50a057d7f04d1a714ad9bb78bf0a9f1165592b1dd8dd31b9f173a70502ed1a3393ccf6d3cdbbc72ddf28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993041, "uuid": "85e8f87d-77b5-4170-b7a3-2c0a960b07af", "value": "T1ADE2F14C71C6752AC370E63720A7C15CFDE6998860BC8740CAE56944BF835D38B8ECE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993041, "uuid": "e5bd5aab-c7a4-49a5-aaf6-23c7918064d8", "value": "768:QzwVMjILG+qjMaKu5SV8Qghkq/UaHq2G9a+C+ayJtc2fFxe4XdZr:Wwi8i+MSV8QRq/UqEaJyHc22wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993041, "uuid": "0e34561e-f796-4e5c-8f57-474045470886", "value": 33756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993041, "uuid": "8f33096f-712b-466b-9925-20fc82395e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993041, "uuid": "292335fb-737f-4a6d-a85e-8dd2b6139e42", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442bc22e-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761988939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988939, "uuid": "5f3adb3f-737e-4a5b-bcca-e7e6bcc7fa0c", "comment": "Malware payload (CastleRAT)", "value": "58253bef795c914bb2dca89f74ae0aec", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988939, "uuid": "1f044f76-2b7a-44c5-8b3b-571581d908d1", "comment": "Malware payload (CastleRAT)", "value": "7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988939, "uuid": "bbce85ca-0aa1-46b5-8ba1-f57499b87ca8", "comment": "Malware payload (CastleRAT)", "value": "ab517aa83178957381a9f9317c15901f4ee79cc4", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988939, "uuid": "e60197f9-e1f6-4153-96a6-b9dfb03e5b75", "comment": "Malware payload (CastleRAT)", "value": "a33149aefc66c085fc09aa3afabc2aa8fc8e89efbfebfa63bc32c309a4101840dbd872200328715d1e0a58e75eb11816", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988939, "uuid": "68c1baae-12f8-497c-a3f4-b2bad532102e", "value": "T12E765B7B62A4826DC96DC33FD1E38F40D5F371B52B33C6EB429103698A068C19E7E665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988939, "uuid": "cd0cd711-ac1f-4f0a-8370-52f90460e947", "value": "1c0dd8cf4de1b0654b64d6ba3da24259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988939, "uuid": "ffd357c0-23dc-4560-85f5-d651ebb28422", "value": "49152:DCiAb9key/HOSt9/uW2P5asIOd0S0IBRQVvOIQrDMsjP4yIJgieTgueLJ93Ij/hs:DpsZZwbJFeg/3SP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988939, "uuid": "62d96351-048c-41b0-bdba-7b3c0fb52f3e", "value": 7565824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988939, "uuid": "5dbe6620-0ae4-42b7-8a94-0cd02b897431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988939, "uuid": "90b98b78-bb3d-4bab-b304-c516cbb59829", "value": "7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94208b5f-b711-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761994657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994657, "uuid": "b762eb55-e4a1-4931-9651-2cb60264c0d2", "comment": "Malware payload", "value": "bb6d17d86e8dc112a93a33c5082af5ec", "object_relation": "md5", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994657, "uuid": "76a90ce5-1946-4651-9a5a-80ede12c0662", "comment": "Malware payload", "value": "7e59e79f48fd2279f9e8bfefa91d79feb4afef5720f7a338e46d2a6d1a607872", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994657, "uuid": "b791cf52-d126-4bc3-9d0d-f303cd97d739", "comment": "Malware payload", "value": "cb22285b9eb62e97f3a57bc020ecfb059a875906", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994657, "uuid": "6172680e-10d0-4b23-ac51-3e08d9507597", "comment": "Malware payload", "value": "6bb03c39d4ebdaaddab5803d5da9fd82d9eeb680c61cf00452e6aa4dea212059d0aa65e22c4c47cee48033c5b672a191", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994657, "uuid": "2d66a917-f68f-4d22-a825-f3a6901e4113", "value": "T1E18723C2E24E8271DBC76E79325D5312D9D9B5463211B2772BBC02802DEFEC9076FA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994657, "uuid": "197bd3ee-3de4-49d7-b586-f1bad262f2fe", "value": "786432:hKWN9OMczcHosmV4fFVXjW7juH/5ihlLgslmmBikUGE8bMcGrG3n:hTmRsmVOC7S/50lLHlmmBPUGE8bMc33n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994657, "uuid": "a443bd93-137d-4314-bece-59de7623b44d", "value": 37723390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994657, "uuid": "faca68d7-c2ca-4fb8-81c7-34045e51dde2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994657, "uuid": "cdea3c75-db46-4102-815b-9db2fd06b57a", "value": "BLENDERX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c103cc-b717-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761997180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997180, "uuid": "c0e60f5b-b3b5-4a65-a4fa-fe1fe0e492b1", "comment": "Malware payload (Mirai)", "value": "890112325660650a8cda7d2e0799bbd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997180, "uuid": "6964e734-83b4-41d0-86ff-8b1be7de4835", "comment": "Malware payload (Mirai)", "value": "7eccb8d41d6eadcdc10d369eda7fa98da89357201e9eb3eb35dc4d898c29bba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997180, "uuid": "4778e740-6ea8-47a5-85e4-24da22565c9d", "comment": "Malware payload (Mirai)", "value": "597558747a81078b464e6bb647177dc08c7c1529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997180, "uuid": "7e958275-8301-40a6-ad75-012b95905160", "comment": "Malware payload (Mirai)", "value": "0d0722b8c032451607ed66e16fc80f4f82340b4fe526f21964e4c1398d90f49bb8b9c2281574d60a592a60a30f2c9d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997180, "uuid": "dbf70f6d-f811-4cb8-99ee-b9a82d7311c1", "value": "T155D32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997180, "uuid": "f4da566f-8474-493e-bfdd-3fba51e68562", "value": "1536:troGHNTUZNHlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg8783p:3mWUiCxttqCwZ7lLhrI43p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997180, "uuid": "5a9d4bf1-0885-420e-8513-4c4dac48cf31", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997180, "uuid": "81f287d0-6ebe-472d-9448-6ca723154cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997180, "uuid": "6639ec06-d4f5-4f8e-a907-db2b7434779b", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7ec179-b705-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761989301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989301, "uuid": "b0a4c3ea-f765-4932-91b3-ba5920dd6096", "comment": "Malware payload (CastleRAT)", "value": "59f8e8263da2e7523b12973233a90585", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989301, "uuid": "3e7c08a6-6138-4c2f-b0ba-4bfbb55b83aa", "comment": "Malware payload (CastleRAT)", "value": "7ecf7c1fbcbd0a5cdf683fb1cba2a32d3c999648a3262626345bc044a7f0be4a", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989301, "uuid": "c8a87535-6b39-47e2-8f38-09052bb41495", "comment": "Malware payload (CastleRAT)", "value": "2b87a37b04f911607055d773b66623d86e501460", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989301, "uuid": "3c464d6b-b425-4ccb-accd-89069a9f7401", "comment": "Malware payload (CastleRAT)", "value": "70fe88dcd70af36ebd0bc468136cbabc76eb309b113215a04d2392ee56fa164b4c08ab76b0c6b887f27ea625b073c73c", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989301, "uuid": "99b42142-f36a-4a7a-80e5-1290760ac6a9", "value": "T1A2D533840ED3AF02254F3BA8ADC754798BC46848562FCBF856F872F1E3F9593E189512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989301, "uuid": "6fe55cc7-52bb-4607-b705-cfd65c10e01a", "value": "49152:EHG68D1evx17jUW7OZs9miWAd6skuZO8jrXpKoY6hZKVtQda0d+cha:EmJD1S17LosBW1skuZO8jrXgoY6hZ9dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989301, "uuid": "7debf7a8-f477-4f19-b871-394e0b7a697b", "value": 2859708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989301, "uuid": "5a8c97f3-1f55-431d-bbd5-c220c6d6206b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989301, "uuid": "e3492706-fb5b-4679-a18c-eb39f5b0246f", "value": "7ecf7c1fbcbd0a5cdf683fb1cba2a32d3c999648a3262626345bc044a7f0be4a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47756339-b713-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761995387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995387, "uuid": "697ded4c-568f-46eb-97ac-46557358e264", "comment": "Malware payload", "value": "4e3cf934b2f079ac3c82c2838dd184c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995387, "uuid": "7f8ff8ce-d954-4c1a-8f99-ffd1afeaa15e", "comment": "Malware payload", "value": "7f3b8ae4271af82ce9bf08caaf553cc16687f89224b0883425a805eee0c5e96a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995387, "uuid": "ca7a60b0-d029-4b7d-9ec5-f4c4a7898563", "comment": "Malware payload", "value": "f65fda8223b4242614c61146133adb6e8cd18699", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995387, "uuid": "d7d60fbd-224d-4c54-a3e2-7719c7c9d47c", "comment": "Malware payload", "value": "37004fb3c1aeda88d05a55ce11b408a4a704d34a4c7ce80838bcfbcac7ee75dc23c58d832b5a37678ace49c2eb2116a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995387, "uuid": "76a5587d-1c1f-473c-be2f-274a2c83f0ab", "value": "T112C08C91853CC87263390A5EB25AF1F89D47A8280FB03871E8288A40A1740700C8F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995387, "uuid": "2b333f61-8c88-4ff1-9bb0-e00e08fad64d", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfNHMK+MREtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMflddebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761995387, "uuid": "0208e63e-9b06-43b4-be2c-de87bdec0120", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761995387, "uuid": "b86cf6f1-e975-4671-b9b7-8e177873927f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995387, "uuid": "fbb168f1-226d-4a3d-a70d-2f244387d811", "value": "q7d55g9zi5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b607a29-b754-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762023284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023284, "uuid": "1cae0f5b-fcd8-42ed-a913-107e90d3a3db", "comment": "Malware payload (Mirai)", "value": "232b2021dc9d01249e0e09c0abbfdc77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023284, "uuid": "cf69c6cc-a5f4-4f58-b228-783ce348a2c7", "comment": "Malware payload (Mirai)", "value": "7fd9cf41810ee66b8e90286404a9445095ec08a083ed569e1b8ebfdc264d8a38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023284, "uuid": "e6a3e5dd-9d05-4786-a3ed-4f200ec49430", "comment": "Malware payload (Mirai)", "value": "0d4fde66044ccd4152c85119342bad5a2604c13d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023284, "uuid": "a1e7dbd3-d20b-47ed-80a3-115a460b0436", "comment": "Malware payload (Mirai)", "value": "d4843300bfac47ea651ddbe6fa405759a0b79799c88eec372472a94f7872352c79c2e80b83a006c64a0afb1266100f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023284, "uuid": "fe192ce7-7138-4fae-ba56-b1cb2d46a3a7", "value": "T1AFE2F250A2436852C7C29B3DB4C1CF4CE29AEE9579E4139FCCA1ED2C6217594893BCA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023284, "uuid": "5cb6e401-f1e6-450e-bd58-1ec02c2ab890", "value": "768:BsAQTbnxL01sCyLFGBMtRhpOawbCY+JcFnU7chpGOc1qIoXMDPudZc8:GAQTbAxyLFNtc2Yc1zqMDqa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762023284, "uuid": "63e53ed4-59df-4ae9-b18b-381eeb589dc3", "value": 33788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762023284, "uuid": "927ee921-1a0c-427e-9703-ff79bb2ef6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023284, "uuid": "ec3edd02-cd72-4839-b6c5-9f1ce4a36ac8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a942b6b1-b6e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976654, "uuid": "dc798618-5b17-4ce2-9682-73fe5a8bebd1", "comment": "Malware payload (Mirai)", "value": "f85b484ac4cd7a4bd186b51778aa4105", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976654, "uuid": "8cae30ab-9e8c-483e-9de9-716bbcd7339c", "comment": "Malware payload (Mirai)", "value": "80287205fb74c258a105f02fef8368678597ba26c2327c9c00fd2d5368b714f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976654, "uuid": "880ac940-4f7e-4153-bc97-fa5e20879147", "comment": "Malware payload (Mirai)", "value": "8746c21354464cbda985aa581e3c6cb4a7945890", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976654, "uuid": "ea92e575-ad52-4dd0-bdbb-099d05e7ae17", "comment": "Malware payload (Mirai)", "value": "c263b5ba120b37ceff81c92620556b2650a4cf095d160e2c5b49088946b4024a3366b7cfc26fc5c638dbf98bfd023fb5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976654, "uuid": "e5d15cea-ae07-45e0-bfae-0e26962ebbb8", "value": "T13001E59A1A1296F49459CA40F9B28464D40CD3A228D14FB1DACF9FA3D45E65C70B1F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976654, "uuid": "e426bdb2-b131-4d12-ab23-109258025aca", "value": "12:784HPS4HyS4HxS4HDS4HXkS4HbS4H7bOS4H7kH:oSPSSySSxSSDSS0SSbSSvOSS4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976654, "uuid": "0724271b-e5a0-4436-ae66-27a617b3a578", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976654, "uuid": "45f2abe3-56b4-4ba0-a6b0-843301e1850d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976654, "uuid": "dbc6015f-0d34-4379-ac69-108673c5f294", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ba085e-b6dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761971646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971646, "uuid": "e1ddb019-d8d5-4fd4-8a6e-d8704bb96bec", "comment": "Malware payload (Mirai)", "value": "30c71093429ba4c84db0a4a501a4d9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971646, "uuid": "8e3ff1e9-8b77-4cc8-8c90-a556b2e4842a", "comment": "Malware payload (Mirai)", "value": "8111e97b7fc27febbfb0aabcd9e55150227c984d117ecfd13b7a7edb1383c6ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971646, "uuid": "e6d56149-86f5-4ce3-ab28-cbffc8e02a83", "comment": "Malware payload (Mirai)", "value": "16230fed1d5a7da21eeddf671aa6039b2c8698fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971646, "uuid": "bf0de286-774f-4203-a2f7-4a2f1d1bea95", "comment": "Malware payload (Mirai)", "value": "64a829f5822d1e2449927387053dc5251ad778e160befd9674438749a036912b8ce7b7dfe22fd7564b17a7e7f4ab8556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971646, "uuid": "9c7a0f92-f6d8-44d5-8ae0-0bdee0b38b5d", "value": "T11263121E280822C0E9D097B87FB893975690E10D8B37D3BD9FC6E848ED448D758B568F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971646, "uuid": "d54ab193-d5c2-431f-a806-d57a4899da85", "value": "1536:MnCb7dMGiAkPOvFCPuU+s18O+MVaB0B181kobc7oUQJpqrBNK:MCwOvFcuU/VlIB0B181k060MBNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761971646, "uuid": "69f58182-305e-4ea9-96c5-ef4b21367098", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761971646, "uuid": "d68f6032-9442-4913-8edb-5f3c3172111a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971646, "uuid": "8fb8f30e-38c2-4b2e-928b-7c87c97185c2", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d57ac07-b71f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000605, "uuid": "d85a55c1-715d-4fad-91c2-3a3fdec3e000", "comment": "Malware payload (Mirai)", "value": "5f522f624ff9fe7f96b3114944a574d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000605, "uuid": "b1fefd10-3db0-4631-872d-c74b955b40d3", "comment": "Malware payload (Mirai)", "value": "8206e1307185b0a4fea5e1eaf3f13306fcd5cdd937b1fe8c008cf18286a98f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000605, "uuid": "8dada4be-a8f3-4cf9-9fd1-23a993f4d54e", "comment": "Malware payload (Mirai)", "value": "ab8c123cb83313931953163cea95b203b6af02d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000605, "uuid": "94937cdc-4948-4f8f-80ad-581cfbae3011", "comment": "Malware payload (Mirai)", "value": "87072f32337432cad6ce67ab0ba740436cc8e5d0d06b8fa7eaed63f939483d9fff0fd9e73595fa9d39c43668fe0e55be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000605, "uuid": "87f35764-da13-48a0-bd27-4bd204f7b0e5", "value": "T1E6434BC4E543D9F6ED48067820B7FB365631F13E1028FA87EB9AE672B941601E64739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000605, "uuid": "606580da-2e20-439c-945c-2b5f29fc0a52", "value": "1536:3VPq9tMqNP0Ql11WIJ5YKiWxWpvP+hNGp5oKz+PEtRR:3VC8qNP0i6IJ9iO83+wom8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000605, "uuid": "e59b3b60-b124-4747-b4d1-b839f7eba7ec", "value": 55940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000605, "uuid": "5c1a5010-f8f0-468c-aa5e-3e7bf62e09fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000605, "uuid": "e5f267e5-031e-4216-ae15-29b1337e2f3e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804193f6-b752-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762022541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762022541, "uuid": "577b14d4-bdfc-4c7c-87ea-a4ec5710dae6", "comment": "Malware payload", "value": "63dc7c2a5723f7c04975c7c5b9f93122", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762022541, "uuid": "3e1b4ebb-7c20-4217-9bf5-2443931a0c21", "comment": "Malware payload", "value": "82fe41ab7bad3d80b8f10364048469a69cec4b982040b5a9b51e2b5a99540667", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762022541, "uuid": "881721ec-8d7f-4c60-9968-420aa3c938eb", "comment": "Malware payload", "value": "6be2746cb2b67fbe683b6497cfda0d0065f6ca3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762022541, "uuid": "8ab0f9f1-2478-4acf-915a-936d40b76a4c", "comment": "Malware payload", "value": "5316b3ff5df5f7cd82a853ce3deaf025c4d18a67d75c8f7e8aa08036f3ff3679320457c5d7cd575d2a7b4e9a950af7b0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762022541, "uuid": "39c4a2da-c64f-4efb-a6ad-923b12753f70", "value": "T1A7E59E17ACE10668D0A9A33489B252567779BC0607362BD72F90B7783F7ABC05E3E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762022541, "uuid": "5e5a88fd-7cb8-4173-bbca-fbc0e3a04107", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762022541, "uuid": "77d7cc4e-b8ca-424c-a8f2-048c117cd376", "value": "49152:tg5epQ5mT6iVw/tycXdAP053wM6I2mIJ8fJN:tGcKWP0JwFm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762022541, "uuid": "223f7780-0cb5-48f2-b66f-22e5916eafdd", "value": 3144352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762022541, "uuid": "b57e1baa-16de-45ff-8129-9a2e820b8b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762022541, "uuid": "a810ead3-4776-4dc8-9dc9-8957afbae181", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b986f07-b6eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978161, "uuid": "87ecc481-1ed1-43b6-9dea-96052ddf7b87", "comment": "Malware payload (Mirai)", "value": "d15fce2f2b7d5e4bf01a36f4165a7b40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978161, "uuid": "6fde5d30-1e53-47ff-a004-74c9680d36a7", "comment": "Malware payload (Mirai)", "value": "835553b8614496287d7be9f76cbd7cde0abb23eaaf45042185a9ea456db7dca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978161, "uuid": "b3276586-3af6-459c-ad73-c1dcc2bed8bb", "comment": "Malware payload (Mirai)", "value": "b50ba7580b1f1a56bb4da324e9ce8d368e3bbd3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978161, "uuid": "c19450d2-65bf-47de-98a3-f2d12eabcc70", "comment": "Malware payload (Mirai)", "value": "ffe20639dd0ee5d243778b0158d46fafa33381c47331578ae5a70809dd28a3c03995a1b936070b1716bcc89d56335791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978161, "uuid": "8603629e-af50-4752-a45d-3eb192a686eb", "value": "T10CB39DDBF3470191D86346F447CB4BEE2E2322822F1789E73C6A253A6C761CB4906F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978161, "uuid": "1f70e42f-1d0b-4ad0-aae7-0a0ba6925dd1", "value": "1536:GETm31bqZ9RY8fX6ddJr6/hhWt95YgRS/LWZm:GE4qZjY+XOdp6TWt95YgRSqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978161, "uuid": "3be829eb-fca6-4584-9e65-4321c2cea6e6", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978161, "uuid": "afc41dfe-77de-4764-9a05-055b35275f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978161, "uuid": "08e3f8d5-9b64-43bb-897a-0c0ca488db88", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9052fb-b733-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762009061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762009061, "uuid": "8294c57a-69be-49b8-92cf-5046b9d6802b", "comment": "Malware payload (Mirai)", "value": "718a512a34fb4626992f511e06aa1cb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762009061, "uuid": "6ef00977-7b40-423a-bdd3-c1471cbe0037", "comment": "Malware payload (Mirai)", "value": "84c60aae6337281f26785177548ae102fbb8d3ca1332062236e0100e404972cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762009061, "uuid": "a9e9408d-4768-42ec-9764-9afa25e0b912", "comment": "Malware payload (Mirai)", "value": "52ff1376b9a3bbcdfddcd3a58bb4c8418877ba0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762009061, "uuid": "78361f46-ee3d-4b12-882c-ece1c11b10aa", "comment": "Malware payload (Mirai)", "value": "91e208709689db1035b466a85d1ed1e2507d3db9006430ea7b37952158f35d9d05ceae48486ff353f52384dc943df6e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762009061, "uuid": "ff9539f2-3339-4f4d-86ac-2a43752a5423", "value": "T1FA519FC70225453D6CA7BA23FDBE9F2C35C056921AE9BF8697EC34B5528CDC8B044A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762009061, "uuid": "ceb5f640-3ae2-4c3c-b869-230890a3e98b", "value": "48:innenhmlnncnnElnnvnCXlnnrnePlnna4nazvZlnnaynaFvjlnn9Nqn9z4gelnnh:iumlOElaXlSPlazzvZlaVFvjl9kz4Zlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762009061, "uuid": "3024d5f8-9f2b-4d6b-aeba-00a0b286c3e8", "value": 3019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762009061, "uuid": "f5557c6a-c7c4-4a1e-959c-03d6bf5f95e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762009061, "uuid": "d55fb7f6-d1f5-4ff8-8e88-cd77015e7a06", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb722fff-b6ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761980120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980120, "uuid": "4e52de78-14f4-48d8-9544-7e3a999e0f9a", "comment": "Malware payload (Mirai)", "value": "741f985205a7168a483b8f414a5cf703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980120, "uuid": "7426e27a-440a-420a-bdd8-609506580d25", "comment": "Malware payload (Mirai)", "value": "8639871e7ad16e28f6d46d428d654f371be7cb5972adebe5794c04f63848a450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980120, "uuid": "ae8c3700-a8d9-449d-86b3-6779b5cad7d4", "comment": "Malware payload (Mirai)", "value": "6d616de0c62fda5308d97fce466fbcfbda4d28fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980120, "uuid": "077fdfd9-74f9-4c6b-991b-b2941a734c39", "comment": "Malware payload (Mirai)", "value": "07722ae2f8697ccedf2630718af8f203feffc0dbe1e807cc3c3c834b333f199334eaf0f60b1a5d068a64e4800bb24e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980120, "uuid": "44ebe28e-e624-4fdd-9b2b-9fdf6f3f2561", "value": "T11BD3CF32E0086CE0CD22067474B6467C1750DEB807E95143EFBEE59E28B7D9579EEBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980120, "uuid": "044cfe77-572e-4e58-94e9-99f84f38de18", "value": "3072:ZiZDnFoBAc+HQF1cWWpQH8IEWq/GxxPzlpxVItkZR:ZqrFsc1S8IgeLppx2t+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761980120, "uuid": "719e24d2-19d0-49e8-a9bd-909854cf4278", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761980120, "uuid": "a74c3bcc-e057-408b-b7e5-9f9f404edc24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980120, "uuid": "f34d7bdf-01dc-41c9-b139-5cc193613bd8", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86dd15a-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761986665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986665, "uuid": "3b76c965-34ba-4461-8ec8-b74f5bcfbabb", "comment": "Malware payload (Mirai)", "value": "6e042e03a49541f77928dfe214650d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986665, "uuid": "1287c928-0977-4eea-acd7-59ceee3c085b", "comment": "Malware payload (Mirai)", "value": "86471c71361de7985f07305c6870d4c13c80a3ff716c1923225bd901ac92e623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986665, "uuid": "03d6c327-5610-4063-aa82-944dc687fede", "comment": "Malware payload (Mirai)", "value": "bebb72016db10ec1b3ed344b068eed1dfe7451ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986665, "uuid": "bdeae7f5-6c72-4957-ac8f-bc94883730de", "comment": "Malware payload (Mirai)", "value": "5074fe044e89f2b13c6749e2ed98db6637b762299510ac780c040fe8ed827884fbd1fd793a841fefe9e31a74d5413896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986665, "uuid": "416d5514-0375-44c5-a6a3-47fc0fa9224a", "value": "T1A0D3C70E2E214F6DF76CC33587F78E21A75873D626E0C685D2ACE9151E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986665, "uuid": "6995656e-dffd-4e8b-9bc4-505d87fceea0", "value": "3072:ZIQJHnUSnD+uMrzKM0E4hWZ98AispAxgsNUm+SEcPFbvsE3khbE7Xn1s41:ZJHnUSDZMaMT8vH0hYq41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986665, "uuid": "d259f9c7-97df-4826-91cf-99fd5eea2624", "value": 130376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986665, "uuid": "3bd8e53a-d8ce-4b20-bb47-0064885abcc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986665, "uuid": "e0c43c5e-775b-4d17-a344-94c2fbb01ca0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e725100-b6e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974756, "uuid": "ece084eb-c454-484b-9245-a2db873f1b2c", "comment": "Malware payload (Mirai)", "value": "f87e015eafc5ff0d9a5ea8a412ea8d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974756, "uuid": "f08bb50d-b648-4762-b9dd-fe0cae5cd4ec", "comment": "Malware payload (Mirai)", "value": "8764d29da56f569fad79bdadfb8c9d15491d91680fe82063def840c63e4074c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974756, "uuid": "4a85c769-e386-4c6e-8bc5-8482610e3919", "comment": "Malware payload (Mirai)", "value": "202243f2c87380108fd30a6e044b8ded39841a0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974756, "uuid": "eaae4c2b-d16a-480e-9f51-b9d1f09ff4a0", "comment": "Malware payload (Mirai)", "value": "7775594ed38796a3101b079e7b2400e185ee3732b6c1a4501f2d52baa007d9f558da43ed2b22b4db7fa2a2ad4015b757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974756, "uuid": "35aa84bb-41f1-4c51-98a0-9c12e6646d3f", "value": "T10B43F785BC829A2BC1D423B9F6AE658D336073E8D2CB722BCD614F207AC551F0C66F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974756, "uuid": "d29dcd09-9567-46de-a74f-85f47e9a7138", "value": "1536:Y4Rm3JEMd+afXPUpKfs195p6QdCn9gITn:Y4RmZEIudE9hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974756, "uuid": "b70905f3-9992-4041-a038-f40fca6b22ba", "value": 56780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974756, "uuid": "af25d2d6-dad9-446b-a980-7edb8bcaebcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974756, "uuid": "a788d8e5-846d-43a9-b04a-2b44c1de8776", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fe395e-b6e5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761975917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975917, "uuid": "92f11ebc-e835-42d5-8696-1f0024256e33", "comment": "Malware payload (Mirai)", "value": "1dc48f52512f413c75daaee1d6adadf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975917, "uuid": "80bf04cc-2aef-48f7-a19f-ec496a0bcc06", "comment": "Malware payload (Mirai)", "value": "89bab5eb7ac425a4f01cf17d52f6d9cfe29c82af3ec36868561666481d32a2f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975917, "uuid": "644a60cd-333e-466b-9241-2c42e30b2598", "comment": "Malware payload (Mirai)", "value": "abb6ba6f35951584cbea063b6bfdb0913752c31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975917, "uuid": "ac37f9bd-ed08-4d96-bed7-ea2be4678295", "comment": "Malware payload (Mirai)", "value": "cba153091183c9f011b66ffe767dd319028dd4ad674ab49b97852bb4ecba6f8b9b70400247794ae0f849812094e88b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975917, "uuid": "5be743e0-2c6d-4f2c-8b8d-39b9d9326309", "value": "T1595301DA771D6BD6FCF8C2B41250816CC672009662C6E1D9A5D498FBE74BD0530972CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975917, "uuid": "5da6baef-b892-435c-a7d6-04a2829f16ae", "value": "1536:VZ4RbeOq0pLdlZMDHyYOX8LSjFt4V65G73YAQR:VZ4EORgtOXLT4V6qQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761975917, "uuid": "7b3e116b-8ea7-4289-95f8-a9bb0bfeae28", "value": 64820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761975917, "uuid": "9c000304-3bcd-4b0a-b08a-c39180dd600b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975917, "uuid": "ac1e8584-e6c8-4a96-9ad0-e470add4c7f6", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ed5523-b732-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762008691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762008691, "uuid": "0b396d58-ac91-4c08-a5e9-782fb2dedf88", "comment": "Malware payload", "value": "718a6c038a521663131d6a703ef5bb16", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762008691, "uuid": "2015ce22-9064-4791-8a00-517becfe9fc1", "comment": "Malware payload", "value": "8c55d9f35eaaca4930c561735658d4183dc989d1b315459753b64821bb210f36", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762008691, "uuid": "86a5b7c3-c05c-4d2f-8174-488d1c650259", "comment": "Malware payload", "value": "377e9e5bab064e2213b23c9597efec98fa7f4f97", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762008691, "uuid": "2195a7be-3aff-4363-9e9f-7fe3707b7560", "comment": "Malware payload", "value": "de287723ef3ee4414208a8032988ea645dd3e1569206436b0b3c3b87523fb2c5a59937a846a0cd1e23674bc7ee49c3d4", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762008691, "uuid": "d3426d97-f94a-4705-b8a5-190ce4608bad", "value": "T111758C0A6B3B0B9DD55588BED67A1173C5687D0CE01838798EC44B057FA2F609A7E3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762008691, "uuid": "48a573c6-abf9-42f3-9344-b0e4075ea4fc", "value": "78520876bfbd93a2cc73c139c5e634ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762008691, "uuid": "d63ad34d-7742-495b-8882-c01d361d3fde", "value": "24576:eNJ9r0TzPKVysoLnme+sM25bNrMl/D42UhOZzbKuNl+hJCvggR:eNm/nfxNNQlL42UYnKurbvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762008691, "uuid": "60d89b6a-7bb4-4bb7-9557-9945150fed8c", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762008691, "uuid": "4669abf9-20a1-41d0-a5b1-f6b5aac9565e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762008691, "uuid": "670dca16-b578-4774-ad1f-441ea465338e", "value": "wmsgapi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb57558-b71f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000607, "uuid": "e0cf90cd-84be-40ac-90c9-d754ecc310f6", "comment": "Malware payload (Mirai)", "value": "8ff62bfe2bf73d81d785c6fdecb5ad94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000607, "uuid": "03c8b3b5-d059-4975-bff5-46122537697a", "comment": "Malware payload (Mirai)", "value": "8e3b4d67fe786c9d8669241cdd3db09457ed3fb7019fdb6b3856a2085b1d29fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000607, "uuid": "07d711be-b085-40f8-a0b0-7fdda486df43", "comment": "Malware payload (Mirai)", "value": "f99c178dbabb6b21c62b7624786e2a2056466920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000607, "uuid": "7ddfefc0-0cfe-4356-9ec0-0435de4ed07c", "comment": "Malware payload (Mirai)", "value": "875721e46df1e942af935cb10dcbcc6fbf7755f63deb5c52162cc5185d536331c6f71a426d113a4318763c678284aa65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000607, "uuid": "c8125338-a4a9-4745-ade8-1e8156dc682f", "value": "T1AF633BD5F801DE7DF41EE7BE8453090AF730A36152C30F3A26ABBC57A97216519A3E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000607, "uuid": "7a23a55d-fb01-4f62-a87e-c40f3563c5a3", "value": "1536:DHOOyVbzvuG01CtI8TnyWIqJsiiACuBXJ5P2GgwxaEV9j:DuOyVbzvtCCt9yWIqJquB5lIEV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000607, "uuid": "ded61376-455f-4ab5-81e2-4020d572ef68", "value": 71956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000607, "uuid": "f2c12b9f-cfa9-4377-9b8e-f2e12d271df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000607, "uuid": "23fb2bf2-23b2-401a-8ec6-d08cfabc32b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe62ebcc-b71e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000419, "uuid": "187a5d48-3186-41b9-b863-2e2873f021cd", "comment": "Malware payload (Mirai)", "value": "a71939caf6ec7529d8a7a7d8f392578d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000419, "uuid": "7abaae71-2af6-4c90-9e7f-9f6711a6fd29", "comment": "Malware payload (Mirai)", "value": "8fc7587013a8725c838d932caa8f7f9f4100d3d778b54b345e732e897910d90f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000419, "uuid": "f2a84216-b5ba-4f39-9ed2-3386d3312d1c", "comment": "Malware payload (Mirai)", "value": "693814837d1ac84ae5fd825332a2550f1232fefb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000419, "uuid": "438d1d9c-5847-4555-9ac2-6da02d9805ca", "comment": "Malware payload (Mirai)", "value": "9018df4a6e58ee9d725952efe1f7e664f882c674258d907985fce32ce72c6334570b27e17675716220e93220cdfadb24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000419, "uuid": "53219eed-81a3-4dcd-9c3f-04ff1fe8d109", "value": "T11003F15D28B2FC1AC2328971BE1289DC510ACD78F2AC315722BC849979DDEC94D8D792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000419, "uuid": "c0931063-607e-4f3f-afc9-644855037cda", "value": "768:nWhn1pRScWrYbpVchlDiZ9+5LifrrPuDBjLPkPe9dpQXsSl813+7BUy:nWpDMcWypsluZI5LifrrP+fLWcSlSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000419, "uuid": "17ae48b3-6963-4ff4-936a-a7d6be00b675", "value": 38988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000419, "uuid": "2bfbaf51-359b-47d4-b082-97e852df2d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000419, "uuid": "5f86e8af-da4e-4a54-8e13-ee9ad60eaf92", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af1e1ee-b6bb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761957732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957732, "uuid": "b42eb022-5bd8-4922-a351-c9dfba10fb8b", "comment": "Malware payload (Mirai)", "value": "8735ee8e0997d1c7dc84052ee1eb3dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957732, "uuid": "3ebf11f3-9065-4d12-937f-52bfc0bfca84", "comment": "Malware payload (Mirai)", "value": "90d3f07d47fac1b0d3fb334ad1909f84b4c48ae34164cc2969ae399e16e344fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957732, "uuid": "2d83da18-2388-4c56-b0b8-90fe7029e357", "comment": "Malware payload (Mirai)", "value": "9225035f8aea5f046ea8be14d19ea52a15404cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761957732, "uuid": "4872e9a7-f786-4d10-8151-173e0b57eb9d", "comment": "Malware payload (Mirai)", "value": "a3b816f78f02e80cdc8359c2eac2a917685f3cb66669f65ea2830c9190d15049f52d6f81aa72784fc2ec9b4da91ca2bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957732, "uuid": "8edcbb95-9ef0-4a92-94c2-45f9ab68cdee", "value": "T1FB634B40FBC7E1F5F2A345B1021BE7AA5674ED144006EAA5FB0A7F797CB2312295A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957732, "uuid": "e45c7414-4dfa-4880-b7d0-228a01aa7e9e", "value": "1536:GDpyKmbYVAP7UwDPXgdZfCBWDgaxawLSRvorgx/P:aypbeAP7UwDId2WEaxawfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761957732, "uuid": "c601481f-63c7-4f5a-b947-b10230ef8e65", "value": 66776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761957732, "uuid": "8e83b204-321c-4a5d-a228-946855cc3595", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761957732, "uuid": "917f1f35-d40e-4548-86e8-150c33c82330", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8480034-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969431, "uuid": "f79d1e6b-4406-43ff-a58e-6878f0cf773f", "comment": "Malware payload (Mirai)", "value": "4265be3a94d168f0624a790f4c78710a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969431, "uuid": "6cb5f7df-8c2d-4787-95dd-17cab0c101a9", "comment": "Malware payload (Mirai)", "value": "92697280e5f2f175cc9868e836803f3075fe284dcc8119dcfeba4cbc1778f9c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969431, "uuid": "58c5b751-66ca-4c98-a1d3-70bfb2112247", "comment": "Malware payload (Mirai)", "value": "f723a8142b06088778be669e15e5fc9697e33a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969431, "uuid": "192441a0-a4e6-412f-8f2f-1ce75a61122f", "comment": "Malware payload (Mirai)", "value": "e833a6d8e1e7d43978428ab87ad25f62807f7145e815ff4a4cfac6dd66f4efa42acfbd72da1d0b19b021df6caf32c525", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969431, "uuid": "d975057b-f10e-424d-884c-a8ab481ec7ca", "value": "T1F014B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969431, "uuid": "fd735546-d654-4d13-91ee-f967cea7d688", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1PrDV:QDy7dCaWalr3bt+eX7ErZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969431, "uuid": "075666ef-863d-4a81-a36a-f9ffea541aea", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969431, "uuid": "05f3f286-8710-4e60-9563-4915874c356d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969431, "uuid": "fe42b1e8-7480-4f43-8e53-4fb903fff714", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c1bbf8-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761986667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986667, "uuid": "3571a8e1-ea42-4a1c-b8e4-443fad307113", "comment": "Malware payload", "value": "2adb0da2ea4d2c9bfe3d5c5999bc0b5b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986667, "uuid": "a92141d5-cfb1-4085-94e3-266ba4c214b8", "comment": "Malware payload", "value": "92cfb617a9d19a537d19fc8dc19ef1f9fe5a5de726368af327d58053ce0358e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986667, "uuid": "e176cd70-9b3c-44f9-85da-e253c5b52c06", "comment": "Malware payload", "value": "215c25442439c426b7063a66f6fed842ac3552f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986667, "uuid": "e05418de-7a28-403a-9aa0-67ea39726d32", "comment": "Malware payload", "value": "24b3e852c6169946a07fa2fc4d2017160d57927e7ca3edd8870cf9eec8a6b305d6fa1850e68dc730de31390cf9dfcb77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986667, "uuid": "7870b0b3-7eb5-4ae2-9752-a1c1d7e8caef", "value": "T1D5014CCE01A18C7218C54DEBB1634D25E4C6C5E11ED38E88708E0476F9CCD08B171F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986667, "uuid": "dc47d0a1-6a2b-4636-9f31-16b60f917554", "value": "12:iWKDbnPZD5ZIOF7+MB05IsX7ACNk3X70BNk1X7yBNkS:DIbh5aOt+MB0SlmkArkGkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986667, "uuid": "2b35089a-1636-4c9f-9516-a6536f470f15", "value": 717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986667, "uuid": "eb4efdd2-760a-4d52-b3dc-74e0e284a411", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986667, "uuid": "0f45a18f-ba3e-4bd7-94fd-bc5e20625be8", "value": "cn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f89cef2-b71f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762000528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000528, "uuid": "af47e332-bbda-4b4a-9305-457949338970", "comment": "Malware payload", "value": "01893f92f5ef453a6605d2f5103a997c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000528, "uuid": "3a7db0d4-e20e-4851-b5b1-044c5e7b23df", "comment": "Malware payload", "value": "956d607b88f263303037375a1c5e631ac644d447ba1452adfa905656820b66f6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000528, "uuid": "37766642-3045-4735-aefc-09571d9b5c41", "comment": "Malware payload", "value": "633ed1e18788258b5d9175f3a2d4bfba43553865", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000528, "uuid": "95967aa8-5b02-4a08-b838-8dde7f722b06", "comment": "Malware payload", "value": "b73204abf7de5ac0b0ef7db648545d9dc7bbd10a92743e248c855275dea3e55c9aa7ac382b24910a7021fae72eef1e3d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000528, "uuid": "228c70e6-2c1c-482f-9780-d3b3aaeaade4", "value": "T1DD444B4977A440B8E867923CCDA39A86E6B27856077153CF076443BD5F377E09A3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000528, "uuid": "52fe0446-b577-441f-bac4-2244cacfbe66", "value": "5bc0b70caf749d10ae7da841cddb62da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000528, "uuid": "3094579c-a0c6-4d58-8d57-ff5b3fc1bea2", "value": "6144:8/TEllX5eKPFOA8c28cd+TUF2W4HuTxm+EiLCyyw:8AL/FP2mHWm+XCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000528, "uuid": "70996f17-cce1-4c6d-ab5d-c14aedb5f557", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000528, "uuid": "6d25f8f7-7182-46e5-925f-6f0f2f2985dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000528, "uuid": "ba71866e-ed0c-4d02-8587-dd5193195b2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07a3423-b717-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761997362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997362, "uuid": "e6b659a4-5478-4ce0-b7d4-349e56f662a1", "comment": "Malware payload", "value": "ead4001b9ecf4e439a9d557befa4a9fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997362, "uuid": "df0541c8-75ea-4dcf-80b3-0ea78507311d", "comment": "Malware payload", "value": "95a9a2fe074aeeaf486321268e6ec081322263ac834dbdd8055a6d8d4e78f225", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997362, "uuid": "1671db3b-b3dc-45ae-8f0c-a835b0356270", "comment": "Malware payload", "value": "ecc09aae7b53b1523e05b33541ad3a5ae29b8f68", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997362, "uuid": "e694104b-1585-4b11-a426-61e77cf3d155", "comment": "Malware payload", "value": "95c4cd5222116ec3326eea522035b1c2985a981e79a1fc7f5eaf390e453178b5ebdb13ad46e172b4a0e77b4a142549cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997362, "uuid": "eac404b4-a2cb-4756-ae70-3d55a90474e2", "value": "T1C35174E4E269EE3432DFF134E7884271F542B2BE45B4B97054AF5864662C43422B5F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997362, "uuid": "6952fef8-5fb1-4835-a66d-77a35fd2ad38", "value": "48:Uy0yyR848xskjEE8F1lQ3MLIgsgjLJZs//ZfR1IdSZw:63khKlQSIg33JZshLIgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997362, "uuid": "5beb5e7e-fa1d-48af-b15e-5f931a1ef9c0", "value": 2774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997362, "uuid": "c1e67997-76ee-484f-9232-a619de937ad6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997362, "uuid": "9896130b-b77d-46a6-ac3a-35b73a309c79", "value": "lol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc4c028-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989086, "uuid": "925d314e-740d-4184-9576-1f5c3fd66fec", "comment": "Malware payload (Mirai)", "value": "8c1932df5800b4cd2cb57eb1eba9dd21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989086, "uuid": "3abe83a0-e425-4de6-b776-6794b93a0627", "comment": "Malware payload (Mirai)", "value": "96ee22dc876187968375ac451baae8bfa10f773bb45e123619291f4ffc2a9a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989086, "uuid": "b7e53d47-965c-4157-833c-d9496fae9b98", "comment": "Malware payload (Mirai)", "value": "5cd85ab8014cde236ff72d9281adb4b769f19530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989086, "uuid": "573f4500-0102-45ee-b38f-43509dee4c2f", "comment": "Malware payload (Mirai)", "value": "1418876941a4615d1da25c12f27c2ba55cfec91d42c0d194e2396a3a490eb5093251fdee7b95330bc04b6cde3b0d01df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989086, "uuid": "a4925720-3bdf-47be-846a-8456177360e6", "value": "T1AE330951F8C26627C1D013BAF6AE968E3731B3E8D2CF32179D215B113B8912B1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989086, "uuid": "68faf145-4491-4f45-970a-a805520fe31d", "value": "768:cyn1fb2q+eQKxuoKISE4XMBegszVnxPFurUQrVnLGRCsn4Xyw2HQkN+wJZY10U:ca2qJQWHXh2VBFurUQBnLGRCsnvJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989086, "uuid": "1c0e9888-57ae-4565-8f6f-0517b962c51f", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989086, "uuid": "50026dc2-66e1-40f7-b1f8-a98436f86efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989086, "uuid": "1e785327-fc41-4824-aa52-379f33b3ffa4", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ce1e0d-b6e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973480, "uuid": "177821d6-2414-4d2e-b8a2-5da71eea983d", "comment": "Malware payload (Mirai)", "value": "2959ad5bf21844abcb1c1e2bdf0cfc54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973480, "uuid": "ee6b38aa-1a2f-488f-b9fd-cf860d735f51", "comment": "Malware payload (Mirai)", "value": "977d5917e7f0c3e9cdd4d27ab35c8a28a2b059870c948c390f920804a6c85928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973480, "uuid": "a15afba1-009f-487f-8509-92b6964d811c", "comment": "Malware payload (Mirai)", "value": "d77157aa9ee9ac138b97ec0f6cbe7912373b8126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973480, "uuid": "07b31fe2-4bd9-4a2c-adf9-c153eb2f5398", "comment": "Malware payload (Mirai)", "value": "c2faa51b1f5bb24ad017ffd27371d1ce070bedac30918ab5604dd9d5ab3ad77745fce37848107ce56f98399adb4d2538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973480, "uuid": "696ccb64-38d7-4c31-a545-a95bd80d2d66", "value": "T1F1E32906731C0A07D1A32EB43A3F17E083AFEAD125E4F645255F9B8A9671E331589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973480, "uuid": "e2a7bded-81ee-47bd-972e-fa0f823f48b4", "value": "1536:qASUfmgvRHkrNxBo6GwTxx8bShlymrBvANBhDEDFFG6hOqk+a0iaQP4Mwj319F:qASUMBp/TxxvymyNaWluj319F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973480, "uuid": "a86b1cda-6678-47af-9855-c7afabc34e16", "value": 154292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973480, "uuid": "ac7345e4-71c5-4263-9338-c71f2fe5d8c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973480, "uuid": "1231f84b-5af3-485a-8812-c9ac00c5ba6b", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dba8c0-b77a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762039838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039838, "uuid": "cc9a1506-64ec-4d53-af46-8950b6e05333", "comment": "Malware payload (Mirai)", "value": "cd725e4692e78062282e4b9527915f29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039838, "uuid": "67cf8362-21a6-41bf-a353-6707f4491bd9", "comment": "Malware payload (Mirai)", "value": "97dc12e3b787a103198163487edf73e9d58b0d3e01fc613af3070904442880cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039838, "uuid": "0d8fe349-eecb-4936-bf86-0bace30222a6", "comment": "Malware payload (Mirai)", "value": "1a02fe933bfeba3db23a0b4a94430459b225b4c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039838, "uuid": "237f1a97-d74f-4ad0-b781-110e600f4161", "comment": "Malware payload (Mirai)", "value": "3adac4de85ddfa5939246c6deb053bb68e20590ffb9c3ed8bc0d65a0f7eef3921b728d567b619a1834884263e89976f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039838, "uuid": "3530a9c5-7c10-4158-8d4a-b7d8efef582f", "value": "T10C04885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039838, "uuid": "5292c6f8-b40a-4989-b292-bdb74875ca5e", "value": "1536:Cl2JvnXPvLhQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/1cwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762039838, "uuid": "ea78bc82-1cb7-42e4-a1f9-fca1f75c9b49", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762039838, "uuid": "18d2d1ea-348d-4271-90bc-da976bbb8c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039838, "uuid": "5a638b10-d58b-4eec-8673-003efb418326", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bac506-b720-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762001243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001243, "uuid": "2006101e-465a-48ff-ac34-2dde5501479c", "comment": "Malware payload (Mirai)", "value": "7f3d6da4d849a80ef9bc77ca38787022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001243, "uuid": "1fa14c6a-88b0-42dc-8ff0-21e488d48ef8", "comment": "Malware payload (Mirai)", "value": "97e9b80935c36c5ce6e5400f745136f49a848c79dae3e5d549d85a52c9c35c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001243, "uuid": "d8c9d52e-3164-44b5-9c11-4dd3d53c0385", "comment": "Malware payload (Mirai)", "value": "52b79a130fd4da520e5909e805f51e84ce725b76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001243, "uuid": "b4b317f6-1993-40ac-9601-25b79dd3cb5b", "comment": "Malware payload (Mirai)", "value": "1a521fac46924c79cd2fcd2a02aee2bc876ba4fbc3383f9712d730ae61bb691df31699e6eeeae5a4aeefa8237e8d1967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001243, "uuid": "fc03e17c-eba4-444a-bb54-e6fbfe507f0d", "value": "T157733925BD361D17C0C5A87A21F34768F1F6938A26ECCA1E7C620E4EBF2465071976F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001243, "uuid": "ad092f07-4367-430f-b64e-27fc4d343b17", "value": "1536:U7ejuw+sIp6PN0aVt/auwnmr7e1rqDQll5Et+ju8tlXRCAtE:qHt6P6aQmr2qklXElGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762001243, "uuid": "ca28db2d-e0a9-4871-a056-88b6719affc1", "value": 73724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762001243, "uuid": "c1ae1aa0-ed7d-4b65-bab7-830e4b7410bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001243, "uuid": "f2ff01c2-53b8-4d7a-8e79-6ac9c9d9ac23", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.29614.23964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350376e0-b6e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973452, "uuid": "6e94cb3f-fad2-461b-875e-24619b5bc228", "comment": "Malware payload (Mirai)", "value": "239c2d24f6952006985ac81abb7e0218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973452, "uuid": "08fd2214-e1a2-451e-85c4-1d536c837508", "comment": "Malware payload (Mirai)", "value": "987fcaadacdc03d1c99244a698676d2095621e53540fa0e37582e15b206cf30b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973452, "uuid": "b1e75137-75b1-47f2-8663-e9ef95c2bbd8", "comment": "Malware payload (Mirai)", "value": "e6c221d81175df89fdd29455037b0c94c147ae9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973452, "uuid": "ac21ec77-3bf9-48d9-a84c-73a12ed31a6c", "comment": "Malware payload (Mirai)", "value": "ec992ad88a30f193832083713944665c84ae95925fe4b1eda794b273710cc8e323ad2bddfbebb43b0723a40d3744d5d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973452, "uuid": "b036f73e-1f33-4f19-b7fe-d09119fcc594", "value": "T19933F144EEC02F97ECE91A764C66D18133F0AF5F979283FAB41392517943A327940BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973452, "uuid": "51271e73-0a50-476a-b957-33db6d0953a7", "value": "1536:S+orcH+lieuWRUEWO6QQozRrm4meh4u+qgw0+z:OZNUE0fozpOeh4u+qgw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973452, "uuid": "4a476f9f-483f-44a3-939a-ee1aad34a2a5", "value": 52136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973452, "uuid": "30cb22fb-de9e-4d90-ba4a-eeb8b841b911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973452, "uuid": "7c7cc696-5b5b-4bf1-b3db-ba3cd0ba1327", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0175cfc0-b6f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761981526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981526, "uuid": "039559d7-6d70-47ae-afaf-3a507bc18bd3", "comment": "Malware payload (Mirai)", "value": "783ba1ae773f62d5e2da715787cf478c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981526, "uuid": "b577cb39-c3e1-4914-bde0-64bc3b079891", "comment": "Malware payload (Mirai)", "value": "994557a745fe75ed950184d17299ea76f37a9a85c3db073537114cdf515ce522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981526, "uuid": "2da401f3-2f33-463a-bbc6-54c2609834eb", "comment": "Malware payload (Mirai)", "value": "804e95f34b64569bb5bd2ea9ad5640006e84a1a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761981526, "uuid": "d1099657-9292-4d42-a73b-3e94cf9cc5f7", "comment": "Malware payload (Mirai)", "value": "eb2f32a0cf7783dc520d9ef611ce5cf747b088f5bd84f3d7cd08e71b438e125ed89dcb908895a91e498ebc5eca4a9ce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981526, "uuid": "c14310b3-ed07-4099-a75c-72e7975d1f06", "value": "T1C4B30885B881EB21C6C256BBFF4F428E7316539CE3EA3203CD195F6136CB55A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981526, "uuid": "34eee29c-6440-41b8-9f8e-d9ab06e30581", "value": "3072:/jddh2hhFOWLv2dBji10mV9I7FNe80kwtrmXrd4F+wa63vhBynwvGznz2:7dd0ZZLv2dBji6mV9Ihc80kwU5ht4vH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761981526, "uuid": "79662704-cd52-4f20-87e7-12be380b6cdd", "value": 115896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761981526, "uuid": "ee4f41bc-2acf-43e8-925a-4f9230fc9e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761981526, "uuid": "9ba20ce6-ef8f-47ba-bafc-10341e97ef13", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177f184f-b70f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993589, "uuid": "0f4017d8-1947-4f13-a691-146ed58d2bb8", "comment": "Malware payload (Mirai)", "value": "572bb24a2893aa854eda6cfe422018d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993589, "uuid": "fd75a76c-8af3-4c2f-9ee9-9a4afb104dd7", "comment": "Malware payload (Mirai)", "value": "9c4cc4e72d3d9c988b58fc2c0d993d160e0c58ea62a412f4f76415deec2d463c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993589, "uuid": "a393709c-1f91-4112-8bd6-278b98a3ab30", "comment": "Malware payload (Mirai)", "value": "b64c7be34c08903d4aca5cbae772d2a9edabbf52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993589, "uuid": "8388520e-d4bf-4e30-816f-f78c17a30243", "comment": "Malware payload (Mirai)", "value": "ec2771c6a176d55bc4c6c41e194e45c10b3801e936ae995458c45d5a8d43903b3114c7966ede3344ecba98472bade734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993589, "uuid": "258434d9-fc62-4e9d-b9ce-b3f08b3f2d62", "value": "T1C30429D7F800DDBAF80AE33748530905B630B7E604929B337267756BEC3A1991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993589, "uuid": "fe8be248-5f1f-4a5c-b418-bcf09b4b6217", "value": "3072:q6cnuTA3ZFaoG5/LJcBw5Yt+Apy0jfdVNjbiOLLLEIyaeAyuh/F5QK9/:JKB+Y55jf/LvEIya0qQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993589, "uuid": "6c124d9b-c31a-45b9-87b9-ba9e114b1593", "value": 173312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993589, "uuid": "c505d57e-a616-466b-923f-ff51a46afb59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993589, "uuid": "282c95d6-bb13-487b-a534-f7cba2251559", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d851b2fa-b758-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762025266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025266, "uuid": "a0a8dcc7-f535-444a-83ea-cebc18b0c7ce", "comment": "Malware payload", "value": "81e10c6d074fbceb9614e221599ae4fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025266, "uuid": "03dfb209-e620-41db-9576-65664c7e8be9", "comment": "Malware payload", "value": "9c829b44d9b4a5f07d905e4c3cf579e7a767ee3ff4bdbe92d5eafa50555f4981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025266, "uuid": "a67e5a3a-6b0d-4f46-86e8-ceff06349b92", "comment": "Malware payload", "value": "81b5061d953e2b66e1c0cd85601306743a5aa288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025266, "uuid": "6f7ffe01-8332-4692-a9b8-00be4efbeca6", "comment": "Malware payload", "value": "3e6b3197bd65bb29c47d64e86e2ad50aaf4709c99f602a4c5a3a5b9aa12ba8ff9715b03d80bfdb284a091ff10adf378a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025266, "uuid": "0d102890-7c4b-4cf8-8770-474dbcef7775", "value": "T190C30796B891AB25C6D156BBFE5F018E33131BA8E3DE3203DD145F6477CB94A0E3A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025266, "uuid": "e538885a-599b-4795-8dc6-6e55b589151b", "value": "3072:JO9vxFtv1++XjPs3e96XqRgjEl8KAv69I+t771oE11nza:E9Ltt++XjPB96aRgjKU+Rt7P1Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762025266, "uuid": "590cc0d0-ccd3-474c-bb9e-0f0c69ff1ae5", "value": 122036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762025266, "uuid": "2c19f8c5-82c8-4e02-8e6f-65767f417d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025266, "uuid": "f656fd49-3b54-41b9-9c62-f185fae70887", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ef0399-b6e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976655, "uuid": "3fac0763-0139-4bff-adbd-8d11a3da3248", "comment": "Malware payload (Mirai)", "value": "00a7dd675442e06732b3bf1cb9ea7b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976655, "uuid": "803225ab-366a-4e78-bf4c-b2e1e651594b", "comment": "Malware payload (Mirai)", "value": "9c86e39eb15884d38f2192861d1ff688d606130d387ab7e6998fa8def647cff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976655, "uuid": "4899fa91-f072-4ab9-9b25-7e9ba551cdbc", "comment": "Malware payload (Mirai)", "value": "9b193ec6c541d1cec29bc0a97fa1537051418cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976655, "uuid": "1711eb05-afa9-4c42-8ad5-241281bdcdb1", "comment": "Malware payload (Mirai)", "value": "a99344b57f40f4dc1eef80b87f8f1b462d2ede8e40347a8cfd01bb45a2c1cd3872f3f9d1ba62c5037b3a63aa9afca5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976655, "uuid": "a3f51e0d-4011-41ac-804d-6771052ab13a", "value": "T19FD3BEDBB64B5921C46106F01FD78F8E3B6362118E0BD9FB2D0EA63B28755CB19067C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976655, "uuid": "4f878a53-ebe2-4344-bcde-e8bc92521ca6", "value": "3072:Ruh2KkxMJ4NK3Q/m3m+6RJf44gfC8tgynIq:esxM3m1E426q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976655, "uuid": "85ed23e2-9263-4760-9ee5-f4c1b5859270", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976655, "uuid": "861439b7-8e3b-414d-a0f8-0785e8791b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976655, "uuid": "4b454b90-0d4e-4d9a-9c53-9ce01486cc71", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75aa29d-b6e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973725, "uuid": "fe4502d9-929c-492b-9dcd-54ad2e96718a", "comment": "Malware payload (Mirai)", "value": "0d7b0b1106917c3f6f71590a70921019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973725, "uuid": "d566d6b8-edfe-4562-9bef-656a730cf56b", "comment": "Malware payload (Mirai)", "value": "9cf9c56f3752709e7601624512a7d53576aff926c950482a7b0824bb8b7f9bdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973725, "uuid": "2b9d08a3-2f08-42f0-8bdf-88001e34cde9", "comment": "Malware payload (Mirai)", "value": "a508a2083d786e63821cf7b957247c3f84d74d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973725, "uuid": "799e0507-2ed9-497b-9338-4a1b9263974f", "comment": "Malware payload (Mirai)", "value": "779a39211baba8541b84964c2a90fa035d5d10bb04b9a369420f66244b93103fdf689d3cae2214c843cd860965c93b8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973725, "uuid": "b40beeb0-c9de-46f2-89cb-59d50a2b8a5b", "value": "T144430270A472DEE8C2D850F3D23CE2C769545A37F9F82057598C81A2B6695660DEF0CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973725, "uuid": "e8fbec69-58cf-46e1-a7e6-f033b0977849", "value": "1536:b2tmtAhcDQPHU1quSfGJmu1QnIwZ8gDLLZ7lhgLt:6GDyHGquBmu1FwZdDvZ7leLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973725, "uuid": "61361969-166d-425c-9996-85d5cc9aa4c2", "value": 57860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973725, "uuid": "13d90929-02b8-4b7e-90ac-60948df948a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973725, "uuid": "221b3c46-8bdf-42a3-838e-62f060a2be33", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66bd6fa-b777-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762038577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038577, "uuid": "5ee1058d-12de-4f35-8fbb-69bfec07d211", "comment": "Malware payload (Mirai)", "value": "2d7a64679c061f4f6b305abc115349ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038577, "uuid": "fafe9bdb-f384-44b0-ac80-b4bfa9165d1a", "comment": "Malware payload (Mirai)", "value": "9dc7adb23cbdbc3552257f42f94c4323d508accb063651711a374f8d44d0ba99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038577, "uuid": "dd8fe885-36a4-4912-a2cf-c1c2d6c21ace", "comment": "Malware payload (Mirai)", "value": "2269ebf95636ec6a935038fe35bbab05bbd95c02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762038577, "uuid": "afc56797-34b6-40fb-965b-7316c8c5ad6e", "comment": "Malware payload (Mirai)", "value": "6d22e2ee86d078cb935af85d200fb87c7c5f6dcd5a4e7abe26065f3aa01e0d4478c63da31e658ac330753d7d1fdc66ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038577, "uuid": "aff0fc4e-2595-4b2a-a3f5-27ebb224b968", "value": "T162E329DBF800DDFAF80AE33748530906B630B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038577, "uuid": "22c664ac-d5a0-4d29-957f-88868e07b2f5", "value": "3072:jRsZqqhrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:tsqnfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762038577, "uuid": "30406738-e4b0-41f1-abfb-a86de8d08f91", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762038577, "uuid": "608f9823-1a5a-40a7-9632-043c4192637b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762038577, "uuid": "87a62d7e-fe3d-4d94-87ce-b0b8753d6e8d", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0401363f-b73e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762013743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013743, "uuid": "9abc523a-cf13-4e7e-9b75-d3d89f51d312", "comment": "Malware payload (Mirai)", "value": "67698e84ea2e7a8abe53b6470413a08a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013743, "uuid": "70870a00-5a85-4679-a785-730a6524baca", "comment": "Malware payload (Mirai)", "value": "9e9b82dcc8bfedfed7c94008fbdf86de5462afcc2196e55337063eb05d00a9a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013743, "uuid": "5f8487f5-0d37-4ce7-9bcf-eb233b09b082", "comment": "Malware payload (Mirai)", "value": "9bc0e31e31f7e7ab9a3def028d9c590c8ae1f7bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013743, "uuid": "e491fe0e-303b-44fa-8f6f-d1cef4ac274c", "comment": "Malware payload (Mirai)", "value": "e936d160d1fd7aa62ddc6b3e3457eb8ed0f8b65c8f323da24135b3c6e2d2285e884ddc21ec2100e860d6ae13f5767ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013743, "uuid": "fad374a4-a42a-4976-a6ac-b288513cc390", "value": "T1B273961A3E25DF6DFB6CC73687B78E209788339126E0C585E26CE9015E6034D641FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013743, "uuid": "8d583fcf-3104-4be4-8580-ef192f152714", "value": "1536:nL/Q3wrWZLLDqWERlqWek0rrNkhIKRCJ6jN9oPLJZvuybVR1:TQ3/ZXONB0rrNkhXRCJ6jgPLXvuyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762013743, "uuid": "8566b901-cbfd-4b5f-9721-2f9c4caf3440", "value": 80128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762013743, "uuid": "a21de5a1-fd53-438e-8926-738b63ef961d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013743, "uuid": "4cb764ec-5633-429c-b990-477bc3a0cf14", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b224deab-b701-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987836, "uuid": "9a55d45a-a75e-4272-be66-c6a7a0978b5c", "comment": "Malware payload (Mirai)", "value": "3c762c926394967f2953f844445f2525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987836, "uuid": "a9617bc6-b300-4119-a6e7-8c50c45dea83", "comment": "Malware payload (Mirai)", "value": "9f5ac58e1199a5ce3082e743ce8fb6d21d89878b2dfbf4b7f9ebe15e67e2a26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987836, "uuid": "8a30a050-405d-4931-ad01-637abe4c5a3c", "comment": "Malware payload (Mirai)", "value": "c97c9be4d7785feedcea41dbf38be1e9efaf7945", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987836, "uuid": "a7d8efcc-48fe-4c24-8ccb-dad4cdf7eb3f", "comment": "Malware payload (Mirai)", "value": "f7304e45a83d25a02a7cc7072fdf98975079f800c90922ca5917a9c9a7899e2cbb260ab29613c730ffabb14b4aec0852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987836, "uuid": "3bdb5d68-fd8b-4356-b28a-d73df577c8ca", "value": "T1BEC3BFDBB34F5452C86106F00BC78FCD2E6362128E0BC9E72E1DB67E28791DB595A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987836, "uuid": "d00067a3-eabe-4a69-93c8-f12010c826dc", "value": "3072:VSz5zWUk4gT53AqBkQ4wwRQ5BA+Fazqg4nGBq:IzxWU43BsRQzMZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987836, "uuid": "46dcf4b9-2635-480e-a62f-5fa422796145", "value": 124284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987836, "uuid": "78662215-be6f-412e-957c-43cc2f2e9306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987836, "uuid": "4ab8544f-5910-4ecf-ade7-242a11ffd119", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07498ed6-b6ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978959, "uuid": "83499851-16d8-46e6-82a0-44aaeb4255eb", "comment": "Malware payload (Mirai)", "value": "a31ffbec58fbe91b2300080f8b42eb3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978959, "uuid": "185fe44e-bc25-4bf8-a511-5c93c84cf691", "comment": "Malware payload (Mirai)", "value": "a01dc6a99558fc993f8e6b17b33c1774296929ff161ccf321a55340f3d05a12c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978959, "uuid": "729297d8-b4ff-4c56-a0a5-92c0ce0999a9", "comment": "Malware payload (Mirai)", "value": "5a2333156e1ddca1af26fb2a457d74824de4c6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978959, "uuid": "b71ef29a-4249-489b-a00f-76e4f8c23350", "comment": "Malware payload (Mirai)", "value": "00c1af8207015ce2df24178bdd8fb24936a2cc495fd782d0005f93dcef240d3eab6e1f3d1cc69c316510e15f77dca9d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978959, "uuid": "ef9ae035-e046-4992-8bad-7ed558263354", "value": "T15CA34AC4F643D8F6FC4605B07136EB379B32F0B9221DDA83E7B85636ACA1641E90665C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978959, "uuid": "b644d4ef-0bb1-4c93-9f3c-dd1b98b59a07", "value": "3072:aDgpptnSv/MsDe80o/5RqSwg9YwXrrYDYysUM:aDgpptSnMsD30o/5gST0dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978959, "uuid": "8914bdff-2505-434e-91fe-1a6322d3f8fc", "value": 100264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978959, "uuid": "8d665c30-7de5-4fd9-af96-471c1e0123f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978959, "uuid": "a6b5202f-c52d-4937-8955-b8d8369376d9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8b97ed-b6fa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761984712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761984712, "uuid": "52a1e57b-49fb-400c-860d-f5ada01cc619", "comment": "Malware payload", "value": "27aa73f2ec2de7ee5a5efea3f98d2ddf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761984712, "uuid": "eaecf7f1-4746-4a8a-be08-2303bd77157f", "comment": "Malware payload", "value": "a0bd66ae0357e9247b6e442b84f3f53c8ec72d6b2a77c4dde83489581c3355fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761984712, "uuid": "8f2b08a5-ec89-423b-9f75-f068a805cee2", "comment": "Malware payload", "value": "041555a78d6d95fa77c9a91fc5e3156f0268a12f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761984712, "uuid": "ec3a9a34-37ac-4e27-b181-8baea75bd2e0", "comment": "Malware payload", "value": "d9ef6c4fbe86b235730862864a790d517e64075e8c203be0199319a45c23ce073f50c2a159061dfea63fc96ddb88c93e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761984712, "uuid": "172836f4-a47c-4cee-8323-0515192de689", "value": "T1D5C08CD1443CC071923A0A9EB252E1F4D982A8280FA478B2D818C644B1B40702C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761984712, "uuid": "0a61a31b-a1ea-48d7-bd97-b9455fab1c1e", "value": "3:pKWNFLIx8sv3uy9Fb+dNMf/DItUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfTebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761984712, "uuid": "c5a9656c-4bca-4e24-b1e7-c7b87983b5c2", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761984712, "uuid": "8b725fd8-782e-478d-8a49-a20b9ace3b4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761984712, "uuid": "6256567e-5af9-4bc6-8524-3fd644a51656", "value": "xm4tby6sqx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb35783-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993061, "uuid": "27f8f44b-2f7a-45d6-b160-290e58472a10", "comment": "Malware payload (Mirai)", "value": "e5f2494a41911e6f8a448431a5860813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993061, "uuid": "4d56166a-9103-49e5-a650-4e1c97b4bcb7", "comment": "Malware payload (Mirai)", "value": "a103ff133404c8dcfc1562d86745211aa107c494716a9952c13c7aea4d61c3d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993061, "uuid": "1f03ec12-f666-4456-bfba-c6f7226c8434", "comment": "Malware payload (Mirai)", "value": "05e11c248625ac105407832abaaf9c4d7aa4f4fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993061, "uuid": "c9063824-e5e3-42fd-bcf4-d36e7bc43610", "comment": "Malware payload (Mirai)", "value": "2f863575ab4d5ef2b9177e7e7b637d42f7246dd83409e5f725dbc2047027c9cd84f74b6df624fbdeabf6057da2e74db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993061, "uuid": "e4d10fdb-2fa5-46dd-864b-d012af02e8c3", "value": "T17983F706BF601FFBDC6FCC3749E91715288D650912A97B3A7974C82CBA0B64F15E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993061, "uuid": "b7bf521f-ed89-44ae-ba0b-5c18130a1c91", "value": "1536:v8GFMEu9Kia98gDibFZp0kvF25ElRUsBOHtWt:vPMEcKfgZ1v84OHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993061, "uuid": "d1fb30a7-8eec-4a9c-bbbe-059d7b5e04ce", "value": 85812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993061, "uuid": "0fdaa1ea-1604-47ee-af10-2ec083cce72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993061, "uuid": "7f98cc5e-bc51-41d9-b296-414008bbc0e8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c53b7-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969383, "uuid": "a11f993b-85b4-4a82-9c63-8403721fb02d", "comment": "Malware payload (Mirai)", "value": "4efdcf1187a43eeb7179f73bf25446dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969383, "uuid": "37d6de2c-bfe5-4c35-a76b-7d3d36fc6272", "comment": "Malware payload (Mirai)", "value": "a1caede42edf95bfaa64046065a4def1a4cb091a9f5b7863f6cfe4ff3f975de2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969383, "uuid": "348ee6d6-6e32-4a15-afad-e9e711e87c6e", "comment": "Malware payload (Mirai)", "value": "7b1e31a391947db313015a0eb0dd080aff1c1c0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969383, "uuid": "4e2dc7b1-239a-4800-af1a-a9bb90abc891", "comment": "Malware payload (Mirai)", "value": "14da4a579776608cca74418a98a7ca1f57b0376725b0cd72b90db6e7f199c1c50cd4e563e068bc984a98f7b6e82b2caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969383, "uuid": "855a3ff1-2ba8-4b91-a97b-22b00c7eefc5", "value": "T11523F24AC2BB7784EA36A03A4FBF74CC14C0E85D77E04C9239D42EB4D99E6647D206B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969383, "uuid": "631c7dbc-1e1b-4058-bb9d-bbba6f04b062", "value": "768:TessG0aMqhb7/lv+AJPhPglPzEAJIJY+iiBpvsE5qnbcuyD7UoQRjV:TessL+5vt2zJIJHtvvsxnouy8oyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969383, "uuid": "068371d3-fd8c-4e19-a221-5b38a319ffb6", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969383, "uuid": "f23fd69f-6f6d-4fde-ac71-b1f909601bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969383, "uuid": "cebc37a8-c412-488c-bb59-17e342fd532f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160f8c61-b6bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761959227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959227, "uuid": "b89a13db-09a9-4ec6-b07c-0c40a45ece0e", "comment": "Malware payload (Mirai)", "value": "f090fb60c8d971f795b61f9dede6eb90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959227, "uuid": "079c10cf-a783-4ce2-acce-97587574ba90", "comment": "Malware payload (Mirai)", "value": "a24f3e2571759d61ba675080c9e5eab6a6e60449b9a938133ff470bee7d0e17d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959227, "uuid": "9127b6f8-6a82-4782-9ad8-11591d5fc5c5", "comment": "Malware payload (Mirai)", "value": "6d2ea519f132bf643ed1762a2c2aed875fa8d7e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761959227, "uuid": "43bc57e2-9b5d-41d7-85fa-7a306dd0a7cc", "comment": "Malware payload (Mirai)", "value": "0e73fc3187a999a115593254ff96b1a9b29cd3f2a0fccc7b4b6f410013996ce2c4326c4c47b863d3921ed619deedc55a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959227, "uuid": "7e79855a-ebb5-4572-b1df-e6cb1d5a7a46", "value": "T1A4D34C46FA418B13C0D51779B6EF42453322A795A3DB73069A285FF43F8679F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959227, "uuid": "f154677e-ea6b-4aa9-800b-be1a571587ee", "value": "3072:bqTt1a2LYnA0YDo8h3t3qZgRLWH5b44XTLADM/9eGmPw/t93:eTt1acYA0Yb3t3qZgtWVLXTsDM/9DmPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761959227, "uuid": "de721406-74bf-4969-8001-4c6afe3dcf00", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761959227, "uuid": "af778d28-41b1-409a-bd71-2f4225940564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761959227, "uuid": "d2328840-f116-4217-bf7d-2a580182c190", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1111ba4b-b6dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761971674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971674, "uuid": "a4c854d8-7b81-444f-ac97-d1d7473c4a68", "comment": "Malware payload (Mirai)", "value": "f480d40e3458eaa0fa409ae4f873c6a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971674, "uuid": "82964136-4518-4116-a282-786eabe9de41", "comment": "Malware payload (Mirai)", "value": "a28eeafdf77ac31624d07c7fffc6775a90cc16d588df8eab752f8cb6a62e1dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971674, "uuid": "ce9dde5e-8b23-49e1-9ba4-375c637692c6", "comment": "Malware payload (Mirai)", "value": "4b9b61c1b6c1be52a216cfb5018ea503249d0ab4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761971674, "uuid": "c364e01d-2c6a-4b09-88ca-12f494b9a890", "comment": "Malware payload (Mirai)", "value": "e60b1e79d542c7361a05f4dcd5a60f97cc651c070dcfc8caba55753df3e28d342599dd708e231a9e3153a011f05d431c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971674, "uuid": "cc4b63da-090b-49be-a69a-5f979c3a9185", "value": "T131148DA8FE8E78D2D2C7E37DAE4A0FE230277D748551C0B54A40929FD5EAED498D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971674, "uuid": "0cb1e8d6-b3b6-44c2-bb55-c40fd340a0ec", "value": "1536:7PLjJNcP/fTv02TdBC+y2VKEdIpVttDEgCwRvlV4dqyiy1MsHNUjzPx+mkXuXxUr:jLVS/fT8iCEdI3DMUlsiy1MeNmzPxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761971674, "uuid": "44415371-a169-40a6-8f46-a8ec63d199f2", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761971674, "uuid": "5cc527f7-7274-461c-83d7-f288f7ebc180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761971674, "uuid": "c806f0a3-8c67-4ff5-96dd-f01e02eb9739", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e355e56f-b6fd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761986200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986200, "uuid": "78618c67-cabc-4434-88ff-4a01c2de2ce2", "comment": "Malware payload", "value": "7842c738cd0f113cb0846dbdc03db53e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986200, "uuid": "9736a3c3-b6d8-4b41-b983-b3718219582c", "comment": "Malware payload", "value": "a4daf9c78d746aefd5e37b5db9e66c2e88bc56801a48843b775e0bd8f59c5b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986200, "uuid": "97df4dde-e2c0-490f-92c0-31ed2749511e", "comment": "Malware payload", "value": "af76ec438aefab654c9cc84a16fe9541fa2fee54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986200, "uuid": "db279598-4632-4e02-862e-169b177db3fc", "comment": "Malware payload", "value": "9c4b90bbe065849fc00732719b46b01b3621e98ce7f289c22e1dfcc57dc9c5ce3ae39c12247706ed33a8b832c8710dd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986200, "uuid": "16fdbcd8-e6aa-4328-b9a2-a3c73c5fb62f", "value": "T12CD30896B881AB21C6D156BBFE1F418E33131BB8E3DA32039D141F6477CB95A0E3E552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986200, "uuid": "f7e8ba9a-5c45-4ada-8b1f-f87c2cd21236", "value": "3072:AsyodMhZP9xALtxzm7uOTD/AKeprPO0KXii4gkQ013Gnz5:eodMbF4txzguOf/AK8O0Kyi4h1a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986200, "uuid": "e46fd242-f39c-4841-af9c-034a880e69ef", "value": 131832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986200, "uuid": "ef6669a1-faa6-45be-849f-f5a64aa6a7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986200, "uuid": "4a370611-6c6a-47a6-901f-e337477581bd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf4aeb4-b6e4-11f0-91c6-42010a9c0006", "comment": "Malware payload (XorDDoS)", "timestamp": 1761975316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975316, "uuid": "e4869424-1440-42e6-a57f-893d8985e347", "comment": "Malware payload (XorDDoS)", "value": "f075a45d0f9159aca526e13870de7b28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975316, "uuid": "770455ce-307d-479e-ab1b-909510dbe20f", "comment": "Malware payload (XorDDoS)", "value": "a544fa8b34122876e3e0140c480c967aad0b26d84823ae6fdd1bc961e47d8b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975316, "uuid": "23f8fd84-3034-40d3-9a9a-9ffe371a0030", "comment": "Malware payload (XorDDoS)", "value": "1f74f062b39def7ba488b1e5dfcd56fcb87c5768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975316, "uuid": "e7a82cf1-7099-4b6d-b588-07e413d6bf06", "comment": "Malware payload (XorDDoS)", "value": "58cdfb312915357c6b8a4516621096328ed3fde877e9d39a54bcabe4ae490ce6f702cd9a0eb1cc8bf9ff8bc236af65f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975316, "uuid": "8652dc33-edd8-4de2-84bb-02384062f564", "value": "T145C45C56E383E2F7C82705B0134BF7BF4620B6359461CD86B7989D5AB9338F22A4D352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975316, "uuid": "608cc75c-73d0-4b84-a10e-64810b169f01", "value": "12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzD66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5DfjQn36Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761975316, "uuid": "e5aa2504-f3f8-4470-8abf-2e67c28558f8", "value": 548616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761975316, "uuid": "298496d6-c1e5-412b-8406-7725aefdd651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975316, "uuid": "7c628871-51ec-4e9f-a88f-20db4bb5d86b", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587e036a-b71e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762000141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000141, "uuid": "a22a64bd-496e-410c-9dfb-d88c29698dcb", "comment": "Malware payload (Vidar)", "value": "0cb8bf4e98eac3ceaf43e6b2189836ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000141, "uuid": "757403e9-b141-4d53-bbb2-d94b08de98f3", "comment": "Malware payload (Vidar)", "value": "a590de97f6389d2e22719b18b45a0aea8c64666d17bdec9a565a08a19e35bd2e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000141, "uuid": "fb59fa69-855f-469f-a32c-779066002a63", "comment": "Malware payload (Vidar)", "value": "1c893ce9e6d806648b5b5fc479a861b36b67c52a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000141, "uuid": "feb8a6aa-ea30-438b-b5ae-9a5fb03b9cd3", "comment": "Malware payload (Vidar)", "value": "dc39de2cb1235aad2c4da99ffe579b0ac43cf44c779499760cc4807829457f4d665b99b871c5c842c34e4905517918c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000141, "uuid": "88b1d3a0-cf45-433e-8db6-38ac7519259b", "value": "T1C8542326727480B8D38CB47B80B7B4E9CB5AB87B6FD0516B5529DBF9A7F1003890E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000141, "uuid": "2a6835c7-7134-4c4e-a9e8-13f9d0f01306", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000141, "uuid": "eac7ebc7-ac2a-456c-9840-81de049f3995", "value": "6144:UKbsfCyEXWzOYuth/XkX8fmpoe3Y3wrj4BD9zhP3kF3uJInRwomqj:UKbsq1aONz/QImFjuDDsF+JAwomqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000141, "uuid": "b382b9e7-a800-486d-a8e2-5fc048a23c94", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000141, "uuid": "4e62e005-6584-4b77-a9be-07ceca52c4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000141, "uuid": "3b89a1e5-b36b-4db7-921c-16128003fe62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d65d69-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761988944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988944, "uuid": "0a1c35e3-6cd0-420f-a366-9016a9ccd827", "comment": "Malware payload (CastleRAT)", "value": "9b0c3ea2238def6d0515e2598afed526", "object_relation": "md5", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988944, "uuid": "04b1986f-5d69-4b37-8a7a-537b5d118c7d", "comment": "Malware payload (CastleRAT)", "value": "a67027c3dec4fc4a5a09c68950f494f631ee6aa42b85dd82d74c5b5399d08d19", "object_relation": "sha256", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988944, "uuid": "3e419e08-b271-430a-8ca7-9098ba36eba3", "comment": "Malware payload (CastleRAT)", "value": "6dc756e31eae607bcb257e168313af16d14ced66", "object_relation": "sha1", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988944, "uuid": "b6c2db28-05c0-4605-bee3-0974d49809d5", "comment": "Malware payload (CastleRAT)", "value": "2b22539e64310ccf0f080decc5c5b3bd2d39c084c56d14b95e22297db106124880f6cdead7c04e72e5ea42b222bd1c69", "object_relation": "sha3-384", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988944, "uuid": "981dc7d3-ed94-446d-a053-3db97df12e12", "value": "T15806BF2EA2AC10B5E07AC17CC5C25507F6B2386A1321A6DF03A1C6795F17BF4BA3DB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988944, "uuid": "2072d089-8d1d-42b8-8bf3-273589a7ea7b", "value": "dffbaaefd236101cc2b6914b4720143a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988944, "uuid": "4d487f1d-2c22-4163-b222-12c82fc0d06a", "value": "49152:RLQRxAaS3KGB7UeKW7t95poAlyo9RXNw6qwmiRZa1ejpDMLHofjTawFP4BvdYajy:xQo7BSS+9WssBNHiwaz26jqCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988944, "uuid": "743b7866-fffe-46a7-a5ba-9a4824f2cf6e", "value": 3670508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988944, "uuid": "66326854-5b85-4e39-9b04-cc20fb4acdc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988944, "uuid": "da531317-d855-4b08-84f5-8cc18768717b", "value": "a67027c3dec4fc4a5a09c68950f494f631ee6aa42b85dd82d74c5b5399d08d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be437559-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969387, "uuid": "23b6bd59-7768-466b-8eb5-a1f2f79fff56", "comment": "Malware payload (Mirai)", "value": "040bb40a6ee8fccd3f4fe89b1ed64c4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969387, "uuid": "72451a9b-6955-4ab0-a1e4-3d99c62d17e6", "comment": "Malware payload (Mirai)", "value": "a9797bf5de249b11f321f90531f6141c45ebc65b06adc385c6f48350717ae7f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969387, "uuid": "ae50c765-08a7-4610-8c37-bc38705e8809", "comment": "Malware payload (Mirai)", "value": "967ea1bf5679dab81a43e29fcedc5ac96d8ddb17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969387, "uuid": "c23acd93-fd72-48d9-b269-63bd1443588e", "comment": "Malware payload (Mirai)", "value": "271c8990ce25b406d12205960c8e7b4970edd3d1660a85493070d0be481b34e82bbb0fbd148c8ab64ef266d17bd36776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969387, "uuid": "19a33a4f-aa42-4541-8990-a712279400b0", "value": "T14D43F159336799B2CAC0583B865485132F4E3FA6D858390B15D02BECB6AFE44C9F29D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969387, "uuid": "871978e6-de85-4497-a85a-817ebbeda988", "value": "1536:4oZVdjMI2ANMTdsJb9e8Q4Y87ejMUekIwGSI3LO:4oZbb5MTdKxe8Q47ej8wGpLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969387, "uuid": "ad12431f-cdeb-4519-a844-05fa5746fa3a", "value": 59012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969387, "uuid": "dd19c3f2-385f-4fff-b058-ae665cf65762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969387, "uuid": "716818de-228c-460d-82f6-ef6979b05d36", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db37e81-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761988902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988902, "uuid": "d01695de-021a-4b58-a814-1a5749aea3bc", "comment": "Malware payload (Formbook)", "value": "673fc2eb59d71bbf406ba864a48de02b", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988902, "uuid": "d9c494a5-e56f-4d24-a730-9cc0e15f6c90", "comment": "Malware payload (Formbook)", "value": "a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988902, "uuid": "0ff91f36-1e1d-4653-a1f8-c10812962cee", "comment": "Malware payload (Formbook)", "value": "4a4313fa4763b458a21842b5a48f1f45557b1b75", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988902, "uuid": "cb013227-e80d-4d15-b3ac-040b9e96a98a", "comment": "Malware payload (Formbook)", "value": "c2c2340bcfd042e0210e3a2fdaa9de91eb53c3c04f1c3eea04cd1e79ad9bd466e3888951ca74f8bf56a48779dad36fba", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988902, "uuid": "35667269-3e55-4fa0-875a-2dad623da0db", "value": "T14AD65B6F76A18568C15DC23FC0A38F05E8F371B91733C6EB83A403686E569D45E7EA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988902, "uuid": "588f6094-8230-4944-8382-51bc966d5f19", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988902, "uuid": "c2b5d809-d33e-4d6a-8f79-1f1170c59770", "value": "49152:EZF0/5ltUaJO+xkgB0dDjdNGSQZKG67KugVtOHEp+9U0aAlxIhrmlqD/oWlNve7P:3RkyhrOHMsfh0V238li6g78QmwdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988902, "uuid": "f5b14ec9-4cf7-4482-b5dc-2822636e9e97", "value": 13263360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988902, "uuid": "00a3b3fc-ca41-4234-ab63-8d34c37151c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988902, "uuid": "dc568b10-534e-44d0-ba51-c0690c9261a2", "value": "a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34a58f3-b773-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762036773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036773, "uuid": "2486e612-8f21-4b5a-be81-1ceb3aa85a88", "comment": "Malware payload", "value": "2173f1ca66f0aeb89445269db9ab6001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036773, "uuid": "fbc3bde5-4519-4d10-84a4-82ed72f213d4", "comment": "Malware payload", "value": "a9ac1e3031b37bd64f55d21c63001ece2ff3e3378861436bb49589a865b5f1ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036773, "uuid": "1e9781e3-9a46-409f-899c-6c96db4d4c93", "comment": "Malware payload", "value": "70ae6f57e00d2c789b1c42ca81318e4dc0547aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036773, "uuid": "f81e613a-960a-47c1-a2c6-9ab8e4145f68", "comment": "Malware payload", "value": "b009d9699e7ed505b6c7f1b1c2508ce4938e6873ba2573a564292af6aad964fb5e28aa033a5318c0f5bc87da10a43593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036773, "uuid": "1c1d001c-9d49-4e53-a303-dbeb4f6b8220", "value": "T113C3B61E7E228F7DF668833447F74E31A35963D622E1C685D2ACD6141E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036773, "uuid": "310b75f8-3533-4585-980b-ca34b11467d0", "value": "1536:Of0o17JNYfYUhC9GxEuO7tcsNBS11oUWsx+QtlE5yvtj2non05ZnFwOtv/27317J:SuUcsNBS11vI5yvtioKbwov/w31FhJOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762036773, "uuid": "b95b349d-bba0-4a5a-b4d3-f2190a2636a3", "value": 118948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762036773, "uuid": "5e74f980-5e51-48af-8a06-57913a576d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036773, "uuid": "131cbf7b-3ed1-44cd-a507-dd6c36e6c0e3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4600a408-b759-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762025450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025450, "uuid": "30f46ad8-5a19-4d0a-89f3-7674b39de1b9", "comment": "Malware payload", "value": "7c0f24ea12613f56a9761fb6c98299e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025450, "uuid": "f5c0f3e9-5a08-4cd4-94c8-be17f4802159", "comment": "Malware payload", "value": "a9b9a55c973c5c77bed83a63bfb2081fbab8049dd5b4f64eb21c057d83bb50e9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025450, "uuid": "9e416748-4fc7-400e-8c63-5a11a2b10339", "comment": "Malware payload", "value": "70b0989935e488ac46820ff3868404105552f214", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762025450, "uuid": "2a72445b-3920-4d7c-a660-00f6b26d78f0", "comment": "Malware payload", "value": "7baf077ef41af0377da9bf8fcc14c9b1d5544ea9a63feae6ac810d8968be423b5634591141ca320472fe92eb7da728f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025450, "uuid": "cdcc399b-4bf4-494f-be4e-b294fb19d9f3", "value": "T110C08CA1443DE07163390A5EB342F1F4A943A4280BB038A1D5588A80A1740701C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025450, "uuid": "9223bfa7-1bb1-42ed-a29e-1453a9525bc9", "value": "3:pKWNFLIx8sv3uy9Fb+dNMf6RoAdgNc1QREtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMf6RoqQhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762025450, "uuid": "d6c8ed32-5565-4ab4-9862-e10cbc2485b5", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762025450, "uuid": "0d7605ac-489e-40b9-a614-51819504d1de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762025450, "uuid": "d9d42f09-0cc4-46f6-b84d-a1be1d6c6fb2", "value": "de11ixa0gh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6abd6f-b775-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762037676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037676, "uuid": "bd59b746-4719-4b07-964e-0dcc387266d8", "comment": "Malware payload (Mirai)", "value": "808b7c72b5d2568585b7028a5c3f065e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037676, "uuid": "1f8ede45-77b3-46c0-9b30-4e2a15c01dc6", "comment": "Malware payload (Mirai)", "value": "aa0a25bc83bed38fc21ca32ca1a61ed644778130c2849a3bb043d57b8e2be388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037676, "uuid": "cd29e230-679d-4723-8f22-29c79b13aaff", "comment": "Malware payload (Mirai)", "value": "dc0baccd72b44fdf99775657b000e8779d730372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037676, "uuid": "f35a58e3-26ec-49c8-b2e2-118ac6cd74c8", "comment": "Malware payload (Mirai)", "value": "0232157bc548e124e91d3790e050542801542b7b4f0eae7a0893173ed083907dc90d1db80e503f72a61c73da796e962f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037676, "uuid": "044f903a-5d7e-42bc-b6a6-10905ae7562d", "value": "T169042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037676, "uuid": "9e849c11-f8b5-471a-a968-8b9e22171de2", "value": "3072:nS/NsThjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/RXC/Ht6:nS/clvlcIaboVS7kVdBMi/XMgM/RXC/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762037676, "uuid": "5e01c4ed-c125-4d24-b178-9e0df25f7fd9", "value": 179797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762037676, "uuid": "4067982d-08a6-424c-8b9c-7d9f8c66e988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037676, "uuid": "db25084f-1d3c-40ed-9ee6-28bdae5c27f9", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd418ad-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974625, "uuid": "2625bbb1-fbde-4790-aa50-47127bca37ff", "comment": "Malware payload (Mirai)", "value": "eb359e5e0d8285712a30c21e6adf0797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974625, "uuid": "b7e8c788-32c1-4cfc-8c63-34459bf3af92", "comment": "Malware payload (Mirai)", "value": "aa209b26dfff0156c01cbe8a84171ea5f471c8cfca7bf386ca6d7333ddd5b588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974625, "uuid": "f660461f-24c3-4d61-8a55-f0524e9a20eb", "comment": "Malware payload (Mirai)", "value": "84f6a6b91151e06c4b7984cad8ee5d76ce358edd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974625, "uuid": "af2c161e-02bb-4189-ad98-25fafba8c892", "comment": "Malware payload (Mirai)", "value": "43c3d21b8f641201dd1ac2e6e528bce1b95a2c5a49d338d814b9c2f21490057a3df6825d9a5d6cf18c9e988f21d79671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974625, "uuid": "bb3a9b43-e0e3-4e21-bf10-bfba7eb241f0", "value": "T148E30885F8805E23C6D612BBFB5E428D372917E8D3EE72078D215F20378695B0D3BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974625, "uuid": "f5209bfa-4f12-4216-98d7-532eda7db0e9", "value": "1536:pA4DnzqOvnr6aXubtXU959vzWuZWdG2L1D4VaeU72mGnElViwywp6mXLeBVgX1WX:pA4z7Yy9odG04VUvGcegNhBE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974625, "uuid": "7fe9f075-2f8a-4c5f-8ec7-e0f6fbb9e8d4", "value": 154144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974625, "uuid": "b09acc7a-88cf-4c2f-8c52-41c4f05a1973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974625, "uuid": "010bff75-4422-43f8-ba9c-69b400d2324c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ffb3df-b723-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762002398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002398, "uuid": "46d4f3aa-b115-4976-a2b5-edfe731f58aa", "comment": "Malware payload", "value": "4abc18de044d79e306d993ee5b1674ad", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002398, "uuid": "ddfd9b52-2881-4145-890d-cb1ce51291f7", "comment": "Malware payload", "value": "aa22e56ad395221995d53aaf258bbd8f5a08ebc86f150088e01a38b92f70da90", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002398, "uuid": "4dd52085-c59a-405c-873e-b50acf1fb24a", "comment": "Malware payload", "value": "a25955b8de3882f4a77d62d2d506b3048f9029c6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002398, "uuid": "7908b9b7-ee64-4ccd-87a8-5f8242d42361", "comment": "Malware payload", "value": "3c8f501c8ed786b20e23ecf7f88d3cdb72e73542608f62bb46d7699a2284e0afb76ab4f798d4089f4a9e2a554ba7039c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002398, "uuid": "fc8e06bc-79c1-4d6f-945a-91a23d3e9886", "value": "T120D2BB53338BF68F90C057F6310867E321FAD91AED8E5149F6DA4EAB74DD88735085A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002398, "uuid": "652136c5-3834-4437-9743-9d341225ca5e", "value": "384:6AReJA9e5NGoUk7Oz8vOv8Bt9pewfcx6jwNLfyu04MIgJenGUlbR7PryKQcpB0SY:6AReJA9e5Bbpp+MXkbRqKfFYemdf9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762002398, "uuid": "581be59c-4c6d-40a7-8d07-050c402eecac", "value": 28524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762002398, "uuid": "689accfe-87a8-41d5-9539-e3fdc0d8472f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002398, "uuid": "7cdd8d70-adc1-4f5d-b7eb-62e6fe1fd09d", "value": "mNtP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b05d4a-b755-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762023654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023654, "uuid": "6c0a42d9-cc5c-4331-acc9-bffef605c78a", "comment": "Malware payload (Mirai)", "value": "967c6e4fec05eb07be36584f1332f780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023654, "uuid": "525cd7eb-21ff-4922-a27e-d1f81b777bde", "comment": "Malware payload (Mirai)", "value": "aa36c61e6ec73e6ed1e462ebd6adb35f776645208b32b250f3894bb6e174161c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023654, "uuid": "23dbc333-1437-45f7-aac2-45322493ad8b", "comment": "Malware payload (Mirai)", "value": "13ef34e9e27c0aba956e08ae579d3e3cb2c828fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023654, "uuid": "0c23e6e4-064f-4db6-8680-0c2a6d001151", "comment": "Malware payload (Mirai)", "value": "9007853535cddb8bd2a6f50a57803decd32af70d015ae9bfb306b532f9f5bcbcc0bdcb3b116ca032f492c926d7523669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023654, "uuid": "629b0dc8-e51d-436a-bda4-14fa73917020", "value": "T13AD3A60E7E218F7EF768C23487F74E31935923D523E1C685D2ACE5151E6028E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023654, "uuid": "98ae346d-bcb5-4f90-b6c9-9ba6cb16dc1f", "value": "3072:713p26B4u15nh9CP3wPZdig7MGbW7dxe6nz+fJ:7138Ib5y3A9K7eW+fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762023654, "uuid": "0fd953e0-98d4-4bc6-9f78-32ec00b3fd6e", "value": 135924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762023654, "uuid": "8c1dd090-a586-4c95-9188-535d91af4ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023654, "uuid": "af9af7a2-f138-458a-9810-02731dbeaacf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0e6aab-b71f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000606, "uuid": "ac92f2cf-67e3-4061-8193-d01553fda48a", "comment": "Malware payload (Mirai)", "value": "1d01001b8564d962ecf12380f3d2f49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000606, "uuid": "94c1875b-62e3-4e79-9834-a4a11a346dd5", "comment": "Malware payload (Mirai)", "value": "aab33a262ba425ea4a4b522839d538b6baf70ac3c154f4a530a111a0fce27f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000606, "uuid": "f5c63886-57dd-4c51-a4d3-16c9af1aceaa", "comment": "Malware payload (Mirai)", "value": "afbd0827b7f9e74b92d760d5182f525b4498fa02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000606, "uuid": "91bc0b29-89e3-4fd1-a7b7-8340971051a7", "comment": "Malware payload (Mirai)", "value": "effb5243336684d2515e5dc7e9850ee75033caa450a141ce2404ec8af80726e7a4b19e148c6eb876af5d6d321d01a8f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000606, "uuid": "c2b6ffd3-d1ad-4826-bd63-59567e812633", "value": "T1B583C6097F614EF7E86FCC3746B95B0424CC960A21A83B797D74D818F65B24F1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000606, "uuid": "18698989-2e6a-4f06-9586-6b2d42a1a64c", "value": "1536:cf9OSKGMLydwF9JyAypAIZyX0hJgkjouum0JuybVR:6YFGMLydwFu6Juy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000606, "uuid": "4f1b7f38-8c3e-4ff9-923c-baa2f2a8677c", "value": 81616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000606, "uuid": "bea8e6a3-8e89-4aaf-93e4-149da0e608bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000606, "uuid": "1755d8c3-d209-4c25-9f62-ecb61a0288d0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7fae64-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969386, "uuid": "a12be6c4-a11f-4026-bbc1-4338953853f7", "comment": "Malware payload (Mirai)", "value": "6b69ff214abcad2de5588017f1ec5eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969386, "uuid": "c673490f-2292-49fa-9af9-c58faeb1c884", "comment": "Malware payload (Mirai)", "value": "ad415d5bd33e985918fd15ef596fe21bcc66ada28fb9d8b28331a423934a9cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969386, "uuid": "e06dc4e9-4e7c-4609-9158-0320fc3c8f8d", "comment": "Malware payload (Mirai)", "value": "7878046b41c2b3b6b4102b840fdcce5e9ef70c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969386, "uuid": "c2ea093e-d6c2-4fc6-bcd7-da0b5ac04495", "comment": "Malware payload (Mirai)", "value": "54cfc0dc727d7f7b8fa8e747b59f9c6b6901f54816756c21f098f792248d328f0f92b073c486be88247ef14db485b289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969386, "uuid": "c04983c1-bbf5-4ef4-b1d1-8b6fba71e37b", "value": "T1CE430268A31511B2E90549300B9B47C9271E0FFE52937E72611FFAAA5D071F9CD03EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969386, "uuid": "c13fecce-a85d-4ac0-913d-1f093ff7b041", "value": "1536:k4kKad2CGj1NUqIpaBotfHathOWSQEb4eVJu+:Jyqxt5B77CtVQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969386, "uuid": "6bca281f-a4b4-43ae-be53-6cd7a832d23b", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969386, "uuid": "b60d102a-8945-4043-90d2-02a07e0fe717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969386, "uuid": "0af5cece-4581-4309-91dd-abb92d6255b4", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd7e214-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761988981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988981, "uuid": "5cd8e1bc-89a4-4ae7-8999-52b9b9c47d7b", "comment": "Malware payload (CastleRAT)", "value": "49adad38f784a0c476274f681ed61d3f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988981, "uuid": "d50f44f3-450e-43dd-8f9d-bfa5badbc7f2", "comment": "Malware payload (CastleRAT)", "value": "adc2e9487e182672fc2a30783130162754e92b173800563bc34a275125a5e3b1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988981, "uuid": "4218a7de-50e3-48ee-a3b5-e7ac4724343e", "comment": "Malware payload (CastleRAT)", "value": "efa4ba052058902d91a7069e68244a8a7204affb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988981, "uuid": "fe88de90-7f3f-4078-8c98-8d2195612a0c", "comment": "Malware payload (CastleRAT)", "value": "4f974f451cd0cefc466d06f6c57a48e07863ee8de356074c3b5a1e5efde5d95e67d994225bf100e69353f4d38407b987", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988981, "uuid": "03f3a685-ea0b-4583-9729-1e88a8027bd9", "value": "T139C092A02B449A11890EC23301A69286B800DA4D8960FC70716E446EDBF167A22B93E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988981, "uuid": "d3ed1773-ceec-4807-967e-5af245c68761", "value": "3:pF22wxzwXAmdAi9zK4ZFfBxlF/cXfmx+TIoDjrxyVy:pF/wAlCwNZZBx3cXfmx+vXxy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988981, "uuid": "631a9f4a-bfd3-4d36-831e-44131cf4f38d", "value": 145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988981, "uuid": "7ecb65ad-36b8-4bdd-8a95-3ca7a2bf6d49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988981, "uuid": "91a019be-1a22-4690-a98d-9c5f31a7fb0e", "value": "yes.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6015f47-b6df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973293, "uuid": "4f4dc31b-3389-43e2-965e-35423324ff77", "comment": "Malware payload (Mirai)", "value": "68485b491bb3b2d6bf1bf32d32c1804e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973293, "uuid": "da7e6c6c-7758-435e-b34b-c4f852b4c1c2", "comment": "Malware payload (Mirai)", "value": "ae292cf77ee6c2fcdf84baa2632d6b4c1ef891953a1eb58ffcda0eeca06ae71a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973293, "uuid": "bdd0e7ca-9ce7-4ed9-8cd3-4a7c54a48b43", "comment": "Malware payload (Mirai)", "value": "8f4f10a9c497feebd6e33d25a6cb13ba24b42eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973293, "uuid": "64f31ec1-6c86-4a9a-b010-9d271332be39", "comment": "Malware payload (Mirai)", "value": "497f6675f96c991c49605b7bc64c3b0fbec6ab037f39e0f53150d12931404aa347bcca90a1bf1c9f6e1e423a603a5473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973293, "uuid": "9b0c282d-2f1a-4f84-a400-2489980881a5", "value": "T14EF33BCBF800DEBDF80EE33A48130919B530B7E251924B376357797BAD361990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973293, "uuid": "0d774107-5c4b-4597-b75a-82aff0bc777c", "value": "3072:5X5FkKX+VhFcVtkjWvB7IvVkjbiBL+/MAWUovYf8bvyjOQo0QN:lkKl2ja7INL+Un24yj8zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973293, "uuid": "d4fd8b4d-4443-43f2-bd09-969404bd5189", "value": 166624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973293, "uuid": "44768974-685e-4e60-8684-27a4dc62d8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973293, "uuid": "2110a566-c27d-4108-b98e-c3ec35d209ff", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2a9b39-b6e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976555, "uuid": "70ad3d6d-806d-4b15-9ea0-2f4579203973", "comment": "Malware payload (Mirai)", "value": "c861bce24fcc23dec7c7705dfd9b69a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976555, "uuid": "8b331668-3546-4a45-9c4d-0920f32203cf", "comment": "Malware payload (Mirai)", "value": "ae43eec8ca35be8badf2dc914bf72bbde4e0b52333ce82d9079d23e9fdaf99b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976555, "uuid": "f0223d7c-bb25-4e6e-b61b-ede1196f3ab6", "comment": "Malware payload (Mirai)", "value": "1f16c9489ed8b8b51ff6a106528ef2d431d1dccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976555, "uuid": "cc9dd929-9b8a-445f-8c87-654fc9a70361", "comment": "Malware payload (Mirai)", "value": "9072722b1a81bf4ce3273f199c854744fb877af0b9e31789f9268c71474371ec4a2c3b705de5d3ad977f328e13d83fc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976555, "uuid": "05e36b72-9425-4dca-95ed-c132c0ef05ed", "value": "T149C35B82E6A2D0F0E68701B00557F3E68935EA345416CDC6EFA93D71EC71B829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976555, "uuid": "b4784eb2-1d29-498e-9502-6b537a74202c", "value": "3072:kv0wERaQvqp87VASjn4My6kISusSXr8IQKpFr:RnRaQvqm7VAWZreKpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976555, "uuid": "dd6ede2d-41cf-4eda-9afc-b66e8e464a4b", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976555, "uuid": "6d5ee283-7af6-4e6a-8748-d0c610e22528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976555, "uuid": "4dcdec52-da07-4444-80a9-2208c7c81b6b", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befe4382-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969389, "uuid": "4fd83d52-8f54-4a51-b53e-1a2da490ce33", "comment": "Malware payload (Mirai)", "value": "8682a55a1d877cfff436df0a5b7f363b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969389, "uuid": "59f25c5d-ebd2-4ecd-83fa-3d51ef622185", "comment": "Malware payload (Mirai)", "value": "afc17edcca5769481d7dac27150551c104fc8a054a2441732c2b5f128328266e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969389, "uuid": "3c1f6c81-bd71-4323-a6a3-a93bf12edfa7", "comment": "Malware payload (Mirai)", "value": "d54d655003449eaa3684b612a852fe75853ce405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969389, "uuid": "5578fbc5-28e1-4d87-a94c-64ac2e669a61", "comment": "Malware payload (Mirai)", "value": "d1b5433c1cde397ab151ac00ae7d345ce677e65569b9448b9083dcf362f81442a9bf701d7a9269e01d57de52b8e92c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969389, "uuid": "5f573d1e-a324-488b-9196-66cb8f3de135", "value": "T15B043BC7F901D9BEF80BE77648170915B630B7E210924B337257796BEC3A0991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969389, "uuid": "f566dcb6-39e8-4de3-bcf2-d68704681e49", "value": "3072:Bptx/9kVkc9Uck8m+9V64KJ96mVNKVijbi+L64ASMyGyJ/uh/FErf:3tx/9kVkum+9VFK7jVNXLOyGwJrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969389, "uuid": "4bce8cc6-ae6b-40d3-8070-e6121e6949a3", "value": 175744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969389, "uuid": "f9dd8e1a-5a9d-4124-926c-d0a6fac7fa3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969389, "uuid": "8ce5cca0-2fe6-41c0-b617-b3434d5ba700", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f01bba-b70f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993586, "uuid": "7915ea35-5304-475e-931e-26421a7d16bc", "comment": "Malware payload (Mirai)", "value": "a1e1c26dd9d0cbabfc7f7c79d493b367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993586, "uuid": "5e4ce5c6-a522-4d56-9f11-fe446d7030fe", "comment": "Malware payload (Mirai)", "value": "b025e9d23574ae8b4bbfda2955861bac96934b6f48dbf7466814a8757e4fca54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993586, "uuid": "40c29040-dae9-4e03-a93c-f38f5c535253", "comment": "Malware payload (Mirai)", "value": "ff5887decdefd30d671a01b182d9eab5a5fd26fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993586, "uuid": "23bf2921-34c7-43aa-896a-20659e00d1e8", "comment": "Malware payload (Mirai)", "value": "4770931b406ce6e0b991d0508de220ed60689a65876bd2853d8884b6f84681fe84e478ed9179527fd257a0c3835b3e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993586, "uuid": "e26d138e-d38a-4483-84d9-4a73e531c5cc", "value": "T13324B71E6A128F7DF668873147F74E20976D23D616E1D680E6ACC6105E7038E681FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993586, "uuid": "57193bf5-ef08-4ed6-827e-6c8cc8dcb9b2", "value": "3072:fJ/Hc53dB7lcZW8wdcs/N8XJxjUSa6hh16An9:fJ/Hc53XilsN8brcAn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993586, "uuid": "b9900245-d8fb-402b-941a-f2a405ae9406", "value": 212988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993586, "uuid": "498e24dc-e29e-4f3a-b534-7c7878af14aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993586, "uuid": "85681e8a-9b58-450c-9319-02b48af09acf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ab0455-b744-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762016462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016462, "uuid": "80843610-6f82-4c5a-8336-a67412053b73", "comment": "Malware payload", "value": "681e35156ce8d939ab836bb9ee8ae582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016462, "uuid": "715efa01-3319-4106-a4a3-6282e0265c32", "comment": "Malware payload", "value": "b04ae21ded94c204e1ca235671012a46e3d4dea9d57e961b05d422640e909cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016462, "uuid": "16a2a3ef-a580-4e90-b991-444d1dad7958", "comment": "Malware payload", "value": "8f78846479cd4e055b655a7d5180e3c5a429602f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016462, "uuid": "f5609e20-7365-4d9e-9626-b05a534389b2", "comment": "Malware payload", "value": "d7b3abb1109895b00f33eeced7e42cb17aa0e47203b2d531b278eb8d47a31d94b15ace756fb76719355d78b731cc3f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016462, "uuid": "2becf3ec-a052-4d74-921a-695155664d9a", "value": "T1AA531986B8919A13C5D4A2BBFA5E42CC332253F8D2DF3207DD116F557B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016462, "uuid": "980322ff-e1a9-4fb8-a56f-4d390175b4f0", "value": "1536:pbLDXu5kq1DUGTIoY4Alzlqub5ZRmE4uybVR:pbLDuvHY5qK5ZEE4uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762016462, "uuid": "e3a5b6b6-0472-470c-9b8a-6da767e74d96", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762016462, "uuid": "5bdc0dc7-17d4-4382-9600-db7eb9798a9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016462, "uuid": "39348831-3b01-4b48-81f8-c7af41f4f1b2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c061dc6f-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969391, "uuid": "a28a39fa-436a-4feb-adb4-9624769f19f0", "comment": "Malware payload (Mirai)", "value": "34ae15ad1214bcd9581a482317ad78cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969391, "uuid": "e4de9b98-811f-4468-abd0-8f482f415686", "comment": "Malware payload (Mirai)", "value": "b0b2a90e03a9f031f8891806045dfdb4f2e0d0354be785a9e5df067785055ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969391, "uuid": "25924024-c036-4221-9299-3c4ce6bde92f", "comment": "Malware payload (Mirai)", "value": "5a9b7355e15a1fddaaa8ff47b04d9001eae7a298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969391, "uuid": "a5a04c99-e42d-4130-a90d-a6fbfb916069", "comment": "Malware payload (Mirai)", "value": "7e0687e5ac707de901bf47d35f35b66322364154527e4090998475b65d3f69a2ca7853aaa169950daf4841a63bce9b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969391, "uuid": "b6bdc518-9165-4c63-bda1-0f98b77fe4d7", "value": "T15D33F160449FE340F6301E3EB9A9CC1A1DD997ECDAF4B0B215904B811E43A5E59BAF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969391, "uuid": "f4952904-1412-4f7c-aae0-5dffc704ceb7", "value": "768:S44O4eyC217SuUTXZazr6s7PvQAdpakxue6+t0NGX06/OnhqolRRN1iZ20njShI4:SbdAsKU64hp1uGKsKR4M0IBg26BzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969391, "uuid": "2768dbff-3c36-4a3d-884c-b4d0fd318de7", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969391, "uuid": "5dc7b55c-ae12-45be-9eb2-5f51897c8eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969391, "uuid": "acc6f0af-4740-4821-8cc6-8eee94a0b586", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b778ce-b703-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1761988675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988675, "uuid": "f4f26c1c-f6d1-4668-a76b-a54ea10f2b77", "comment": "Malware payload (GoToResolve)", "value": "e9687e48b2857042864fb3ea350959d4", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988675, "uuid": "b0d6b760-2734-465d-8e0d-604a03677394", "comment": "Malware payload (GoToResolve)", "value": "b32bc15db7a2f0340a5459b92eab1fe515eb07da97d81a91fd743e5591a333cb", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988675, "uuid": "60aefc36-fb75-4920-b057-23f7253388e7", "comment": "Malware payload (GoToResolve)", "value": "e4654fe3a98adec2065e3c1623d779f8d18ffaa6", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988675, "uuid": "673ef475-dd7d-41cb-bf2f-ba4c0462c633", "comment": "Malware payload (GoToResolve)", "value": "38027ceb9ad098a5c9b5895c57383590c57ffc08ba2ea36966cf108a70250353cb3a6853c69ce949479f4891378d26fa", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988675, "uuid": "5178d1de-36b0-4b2b-bbd5-d29d8f6b949e", "value": "T16A3733153448C432E65E02F298A957FE526DAC350B7504DFB3ECBF5A5B316C23A3628B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988675, "uuid": "513bd0b3-81db-41f5-9b29-7f792262faa9", "value": "393216:oA3jqMgJvnrcMch7FEbPK1vf+8c7H2D3KdvqfQSmf6qiGwPlpZCICW65aym:5mRYfh7Y4f+ZkKoxqiGwxCU65a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988675, "uuid": "bff1c107-bbd4-4bd1-adb0-5b51912e59a7", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988675, "uuid": "83ad1658-5218-4fc6-8781-2a169a75c2b1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988675, "uuid": "8c1d1c5e-5240-449d-8c96-8f0bac6b3461", "value": "SecuriteInfo.com.FileRepMalware.18417982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048ccdb1-b6b6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761955332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955332, "uuid": "37692790-4823-44e5-bebc-2889affa473c", "comment": "Malware payload", "value": "adb3b7f9d3773cd07d0ee130c4b27623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955332, "uuid": "a3b8ee8e-f366-4be5-ac03-478bc1f53acf", "comment": "Malware payload", "value": "b3576fba0a056622a8cff4de3467a405ff642201ea3266f281716cc5d96aa547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955332, "uuid": "2b8c24bc-f945-4d97-b5f8-8b51d1f2560a", "comment": "Malware payload", "value": "73a92c0f972f9d9c6e26bf88f5b3608a2b1f969a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955332, "uuid": "f2c3381d-e9c3-42d3-b1a9-40b92f6eaf13", "comment": "Malware payload", "value": "29e93dae56953ebe7946e8ee04b8c35fa0b5025d1bf5fa769df5381df9b85503cf792b7f6ceab6773f9ee50b107cc302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955332, "uuid": "af394eeb-4ee8-4d82-9b35-f20c2c66616e", "value": "T143A31A46BD945BEBC45FCE30052AC30325DD99CA92E2631F7278DE8C7DB930A85D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955332, "uuid": "edc6265c-d991-4844-9c24-b15fe0f2034c", "value": "1536:YD1dLXagX3w5f9sK0bdf3kYyIwf2Ei7AfAFQ9inKaF4rpI:YJNagXyDY13WIwRZACUq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761955332, "uuid": "d627273b-8d1e-4e2f-a79b-942b87593ad9", "value": 105664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761955332, "uuid": "d5c64c68-0018-40dc-b41c-ce406120584e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955332, "uuid": "87d2a4ab-f831-4eb5-9669-ca348008a98f", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dc1781-b6fb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761985342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985342, "uuid": "bdd471e8-a46b-4e8f-815a-067f3a0da2ce", "comment": "Malware payload", "value": "a1fdf665dab23f6c0961033990a37faf", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985342, "uuid": "d2586944-c115-46f6-bc6a-c04e3bc73be4", "comment": "Malware payload", "value": "b55c72632ad93fa35a1e414a06f3ae266ff0a360748d79f5df0c5a9af35d3279", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985342, "uuid": "feb0d374-ccba-4af9-b20c-e599cc4b9702", "comment": "Malware payload", "value": "78f0c3bd359ab30dd237e5a099abe63ea81b6255", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985342, "uuid": "353249a5-40b0-4598-9ed9-58674f09d195", "comment": "Malware payload", "value": "5effa0cb31c1fec42b3a8f59ddba59261ba12b50ee1fe611b5e382fb605e81456873e386f691ee6a7b584dcdf551760c", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985342, "uuid": "60aaa336-3cae-4115-b504-a04eb4957cc7", "value": "T120B092F1122168BE6EAA8B80849BAF6AD02B14A96A9199D8B54290AA31C59A3964404C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985342, "uuid": "2900dbaf-a932-45e2-bd68-7a273e851503", "value": "3:VSJJFISFeBIFgYCDbWKsT1p3hyxHWX7sV2Av:s8SFZCDqhyzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761985342, "uuid": "fb94a3d6-f8ce-4440-b937-05f20850fe15", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761985342, "uuid": "91b4b2d7-f97e-46f4-a7ba-57407b250098", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985342, "uuid": "0c561f4f-2e30-4e44-95ad-76e7cbb8770e", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bc3560-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993042, "uuid": "6711a48c-c50f-470f-b261-05eef335f764", "comment": "Malware payload (Mirai)", "value": "7da9fc48f52397ed0a566d4b6f0b1295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993042, "uuid": "000fab5d-6e75-42c9-8930-f840071ca340", "comment": "Malware payload (Mirai)", "value": "b5a60e20229be34f5e3e15dfa28b8fb71e48bb7dc8e09018a8376bbd90856a4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993042, "uuid": "7c250472-da12-4195-83f4-a86795ccaf4e", "comment": "Malware payload (Mirai)", "value": "bc5ac7e4afffa684e39ca9efb0c81c4fa7fed354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993042, "uuid": "5099b227-f4cd-4e90-838e-09b3fc75c06c", "comment": "Malware payload (Mirai)", "value": "373701b88f7e644b8b4596b8437e9ca482559cbc46621ed00be75e2f292e4b791a918607237587ac709affa506e96147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993042, "uuid": "ab9114cf-7e8a-483f-904b-173838d20378", "value": "T1F0439D63D169AA94D4848578B430CBB01723B44082B72FFB5AA6C6B5B08BEFCF1553F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993042, "uuid": "c1297a69-fdd0-4fd2-8da4-2a8e0d924619", "value": "1536:CRal65hs4s6VcWmikSX1b14eKUbwxQSPIDnK2U2nlFRgcUclVLuBTLOCUYH:CRcih1chs1b14eKUbwxQSPIDK2VFRgce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993042, "uuid": "bcf8e0a7-79fd-47b8-a23e-631f10879d0e", "value": 59180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993042, "uuid": "c98f4a9e-acaa-4830-ab1f-4ee62c9e8ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993042, "uuid": "c79a653d-8a11-4b57-b3a4-10c684d43262", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4775668-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993047, "uuid": "f53321e0-c8c4-4ef2-8aa3-ab71c1fb300e", "comment": "Malware payload (Mirai)", "value": "12150aee062155bdf5bf415b441c8404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993047, "uuid": "d554306c-fce6-475c-8807-ee7a137d7e31", "comment": "Malware payload (Mirai)", "value": "b5fc5d58211fddef0325cea719959dc9d24d37117f45aac0ee5e189af87ee9c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993047, "uuid": "41c2c7e2-118a-4de4-ac93-c44d806e12b5", "comment": "Malware payload (Mirai)", "value": "f5ba82348f5f0c96ced4bef98327ec58797c3c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993047, "uuid": "3e542e4c-543f-4b17-b23d-cdc816d5b5ef", "comment": "Malware payload (Mirai)", "value": "d7107c694082254ccaaf8d130006b3853c423052b6f7294352300066bb54dfc497c6fb86a1574bf914eb921a2468e2c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993047, "uuid": "3f35cefa-754c-4623-b682-3aad3f0264f8", "value": "T1CF634AD5F801DE7DF80EE7BE84530909F730A76152830F3A22ABFC57A9711691967E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993047, "uuid": "e848b8f5-ae93-4cea-97f8-1c1d802d8b29", "value": "1536:XA7urZYcF+X/AlVel81QyxxlCPt4CvwrTj37nlHPRoV:6urZYcFQ4lVe5yxxlCnv8fBRoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993047, "uuid": "1b25531d-5dd2-4c6d-890b-cbf81cc7f654", "value": 71820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993047, "uuid": "90424e9c-48c8-4523-968b-05d31f4349f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993047, "uuid": "ae4f8b01-23f0-4638-a5bd-41024297ad26", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cab49f-b77c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762040745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040745, "uuid": "3153de03-9f49-42eb-a086-5485c4336100", "comment": "Malware payload (Mirai)", "value": "bf44fde8378dc80d1ce07557dc4a8af6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040745, "uuid": "a116fa7e-cd03-4d33-b44f-a46fef53ed24", "comment": "Malware payload (Mirai)", "value": "b770a2f5e0fbdc582f8c8b110118a84e47d5c056061ecec6e0e97f20c9e27e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040745, "uuid": "e0f8cb73-21dc-445b-b0a8-32eecd532b92", "comment": "Malware payload (Mirai)", "value": "a2cb2d2840c814397d22c1db33b3f08b69dfaa07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762040745, "uuid": "9ac0c3b0-718a-47bf-9666-695eff441dc5", "comment": "Malware payload (Mirai)", "value": "e8e1b0cf973037f841bca595c093bc1d4ea11f93e2f23c9addb19a7c349b6f0c95cce4ecdf37426e875cbc968fbe01cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040745, "uuid": "5529548c-f42f-46ce-b240-ade16a62a6d9", "value": "T1EF04D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040745, "uuid": "53501014-b740-411f-a4c4-db44ab5827ae", "value": "3072:ueEksFM+wX5OxaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXFVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762040745, "uuid": "304b0a23-b151-48ae-9aef-af0c97772de7", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762040745, "uuid": "1d499278-d071-4053-bec1-9b0dcec5ffb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762040745, "uuid": "3bd5834d-9c8d-43d7-b157-87ca13740b6e", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa5d71f-b705-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761989335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989335, "uuid": "cf0bed63-fea0-40c1-b7e9-12f0c9c3fc46", "comment": "Malware payload", "value": "68adb890de23d5dbcc3c3654962b2594", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989335, "uuid": "bde6ddbe-10f2-4b0c-b138-15aecae6f8bc", "comment": "Malware payload", "value": "b7af7175924e6632e21b06e52fe1721839d8547d3b0c8dd7b1d58aaf49ac60b1", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989335, "uuid": "6dbd4f75-dcf4-4a8c-ae11-8c1699b92876", "comment": "Malware payload", "value": "d2898dd2ff12a92dad3e7757f82b80bcbd880993", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989335, "uuid": "8721cd07-a600-4c24-a8b1-09d47faf978e", "comment": "Malware payload", "value": "af1c4d572c7c7d8c956c2d0fb5e92c210ab4456aa631af466a6d3ca710f02bd46c4b6ef102c0b91fabc9be50208f3870", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989335, "uuid": "d028b4d6-84aa-42bf-b0b6-106d5ebc6a06", "value": "T1DDC53A0A6B3F4A5ED611C4BED27B1263C5597D0CD028B8758EC04B457FA2F6096BA3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989335, "uuid": "f44134e5-b8f8-498a-89d8-1e0db1b92259", "value": "7ff63b341c536aaf5d6c5887373a00e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989335, "uuid": "97d3ac61-81ef-4eb8-8728-40729e9e269e", "value": "49152:EHW9n0jfLo/jJCNf7RY8pAwXGxuWg8VHEHM:rWy8pAwX2vgCHOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989335, "uuid": "c71b1995-22ea-4114-96d0-2b5777452541", "value": 2540544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989335, "uuid": "70e67ca2-2eab-47dc-a5a6-60fc1a71f730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989335, "uuid": "92855686-c482-4560-ba3a-524d314109ff", "value": "b7af7175924e6632e21b06e52fe1721839d8547d3b0c8dd7b1d58aaf49ac60b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe95534-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990167, "uuid": "3a3dbdac-4ec1-4829-931d-4f74b8ff93b9", "comment": "Malware payload (Mirai)", "value": "b4f56575295cf612990e0ebc5131eff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990167, "uuid": "911b7a36-8f22-4745-a02e-ead356effa49", "comment": "Malware payload (Mirai)", "value": "b8202050b71faa371f300d48d6dcf27010aa204c8073c45b2ee6dc53c9a188ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990167, "uuid": "d0735c1a-14b0-4d2c-b293-c16afdf7fd88", "comment": "Malware payload (Mirai)", "value": "6ab9babf2cbb773d8ab2b538f8ef6d45b518d3f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990167, "uuid": "2068b6dd-e918-459a-afa5-ef71e710484d", "comment": "Malware payload (Mirai)", "value": "3e8379333759f80b18c0fbcc33cfda540193ea98068b221c4450aead7befc34d00e6a4ded3973f2643899096d3dd4f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990167, "uuid": "9f956ae4-20c2-4821-b284-26284e53fac6", "value": "T188736B32B935093BC0D5547A61F74B26F5F683CA20A8871E3E710E9DBF605403A53EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990167, "uuid": "25a72ae8-2184-4bcd-911e-4f15d8f83825", "value": "1536:3OvfWuUP7Q45g8ztIoRYm5XwMvxJy0tCIW:evf3GyMYOXwqsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990167, "uuid": "7758ec8a-7ba1-4b39-8bed-45fdce380c5d", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990167, "uuid": "2d4515b0-58a5-4644-b1af-d59734b5f954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990167, "uuid": "36d70638-243b-4532-9259-c655e1178478", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01865dd-b6dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761972048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972048, "uuid": "a6979b8a-7466-41cb-be7d-cf39c52e91ef", "comment": "Malware payload (Mirai)", "value": "2997dd52b942ce32d424336d73890639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972048, "uuid": "f98b3a87-34fd-4c25-8654-1f5b9dc9df0f", "comment": "Malware payload (Mirai)", "value": "b8324e730eadec45f2ee6df3fbc56a5d020a3d0e96ae21123cfb9978de1f11f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972048, "uuid": "1dac6a4c-559a-4fef-b392-8656bc248d91", "comment": "Malware payload (Mirai)", "value": "6423f0341c6254a716c5e2443bbabbe846da1055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972048, "uuid": "ccb08269-a2a5-45a2-919b-54a425908779", "comment": "Malware payload (Mirai)", "value": "765c8ba92f57a36f1eaa2476e2b3c2432f4f8b3f6f863e40d00cf7d4ea1e707b4f4eca172db3146b95b10a33232d768c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972048, "uuid": "a3894672-d7b7-4e35-9180-8e1f5d969b5c", "value": "T125F33B0BB7108FB1C369D67009B78B67A6E626921AE19985E75DCD107E3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972048, "uuid": "796f095b-83e9-4128-9ebb-ba0eeea33633", "value": "3072:hNJ2kWmdM/DaLTa4aDO0z7+0ak5UDj1hPxp34yMUzk72faS:/J2kmDaLOvDX7+0O31Xp3IU9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761972048, "uuid": "81d6b830-aa3f-45a7-9f10-ce77fafca514", "value": 170688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761972048, "uuid": "618e7880-f14c-43b4-a5b2-3f458224a78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972048, "uuid": "f31eebd7-67c8-4c36-8116-24693ad9b753", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282fddb8-b6df-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973001, "uuid": "e5c13cbb-1e3b-4c33-b632-792a122e92c5", "comment": "Malware payload (Mirai)", "value": "ac681ae0efb2eb0a2140d182066fe1a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973001, "uuid": "0cb5a46c-6ee6-4235-a723-abbc890ebf87", "comment": "Malware payload (Mirai)", "value": "b8a587dbc9c7df603590ad4a6b421139ae5267ee284fa814dd5799ce54ec3076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973001, "uuid": "6bc22ea8-9cea-423c-9c8d-82fbde1769f8", "comment": "Malware payload (Mirai)", "value": "f4a5b4fcee1868a9f9ffb1948c150b4b934bdca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973001, "uuid": "ad9677bc-1ce0-42f3-9365-a66215057db9", "comment": "Malware payload (Mirai)", "value": "89bc7c8f1f815531e0b3b9e7ed323c5aea8f7a2383a44ca093876725f89ae98ef860bbdb9f66dd55a3deb2378a281f0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973001, "uuid": "8736dcc5-df4a-4d6d-96f1-4c7bd88836eb", "value": "T1B4B38DA86A4E7DA3E2CBD37DDD084F62712B75B1C26083F57E01A35DC6D799AC9E0401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973001, "uuid": "27efb332-6446-44ce-9597-354c539c1a03", "value": "1536:eVEeciqgaFmpa9HRUCSEdbMrmXxP+RADLz/AlceZ6fZ5:VsqgaxRUCSEdbsRWLbAWei5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973001, "uuid": "291beced-5063-4f00-be9b-63ecf0abd274", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973001, "uuid": "74e16133-5757-4f13-b65e-fcec0be562eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973001, "uuid": "80f10fc9-9e44-4d4c-a9a0-d2ca6c85719f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d45983c-b6ea-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761977680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977680, "uuid": "b0b33d49-e43f-4938-a0b5-fb99560939fa", "comment": "Malware payload (Stealc)", "value": "18cf23ffa908ed994878e0510a807d0e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977680, "uuid": "7cf22937-58f7-4023-afe1-5810505e38bb", "comment": "Malware payload (Stealc)", "value": "b8d1074bfacb28578bd4c330e6eb8126c2f18d779aa7fdd5d992e5f3da703f51", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977680, "uuid": "3e3cb325-3236-4e15-a7b6-9642f57f3473", "comment": "Malware payload (Stealc)", "value": "5ffc0383f10172f6821d12193269c0303f275a12", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977680, "uuid": "0594a6d5-d51c-4daf-a89b-980af9f1afe3", "comment": "Malware payload (Stealc)", "value": "d51b7b3fcef91eda867736a51805d3ad8dce51d31be16913d15dc306d0d09aa8c8fc3025a40d8e12531569c8d117a31b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977680, "uuid": "231ff8fa-755f-43ba-9168-5000a5b30d4b", "value": "T11F960281A1C59278C0C9463820C153D9F0DE6D9A98F896DCBBC3BF337A73E6C1566792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977680, "uuid": "368d608c-13ec-430e-8ffc-07fb6c2a0664", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977680, "uuid": "bedbae1b-43e9-4209-b822-f8f603de821c", "value": "196608:MG2ILIrMhnQPwtGbny0SN3+MbzhtVUzVKY3cK:MhIsoePlUNZhtm02l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761977680, "uuid": "ce4f6955-e2cb-4d4c-8aed-cf6f49d1366e", "value": 8926768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761977680, "uuid": "01a0b48b-5835-45c2-b7b4-eed75416aa4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977680, "uuid": "7cdde0af-bad0-4fbd-9f0f-de640336e9ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cace01c5-b6c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761960389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761960389, "uuid": "93f70192-da0d-4d9b-8149-8bd1810970f9", "comment": "Malware payload", "value": "e16184061999c44166d32bc6ead51290", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761960389, "uuid": "fd84038e-5cf6-4a09-a2a1-107d5474d6e7", "comment": "Malware payload", "value": "baa1b09a29a038187ee3a30cfa0c5840bfe4a31674111b3c9fbdc9623cca50f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761960389, "uuid": "45b7a479-23b3-44c3-9d43-9a0c92cf3e00", "comment": "Malware payload", "value": "ea62f7e52c1f9e6c7b04e427de4efcbd9fd69c19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761960389, "uuid": "e73254f0-2da7-4f19-a893-4ba533718aa3", "comment": "Malware payload", "value": "2f2cf2c7b1a092f23004940f8c0838117b323bf63dfae5f7fa44a77d982f1a4820d16f1c95b0a54dbbed02943eb7e49e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761960389, "uuid": "f15d4938-b4de-47ab-95b1-c77b2b907a46", "value": "T181C08CA2443ED43157BD0A5EB345F2F4A916A4380BA03C72E8189680A1780B00C5F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761960389, "uuid": "b428c49e-a7d5-4e40-b9b6-75e5cc88cb38", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfqwXZCLBttUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfqqLebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761960389, "uuid": "da50282d-10f4-48af-b6a6-25d02e1650da", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761960389, "uuid": "ddf7e0fd-516e-4b1e-80d4-96ea91cac722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761960389, "uuid": "64a25613-c648-4943-8dfb-396aa0a4eb68", "value": "bggzr8hs8h.2sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e95fc37-b6fc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761985521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985521, "uuid": "b6e53e4d-1704-40b2-97fe-8d7f712167c5", "comment": "Malware payload", "value": "7e89f9ddbbd24aafe92ad3025b6e9a01", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "pipa", "colour": "#4EA794", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985521, "uuid": "ecf0ed94-05ef-4e69-b7fa-e63090cdb1fa", "comment": "Malware payload", "value": "baf0f3e9f99bd2e816c3dd2f3cc3b2ad8b75185045e0311f1a8e3f041860567a", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "pipa", "colour": "#4EA794", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985521, "uuid": "21d85f58-f5d0-4fb3-8908-4d33abf2f82f", "comment": "Malware payload", "value": "39c52262a1eeeb23e4665d27fd3fbe3e16e3e0a9", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "pipa", "colour": "#4EA794", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985521, "uuid": "e27605f6-b774-419a-a351-cf717fe50887", "comment": "Malware payload", "value": "fa56c45914ec984abd1e267236e5c40e081eb2de35383f1499f2df0ab6b52f0b6e31d77ee874d9b85ad62a3bfdb78f71", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "pipa", "colour": "#4EA794", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985521, "uuid": "ed4d21b4-34f6-4fdf-a89a-8988884fb768", "value": "T18E4633F0BE595E9CF86A2035F14BA8A5D4A73660EF6791E0C0DF56949CF35A2031E0F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985521, "uuid": "8c3da4a4-6591-455e-b81a-7e7e41c10d65", "value": "98304:rf0EVEIg7wZzQmR7eys+DvYmheRNadiv59+JXYMJOhGwib5kbBa:TBSZcR601eRNadiuXYMQhab8Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761985521, "uuid": "44d0a177-e38a-436e-b3b1-4aade4b56367", "value": 5411455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761985521, "uuid": "5d20ad3e-818a-4e38-bfd2-aa1582cbef97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985521, "uuid": "46e6fda7-0973-47ba-8581-177ceda0ba9e", "value": "contool(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dccecaf-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974433, "uuid": "2eedcb30-fc8a-4f8f-bd5a-483ddaa50334", "comment": "Malware payload (Mirai)", "value": "c6541a3d4ed94d18006be65115063c54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974433, "uuid": "c12c8c7c-0c94-4a35-ac1b-8e92bb023ad6", "comment": "Malware payload (Mirai)", "value": "bb99685ed4c6378f00c9d6b9dcde10c324118adb545618b8a341aa6edd90278c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974433, "uuid": "b14bf37d-04b8-4d85-811b-090ca07d04d2", "comment": "Malware payload (Mirai)", "value": "78c43487d0c080e4e7218c740fb3c61f4d93569d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974433, "uuid": "8e6598ed-5e30-4180-a7d2-445de65afc5e", "comment": "Malware payload (Mirai)", "value": "ead47e33efbd3851ad72bfb0a60fa9a48b30507bc4b716183810dbb3575e788dee37c1d8495431d5e859037d733c3df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974433, "uuid": "592c18bc-227e-416e-810a-49b2d7a8f95e", "value": "T1FAB3F959F881DA56C6C655BBFB0F42CD732613ECD3DB3203DE18AF65368755A0A3A041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974433, "uuid": "eb4c810e-f2c5-40ac-91a4-09858cdbafd9", "value": "3072:/31xDVHO6vVdkZ5uMir/RTneR281kvjXyFJ1QFOO47/6sBTsPn1q:f1RVHO6vVdkZ5uMiVqR2dveT11x/6ITf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974433, "uuid": "69acab6d-260a-4e1b-ad26-367784669561", "value": 111796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974433, "uuid": "6f2458f7-b109-447a-8b21-5c9decff8b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974433, "uuid": "034a26dd-09c2-4d69-9f64-89215f403571", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd8358c-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969385, "uuid": "275264fc-7ed0-45bd-830f-ffdf1b06fe8a", "comment": "Malware payload (Mirai)", "value": "274353fb0e63090a077bf9e377ac5d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969385, "uuid": "afd33a40-27a4-479e-8ee7-3e9e557ac911", "comment": "Malware payload (Mirai)", "value": "bbc38de2ea7a195aa4bb9e2c2c4d5336b6427433448f6513345f40b551f8e880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969385, "uuid": "f5296306-0b33-4670-9ffc-c8128df37dcf", "comment": "Malware payload (Mirai)", "value": "02cafe40fb81e5d22e05c2593ea5970688a57bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969385, "uuid": "6d601854-fdcf-431d-841a-b1b986d2d8a7", "comment": "Malware payload (Mirai)", "value": "d3c5fd89ab41da10033578a28d7faa67260d5061570b3c3a932c05a5cb48f99ead69ba7ebb391f0f9c0939316f16e620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969385, "uuid": "116ab289-f62f-4068-ace5-d36a8bd84b25", "value": "T1FE7302483499D110FF1107769C9818CC8841A9D690AEB1EF352A5F39D9CF9A32CBFDDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969385, "uuid": "c9ea3891-ef5a-4730-808f-acd2079673a3", "value": "1536:V8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14OLtBcGXUqh9+sadEO3dzzUCRvw:SIHq+kOQwgrBEEO/h7iF6q5v4OL05DRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969385, "uuid": "f8795bd3-1680-4801-8964-84a398262ccb", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969385, "uuid": "64646e94-fba9-44f2-9f17-1af4813194fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969385, "uuid": "732ec615-59a4-4eb5-aa3d-df0944c28d64", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742de4a1-b743-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762016078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016078, "uuid": "7d754c4d-a233-49fd-b26e-7be8d1855f71", "comment": "Malware payload", "value": "1c19e65240b5fd5c9a07ca5e3b343e5b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016078, "uuid": "05337ba4-2184-459b-8998-1c062f5883fb", "comment": "Malware payload", "value": "bc4be31393e53ddb23177a2bc812d37e7fa30576da9417498932956091418d66", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016078, "uuid": "3cf7603f-1b9b-4856-b241-f063e2186891", "comment": "Malware payload", "value": "444362000070778a2d82992ce113fbb359cdfb1e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016078, "uuid": "10eb9193-b9af-4f06-8de5-b40110858e8a", "comment": "Malware payload", "value": "44544f081eab4535f520a7795082fea877c242f663c29c02a5eb71a9a9bf5de100ede44745bf4c0f829bdeda3ff38d48", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016078, "uuid": "e57e059c-2521-45e9-bcbe-9a25e17a978d", "value": "T1D70140460574C7608C48C78B7CE42E5C5409D39561811FBCE98F29A6E5C9A29B0F3F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016078, "uuid": "b2a75e85-d4ab-4be6-9206-ad01a26002bd", "value": "12:784HqNZL4HdZL4HINZL4H+NZL4HXHZL4H2ZL4H7bBZL4H7kBZj:oSILSTLSIDLSsLSpLSULSvfLS4fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762016078, "uuid": "da2ca821-ba09-44ea-b523-358226d1ec78", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762016078, "uuid": "fba43148-e970-4dff-8f11-7f9b499f207a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016078, "uuid": "48b3d30d-2ce0-460b-8cc5-a6f5f172d120", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d28258d-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974432, "uuid": "df630add-1434-4b48-a9bb-e85dffaa14b7", "comment": "Malware payload (Mirai)", "value": "583e8683ada999bdff982fa089408dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974432, "uuid": "031a658d-c486-4964-a11f-8f9ef2d7665b", "comment": "Malware payload (Mirai)", "value": "bcd26280ff13689638f5ad8a994000af483ff74a709b2a038b473d0ff2e77178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974432, "uuid": "719a853e-0b29-4fc5-84ca-9250a623658a", "comment": "Malware payload (Mirai)", "value": "d1a6aad1d2a33e86e5a65e2dbb812501f6c10822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974432, "uuid": "e56c4f70-df5a-45a6-9243-39ed50149387", "comment": "Malware payload (Mirai)", "value": "9683cb18a074ab2f88c11f4564972444ea4d3cca4944eb795c49b40a38d50392f06341ca5304b91c393ff848b091b1cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974432, "uuid": "ee1e27b1-29e8-49c8-b069-51cdeffa306b", "value": "T197145C2BB3C3ACD6C11067308C316362776FD7081958EBFFDA0A3794A9A776256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974432, "uuid": "99752801-70f3-4057-b943-6634ffec9ab6", "value": "6144:IUd9Om515G62+mVTqz0mSRYtYkG7IKTtm:Iv6212zGq9G7Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974432, "uuid": "f2c78647-2ae4-4a7a-8375-889dc736a97d", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974432, "uuid": "0863b797-348b-43fc-867f-d110210238cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974432, "uuid": "d0990449-b10d-4ec4-991e-0e2c2c483e28", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d8dc70-b6fb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761985350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985350, "uuid": "23e806c1-a857-4f38-b48a-62818d5190b5", "comment": "Malware payload", "value": "f8b832d759f68aae2148f8ffa2647fc2", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985350, "uuid": "c8dbb6a2-691c-4e6f-bd44-7ff4e541e82c", "comment": "Malware payload", "value": "bd4cd6334ebb554b18e087b896e758340d61129637ed2fda15a0a30bc541286a", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985350, "uuid": "80a115c9-27f8-4f1f-a67f-2f4b85e39110", "comment": "Malware payload", "value": "dcfdc25399150a4f4202cb4544fee1ae5e4cd3d4", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985350, "uuid": "b8b17bbf-56e9-4676-91ba-2615dc94d5f6", "comment": "Malware payload", "value": "b9b317df4ac3f5e1c5dab6a780c6e056dd6c910c4674b60a1eac5209b8b2f058a1911a0fb61bd492ef93d1d522618e39", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985350, "uuid": "3789ffa8-cf3b-4e32-8017-d8d71e44bcce", "value": "T1E722A90B6C760A74524B85B81A7BCD0A39884713800D9CE4FA8C57B85F5DB65C7B1BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985350, "uuid": "90cd4dab-ac96-45ae-a366-716ad59ac563", "value": "192:oaIGVOp/yaZYJ/c1bztLhvS/2pTDz/4U8hZ+ejJzZVowgDzjaz:osm1dRA2pTDzLJejJzX3gDzjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761985350, "uuid": "fa7e7163-0ef3-47b6-86e9-53880a4c2159", "value": 10693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761985350, "uuid": "245e9015-fbf4-40ef-bf53-09e6079551bc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985350, "uuid": "0e000666-5e67-49c7-bda1-b95af7ee0a81", "value": "vc.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fe8ccf-b6dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761972033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972033, "uuid": "0bd6bb25-ce95-4fb2-a02f-1cecfc2ff14b", "comment": "Malware payload (Mirai)", "value": "c04c7b589924b8029ad54aa63c4b2373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972033, "uuid": "3f95f6c0-495d-47eb-a251-5f19fd338f4b", "comment": "Malware payload (Mirai)", "value": "c076c62c12715350a5314a471dc2082d6dcceee8beb1042238026862cc9f0fd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972033, "uuid": "b4dcd432-5035-4860-9ffb-260709a03dcc", "comment": "Malware payload (Mirai)", "value": "6900b1ab866a9f273e155379bb5dab6f0edd19bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761972033, "uuid": "8f836444-99ed-40e1-95f1-74e0480a9105", "comment": "Malware payload (Mirai)", "value": "3bb05eb268309c75dd2a0450331cc3fbb6f742440691bf5af7d0640a12e52309bbbb18a6cdabfe46d4d8b141fe1af9a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972033, "uuid": "d8cf7a6e-2e2b-4775-8153-b3f22766fea3", "value": "T1B8730246FF2F432ADC9C3F74DE3B5DE8A3A94A8D4A936A653703B14C1534184A89C2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972033, "uuid": "9e6a421b-ae69-4a7a-99c1-2c5b5d6f959d", "value": "1536:vuSefbft86r+2CLgr2W/8CkIYEntXLsmpTlo4torQ:vuvth+VK22UI3tXLsmpWYSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761972033, "uuid": "daa26265-6d14-408f-bd81-85ad9c10835e", "value": 75752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761972033, "uuid": "969b0e8a-bcf4-47a0-9879-cb91a2ae71b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761972033, "uuid": "ebe5a51d-ec52-4376-be60-5656b027f96b", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509a097e-b775-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762037493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037493, "uuid": "9d545e56-1b9e-433c-89d6-59da41ec2e6c", "comment": "Malware payload (Mirai)", "value": "862bddbda86a31387b64a5aac9fafb1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037493, "uuid": "8b087a65-47fa-425a-8aa1-5db76b3841a0", "comment": "Malware payload (Mirai)", "value": "c122f154e929d4f010264148d6e136543626699bfdc273e7d88a455a7b3c68a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037493, "uuid": "ff707499-85cc-4136-a62c-95c6e0837284", "comment": "Malware payload (Mirai)", "value": "a8f8c93c611b99343fc49b92f742e822131e91b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037493, "uuid": "92ef5cf1-6aa9-405d-b74a-0452e6b9285c", "comment": "Malware payload (Mirai)", "value": "aefa44c60ba1d4f71d73340e10ab23276d660604b877ab1193300d23335016a1536e4d995e6907d3b80d896651fc5bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037493, "uuid": "7d678604-1379-47a9-a7d1-3f9340689bfc", "value": "T1F9D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037493, "uuid": "c8ad1033-6424-4320-a056-277d501e3a95", "value": "1536:cP0nwryWv+n/qZIKcST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+EcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762037493, "uuid": "f39ceac6-6247-4aa6-9f64-cdc9cfd56245", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762037493, "uuid": "5a97bd9e-6288-41ca-a266-7d959dbd723e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037493, "uuid": "75272b98-deee-480d-a692-e874e7aeeb6e", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67078f1d-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761988998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988998, "uuid": "1f57c3c7-f732-4d43-ba56-aa54637194db", "comment": "Malware payload (CastleRAT)", "value": "77eb5b37828586664f3befcf02072ffa", "object_relation": "md5", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988998, "uuid": "73a1eb6b-2fc4-461b-a4ed-c1b23ff3a5d3", "comment": "Malware payload (CastleRAT)", "value": "c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92", "object_relation": "sha256", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988998, "uuid": "7f04bb5b-aa1f-4774-b514-ad2b56582f97", "comment": "Malware payload (CastleRAT)", "value": "46101ef44977c8bd3426d410a5f2cf0b25ccf6be", "object_relation": "sha1", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988998, "uuid": "5ee3aeac-1cb7-4cf9-8e72-faf9bbca2a89", "comment": "Malware payload (CastleRAT)", "value": "cde60b7807ebb00884ffc0db3d9177450a3922411301202f98743b3e043009f44ea340a98838863d40a4704af6b3f3f9", "object_relation": "sha3-384", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988998, "uuid": "b9c7674e-932b-4f74-93fe-63dbd15da4f2", "value": "T162D65C6F76A18668C35DC13EC4A38F05E83371B91733C6E783A902686F569F44E3E664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988998, "uuid": "60b4bae4-5b5d-45a2-8b49-f838895ab846", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988998, "uuid": "e3372a62-84c5-4a69-b3b1-e9d73df78581", "value": "49152:TZF0/5ltUaJO+xkgB0dDjdNGSQZKG67KugVtOHEp+9U0aAlxIhrmlqD/oWlNve7p:+RkyhrOHMsfh0V2Ecni6QFnGvNYIdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988998, "uuid": "af3cb2b6-0e5e-464c-aecf-d2d6c5100e3b", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988998, "uuid": "cd484618-9404-4d29-b83a-6f3d7566ff62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988998, "uuid": "470fde76-ce75-45c0-a9ab-6bd0bcdb41da", "value": "c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7f11d0-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969416, "uuid": "147b7b85-fc13-40ee-8276-6fab4b3b5a4d", "comment": "Malware payload (Mirai)", "value": "4734fb189e04c99f7b3f8ee9c291755d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969416, "uuid": "03f07b03-4d38-4e61-ab10-d20592a885ba", "comment": "Malware payload (Mirai)", "value": "c721323e3e39126f3266876d12b50b132488e6afd21ce7067a9cab97465d569c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969416, "uuid": "e2669ef2-a20b-4e52-80c9-e822144a41b1", "comment": "Malware payload (Mirai)", "value": "4bc1537fdb6eab4a4ad7029d41664c4876d3d525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969416, "uuid": "a82a7c3c-237a-46cf-9a6d-e6bb9f6ffd89", "comment": "Malware payload (Mirai)", "value": "45d86ad9337aa542f1f4880139f2bddcf915543c8f17cd777c7bbf3429ee4f7e4a0052d4f3325f9167d6730fa89de009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969416, "uuid": "46437b38-0825-4e76-b275-2a32ba326671", "value": "T1A1C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969416, "uuid": "143ed284-5289-4b36-938d-a92dbc40efd1", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeX5Bts4ceGM5UQ30hAB1EM:Zr4KEKcHmz2F4e6eOQ3GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969416, "uuid": "28622951-8d7c-4c89-a0bd-e9b0a86cefc6", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969416, "uuid": "7bfc543d-1244-4699-bfea-c72b6997017a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969416, "uuid": "eb19c0ef-56bd-4cef-bc4a-db5e30823455", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f1ac31-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969449, "uuid": "e2259ec5-d140-411d-96d5-74018ff44e36", "comment": "Malware payload (Mirai)", "value": "548376b912c2cfcce62a3f8f5d820996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969449, "uuid": "326ea2b0-9f56-48e9-8ea7-692ceed27346", "comment": "Malware payload (Mirai)", "value": "c88b92140bf19cfceac85c7d509939b4d2c65f1191b592805f9c6b745b1605a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969449, "uuid": "b03091a6-a224-4dac-ab2f-ca37a25082d9", "comment": "Malware payload (Mirai)", "value": "9a0b5293595a79bf7db70b1f735c5a178a2dfce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969449, "uuid": "cc84284a-ae5e-4655-a9da-3f9680ba13ae", "comment": "Malware payload (Mirai)", "value": "e705f3a6a6f5765366cfa0fe8796d8cf5777081e297b4722a9a18674f4a1e4fc83b634503f750cd0ecd4f2f27584150c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969449, "uuid": "afa12852-9904-4b1c-988e-8df80993c682", "value": "T17CF32981F9414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD215F203B8695B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969449, "uuid": "9248759b-4cec-4bb3-aa8e-924bfe890955", "value": "3072:tQC7toK0cm5aWW/i4SXdAcTvEG7kJ6hh19OMZ:tQ2PoDUi4sd1T80kmOMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969449, "uuid": "c5491bea-297f-498b-ad31-ef2412d374af", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969449, "uuid": "94555640-aefb-4d34-bd4f-4518355512ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969449, "uuid": "fff011c5-3bbb-4212-bbbd-94ffbe8974c9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ba1b29-b71e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762000109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000109, "uuid": "e346551c-b9a3-41fc-ac77-b916d8653be7", "comment": "Malware payload (Mirai)", "value": "0bee4906b5f233842bb2ba1ff85639aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000109, "uuid": "bf536cf7-1571-4863-a4b8-26ab55f07a48", "comment": "Malware payload (Mirai)", "value": "c906d4992ea6d42d6e10f59a8930c272f2d6840fb11cf99f5f16c83ba46ef529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000109, "uuid": "d36f082c-28b8-4068-9349-5ecf41e3bf80", "comment": "Malware payload (Mirai)", "value": "66f7ca6f212aeb1a96579b55b2b5d4293c594416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762000109, "uuid": "bcbc6618-11c8-49d5-ac55-df485245459a", "comment": "Malware payload (Mirai)", "value": "ff80db06db7d4142f7fc2de38dce7e196dab9db4d15b22134431b5bc33ec963557d99b471379e0149f55618ec008d48b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000109, "uuid": "0bab707d-0961-49f0-8276-dedc0560118d", "value": "T10B434CC1D653D8F9EC4A06B41036F7338B37F539501DEA63D7A9AA22BC92A40E5163DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000109, "uuid": "6bcb603b-495e-4191-a756-ae93473f41b3", "value": "1536:QHFqf0QcXivYssUAtkhEpu5xMt9xo0WF1z0B9xklSYI3fLFjP+YBZZGJw6RQQ:QHFS0QcXivYssUAtkhEpu5xMt9xo0WFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762000109, "uuid": "2f80f656-0676-45ed-86ed-9635df393b00", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762000109, "uuid": "363fc1d3-e1c0-4936-8480-3c0ce5c049c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762000109, "uuid": "cc4315b2-651a-471d-a5ee-5ea2cb4a4cc9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66ca82d-b6ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761979360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979360, "uuid": "195fadb1-f8d8-4cb6-8891-617eba5430d6", "comment": "Malware payload (Mirai)", "value": "85cc9f94e3208dcc5fc48feca2c1ee2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979360, "uuid": "88ca3515-44b4-4935-bce2-e9ac426a0874", "comment": "Malware payload (Mirai)", "value": "c920680983e56942389ceb523d4e032c92aaae4b5420c1aee496a035391674e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979360, "uuid": "9e7212af-a9db-42b9-8de9-60ade055981e", "comment": "Malware payload (Mirai)", "value": "71663373aeee302edc8772b65cbb636fc9331cf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761979360, "uuid": "c944eba7-ef6b-4433-bc83-de37ac5b349e", "comment": "Malware payload (Mirai)", "value": "c4b97c0ee228794b4e92617ae8b0e11fcfd8fc1ac51a009011ba92a8684c2a329d162f8b234d00c9ccf61d7add4687f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979360, "uuid": "e18a01b7-265f-4e28-b481-915e397a42e2", "value": "T116D36B76C82A6F68C661D474B0758F352F53E58082476FBE25E2C2B58483C9DFA05BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979360, "uuid": "44896193-bb50-4923-98f3-65dbb50a7acb", "value": "3072:q4iLWwz4t6IeaVEfGbMd/WFVJTJJodfnv:qXWcDQVEfEyuF/VJodfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761979360, "uuid": "c66365b9-67f3-4af4-9311-7eabb10c5888", "value": 133732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761979360, "uuid": "22b8a6dd-9b6b-4e60-9f56-5add17f5ce7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761979360, "uuid": "1b3605f2-7b8b-4d82-ac8f-f53136262291", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae9135a-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969409, "uuid": "ea6c3031-f2ab-4e83-921c-64344a607d38", "comment": "Malware payload (Mirai)", "value": "8b7eda1dd355ef5377dff2779049b50b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969409, "uuid": "ed07cc3f-e47c-44f4-8510-55453f2c3975", "comment": "Malware payload (Mirai)", "value": "c992b16ef8cb31fb7998cff5c7d1ce665830d4b6cdae11c48d6758fdb1f26690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969409, "uuid": "4e9fda6d-e83a-4ba4-9755-3f71b4c2ade0", "comment": "Malware payload (Mirai)", "value": "70854cac34bcedf92ba1f426984c2cec765fc8c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969409, "uuid": "0b6bfc76-a814-4a02-a2a7-94116ec990a8", "comment": "Malware payload (Mirai)", "value": "ac06c7a28e3eba72082246dd35bd7ffa01cd405dc8e4756a3b35a382ea008b42298c6f8eb61fbb69970c600d825a07ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969409, "uuid": "dea4b7f4-83c0-4f2c-8830-46e257987658", "value": "T13B531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969409, "uuid": "5753e778-6d4d-48e4-ba71-6606085771c9", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969409, "uuid": "f84cfb03-08d3-4a0a-9c3a-4a042d8ce2fe", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969409, "uuid": "babc8d7f-71d1-4dc2-95e6-d422d9dad0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969409, "uuid": "b055f35b-6a29-41cb-8c3f-929e3b544da8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d977ee9e-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993055, "uuid": "faea3725-ba88-40c1-9108-c4bc8988923e", "comment": "Malware payload (Mirai)", "value": "4c65f4f18aca7418cc6ab42aa35212ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993055, "uuid": "94f3463d-df8c-482c-97d6-8763cc61c6a0", "comment": "Malware payload (Mirai)", "value": "caecf172cfe7405e4feca3d24ec1007ffde4df46934db85ecaa85ca39281a8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993055, "uuid": "215500d0-87a5-4e11-b3fa-c83cf7ee3f50", "comment": "Malware payload (Mirai)", "value": "b300fa3ee49f96146113d0af2b0a15372f2eb5a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993055, "uuid": "23c8c084-9b79-4c2e-b103-b5879c6d25d2", "comment": "Malware payload (Mirai)", "value": "0ad04da1cef21583e577e8339d0b76a6570a59c56968d4f17a9eb0f2fbaba950bb3d9d7895531f09ac48d4b306b00d4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993055, "uuid": "e6614cc8-59df-49c1-b315-89c49b160807", "value": "T175532C42B31C0957D5B3AEB0253F27E093BBE55021F4BA88251E9B999371E325186FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993055, "uuid": "ff6820a8-4049-4619-aa30-9f9288107562", "value": "768:bLQaw7umFBnpoyu7wfQ99vDoSeONP6O3QRdsjF4mtuWkuqh/2IOi:XQT7FBiPcfCvDteAPx3Qhmc3uqh/2Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993055, "uuid": "027d0c65-5bdb-4e50-a268-8788a9703f8b", "value": 63104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993055, "uuid": "7d141f40-f2e1-4506-af0c-8429bc864099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993055, "uuid": "90f108d9-9082-4cea-bb61-bb8b6c1eed3e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608b39e6-b6ff-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761986840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986840, "uuid": "29fded35-dbef-44b1-8e0f-fbedf7743a6f", "comment": "Malware payload", "value": "c1bda42c103a24dfa502ab9fd1e77fde", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986840, "uuid": "ab9946f7-c836-4ad9-a1f5-219f0604d68c", "comment": "Malware payload", "value": "cd42d4932958ce96a4b9f3be23a31c1858fc0e848993cfd32724aba2856d4afe", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986840, "uuid": "cfcd2796-ece3-455a-9734-8eab6e1017e0", "comment": "Malware payload", "value": "fdf4e9b67d7ced0571d4e13cdd0774901ef2b152", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986840, "uuid": "3041310d-4444-46be-bcea-38205ec89bc6", "comment": "Malware payload", "value": "4bc6da0793157bbf063f1a50ad5616a5bc93bb44b397ca8b39d7d0439be5db593aa2cfdf335394fd0234b7c2742101d9", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986840, "uuid": "107e3569-b4dd-4567-bd8f-f51ff3d19f59", "value": "T1AFA3B625871C66B2C18CC73941E65316B163F18A46E2960F77CDC12CBF853A87E71D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986840, "uuid": "8c0c25c7-fba2-48ab-b6a7-c5237fcb4819", "value": "192:dvS8qLtLduSBJkPybyEc3zBDzLduSBJkVyLyS:RS9LSMruEcDJsMReS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986840, "uuid": "9396d8ed-a226-4783-a590-9f0172bbfb86", "value": 101536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986840, "uuid": "aa189c17-d864-488c-be2d-14dd0563a7f4", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986840, "uuid": "b9cd15ff-dac8-4da7-87e5-cdb44bb5d90b", "value": "apps.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30e0030-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993045, "uuid": "2aaee4a9-6571-4c01-aa31-7e4b7a2165bb", "comment": "Malware payload (Mirai)", "value": "842f938865ee3adf3cf7b6bd86d2b2b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993045, "uuid": "563c5f63-91d6-4d5b-993e-41e9f18ab848", "comment": "Malware payload (Mirai)", "value": "ce14f6734aca617f41906ff32c6a98787126e826d70b1f04608df19d7d92383f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993045, "uuid": "dc47883b-0329-47bc-816d-69f6a11a4c81", "comment": "Malware payload (Mirai)", "value": "d29a7ffb5e64a80fc2c093b48223ec9df7446108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993045, "uuid": "e840a020-84de-4004-8935-dcef0c676986", "comment": "Malware payload (Mirai)", "value": "64e106bde8e86608976d7c09df577cb0210cb699a8bcfd5d0467053ff27f33ce836b5a2fc3e03540ec3afec214dd0fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993045, "uuid": "e47d3306-544f-4bc3-aa8e-824bf40d76d2", "value": "T11FE2E162B74B9408FFB101F874251AF47F99F626C6E321582DE95FD6E63E48022F2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993045, "uuid": "02eb23d1-b162-4cc2-98a8-d19aae757ccb", "value": "768:PpfO0Z8P5HjfjWZi/oNfqk80597bmcuzmqlZ+dZ6:BRKjf6I/ox7V7bxL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993045, "uuid": "d32658cb-bc7c-4a63-804d-5c1141799bf4", "value": 31984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993045, "uuid": "3d144924-61df-4966-8e81-995a2333f095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993045, "uuid": "2aa7c900-0065-4d3f-a0cd-b1c3826e1ea4", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77964d65-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761989026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989026, "uuid": "e667670c-5ea4-4d55-8c0f-b14eb83bef11", "comment": "Malware payload (CastleRAT)", "value": "0ecd9c1d3597b1b8f7f7dd2798d15ca2", "object_relation": "md5", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989026, "uuid": "92674aa2-4485-4873-b4e5-82ae1853cff1", "comment": "Malware payload (CastleRAT)", "value": "ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c", "object_relation": "sha256", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989026, "uuid": "2e855c7e-562e-4b21-a58f-10741b1e3dec", "comment": "Malware payload (CastleRAT)", "value": "1666a6f3ea8ed185793c1f0188e25c4761c120d1", "object_relation": "sha1", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989026, "uuid": "6238c6f3-49c7-47eb-8cf3-4307df1119ba", "comment": "Malware payload (CastleRAT)", "value": "0f4de9919d4572881c18e752e2aef9e18a48c7497067c47473e3fd4a36c82a1003b75ede8441e2605bad34a53cba25d0", "object_relation": "sha3-384", "Tag": [ { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989026, "uuid": "1b65b90f-7be6-40bf-b1f5-f6b1f71f1003", "value": "T1F5D65B6B76618A68C35DC13FC0A38F05E93371B90733C6E797A402786E5A9F04E7E664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989026, "uuid": "51e972ad-d650-4dda-b6f9-06f1569429af", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989026, "uuid": "121527f3-e0b4-427c-9a90-66a66b5a6185", "value": "98304:kRkyhrOHMsfh0V2mcni6SbaLJyEXgmRQdQI:knhr/spCpcEbOr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989026, "uuid": "51c1d4db-f630-428e-8c9a-5e6e2b83d59f", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989026, "uuid": "ebcbeb2a-89b0-4213-86d0-331838239261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989026, "uuid": "da918f26-2c36-4bf9-80cd-d190e5c9a9d2", "value": "ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d9eb8d-b6e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976222, "uuid": "bc0de2bb-22ae-4a89-8ddd-ae38b54abb0e", "comment": "Malware payload (Mirai)", "value": "a407d78638b88879a1f135abd0d487e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976222, "uuid": "440fd3b1-0872-4574-abc8-b48bffd6429f", "comment": "Malware payload (Mirai)", "value": "cec45f6babf80c006e2092d6b2750cf13f324bfcaeab83ab3258c8337d267b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976222, "uuid": "83c64e88-400e-42d6-abea-0c7f8a948e4d", "comment": "Malware payload (Mirai)", "value": "79ef9f45191524006e491390d454c1134b454e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976222, "uuid": "4c83bf04-0c41-46a4-8a17-8f1c2f877a3a", "comment": "Malware payload (Mirai)", "value": "f4e295f96da6ee620ff28817fb4bf548ce25efc22f95f9e1ef4663fd749bfc79a600a08d646ea5513c825066fbf8c549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976222, "uuid": "43890379-eba6-4778-805a-df381c4ba72c", "value": "T11C4301BD5846F4D2C96D1C3C50BA35F9ECDCB0C1A424E8726B8058827997395728E8FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976222, "uuid": "331cf04e-34fe-4788-ae51-86d2ef922356", "value": "768:gCJfix4xPJ0Q/R34t9J75Rf+Mn6X00zy5rqLEQKf/8u5JIPvaGzhfWk:gCxxx0Q/RotLVRh6knqIbEgJQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976222, "uuid": "21ba07fe-87c6-43e5-9dd1-0736c0314dbb", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976222, "uuid": "d59d0588-3642-40e8-a9c9-0ab682a4ce03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976222, "uuid": "00cc003b-104c-4eb6-8b5a-e7a2f50c0d7a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597bbe81-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761994988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994988, "uuid": "d2364c55-58fa-41a5-a106-9a298fba430c", "comment": "Malware payload", "value": "f36e92d6da5c77cca267c707245c4cad", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994988, "uuid": "32e1c4a0-eaf8-4b39-8fd9-c462a0d78347", "comment": "Malware payload", "value": "cee6d44cb902e18637fe6df302f9407f3dc70e05201fb07997a294c6b83f5901", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994988, "uuid": "9aad2974-f1e4-4eb4-83fe-db3b6075ef9e", "comment": "Malware payload", "value": "abf1c3813364650ba388dc9e5e218cacd776f6bb", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994988, "uuid": "f4edd44c-c8a4-4a9d-a57f-85ff9e75d8e9", "comment": "Malware payload", "value": "2a08538122166eede009126dec9de624a40144f8ae4e384de3bb6ce59ef780529fbfb092e4a2d6a7533a8e3622b19a0f", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994988, "uuid": "313cd8a6-879d-49d9-b31f-3e658e7c2033", "value": "T13E514BE4C360A5D8C4D4F3B04BD5EDCAE8F1C76B56E28A92A771100B3C0094442E6AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994988, "uuid": "03359fbb-a343-484d-9e85-2d2cde48d2ac", "value": "48:9d71tUUANeWU5pTNDUQiT9KqSDKhdQXE2GO5fUqMW4ioT5gECm7CXTxwSSw71v/:VtOeWwpRDUQiT91SWhNO5f8W4iA5go6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994988, "uuid": "7d0d2bf2-de2e-4c49-9bd6-e8ed82031194", "value": 2720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994988, "uuid": "47b76046-e2b9-4ec8-8c13-aadfe61ca2bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994988, "uuid": "c1fae5d0-8b42-45e4-b54f-6469ec4fac77", "value": "f27d629aa2adb453f4c76c4bf49b3b3a4a7878b68c90efd0a9478508d0310ee8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e084ca14-b743-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762016260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016260, "uuid": "3218664a-7c9a-47bd-813f-99e4378fb761", "comment": "Malware payload (Mirai)", "value": "370b699f82c9dbfe76225ce113fc39bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016260, "uuid": "d9d66806-454b-4624-8dd4-6d314e6910ca", "comment": "Malware payload (Mirai)", "value": "cf00a56ec337b2d65c683a3ff6e573292225e03810ddeda2846c1e155070c0d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016260, "uuid": "364e200d-7af6-4b94-830b-2dcced841cfd", "comment": "Malware payload (Mirai)", "value": "10e6d5e532cc860e86c972ab9124681bcb7968f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762016260, "uuid": "a22adc69-8619-493a-abae-29d201dde11c", "comment": "Malware payload (Mirai)", "value": "4bbd3f8eaa2dd765a963098dc3881b5f69666fe48093fc762bc8c613a0dfe634d2da6e32890557d74f402e4e1f2f3e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016260, "uuid": "4093dc16-45df-4c78-9edd-1b9218a9f808", "value": "T189E2F1C056DAC636D2F3A4BB0CE833287AC6FC7D61511D9658032BDB2578838D447B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016260, "uuid": "ac899549-faaf-4baf-85b6-8ff31f2a4d21", "value": "768:TmtQyR+EUdvT0njSjbD1VpJoYnYgJDxsgU4nzo9Ky0:itQyYEYInY/7p6YY4DOgrs9Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762016260, "uuid": "c43d1589-9034-42cb-8e20-dead9580524e", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762016260, "uuid": "206ef82e-227d-4e34-b81d-386b91d27fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762016260, "uuid": "836930ab-4995-412c-97ab-54efcad38c36", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae45e88-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987152, "uuid": "f1e3ebf8-423d-43d6-9b27-51c89ee96daa", "comment": "Malware payload (Mirai)", "value": "00bc47d38c44057a46e90863c85d212e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987152, "uuid": "c6f2ec4f-73e7-4311-a5f8-43babea00015", "comment": "Malware payload (Mirai)", "value": "cf1ca1cbd2c6c005d48d5e9d9e5991d09e3c9904e8ec7165479ee7e09fc86df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987152, "uuid": "adcfac56-332c-4a86-bbc7-d1a62b6386ac", "comment": "Malware payload (Mirai)", "value": "c1592bd69ef56a30299a293c1d074ceb8df98e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987152, "uuid": "c0f7e11d-b6b3-4825-9bb7-a11f25cb2f6c", "comment": "Malware payload (Mirai)", "value": "b5f7d4958eb3539ca982b7b9c8e38d7d599ec76ab2fcb5658de2f90e567139036ca160cd7a605c9e7cc56095ed461aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987152, "uuid": "0c30a908-2f6f-4525-b156-4624531ac7d6", "value": "T11E04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987152, "uuid": "bc73af79-2383-499f-b324-f1c0e0ac8d70", "value": "3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65aVt:nKYeeNYQqmeqavlg65a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987152, "uuid": "7dda9100-9579-4ace-b263-8b533bcae369", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987152, "uuid": "2a3c67b5-a16c-4cac-a398-4113f59035f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987152, "uuid": "d2d2ed95-7f7e-415c-a71d-0d47d8e6b589", "value": "main_mmain_sl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7316b2e6-b717-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761997179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997179, "uuid": "4990ace5-c24a-487c-907d-253b41973b2c", "comment": "Malware payload", "value": "1d5a6e5da8b1009b18e3e4f73a9d6c5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997179, "uuid": "45f9d319-6258-4bcf-b88d-6521c8d250d9", "comment": "Malware payload", "value": "cfe4da949f36a7f57b5dc4e95b7b4cc5d4a8b2cb018a5c538bb1dc801d7899ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997179, "uuid": "e343e06c-75fa-4a68-98f6-5de9619b3b7c", "comment": "Malware payload", "value": "4b4375d69e4867d1f149235981f61eac4cb628d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997179, "uuid": "013dfa1f-c276-4354-b5f5-54dfb8daeb35", "comment": "Malware payload", "value": "e510f2175ad06d6722cfe1324e6d11ae8723e6081ba6bda0953017d5ada35044bca0b1797a9619ee4bc0e4e7f3a7391a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997179, "uuid": "797a630a-5cb2-4e81-a9a8-6a04a70b0e46", "value": "T11DC08CA1443DD071533A0A5EB342F1F8ED03A4290FB038A1D4188A80A1740701C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997179, "uuid": "170d8498-c455-4227-ad85-82773abfded3", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfNjNAKNc1QREtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfZqQhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997179, "uuid": "7160db0f-5b17-4377-852a-2048a07bcd1b", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997179, "uuid": "9611f5f1-23ca-490e-97e5-65977f0a5b99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997179, "uuid": "405d83cc-ff9b-4935-8b1b-710a36218eef", "value": "5n7acsetdu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578fbdbd-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761987254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987254, "uuid": "f961307d-10b2-4629-ba5c-db2cb7037a13", "comment": "Malware payload (CastleRAT)", "value": "a8ae67da33e0e914bbefdb6bcebfca92", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987254, "uuid": "98faa7d7-0024-4429-b76f-a86ff237c257", "comment": "Malware payload (CastleRAT)", "value": "d072da4c2346e342e43ec81ce7b45a72ca1dc932e5e9c7a5740cc70465a3a326", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987254, "uuid": "8c5e5ed8-b3f3-4cae-bd26-48e871a0d34a", "comment": "Malware payload (CastleRAT)", "value": "e9dc82fd0ce33d9f247b7ddf36059e4b85787d4e", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987254, "uuid": "f2b7bc0d-b02f-4ec0-996f-ae805328a42b", "comment": "Malware payload (CastleRAT)", "value": "6d0a93ed7503802d09f00ab91656ca7d62a0f8e6580038366e65dbbc18529104425a35cc7827e10efbf8bfec8185a136", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987254, "uuid": "d663f21b-761e-4287-be30-b6048ce5d2b2", "value": "T17D758C0A6B3B0B9DD55588BED67A1173C5687D0CE01838798EC44B057FA2F609A7E3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987254, "uuid": "7ac78442-1dd3-4725-8b77-01cec8caec98", "value": "78520876bfbd93a2cc73c139c5e634ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987254, "uuid": "d64434e1-c6f2-42b9-b520-4f49e23cb9c4", "value": "24576:1NJ9r0TzPKVysoLnmefsM25bNrMl/f42UhOZzbKuNl+hJCvggR:1Nm/nfANNQlH42UYnKurbvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987254, "uuid": "3752028a-68a3-4e16-83df-bd0be2e93b96", "value": 1635328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987254, "uuid": "78b382c3-8751-45c3-bddc-fa487d7df225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987254, "uuid": "b76d44b3-bf6f-4352-8de4-a3c564062f38", "value": "Organically_v8.150.158.4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e122fe31-b717-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761997363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997363, "uuid": "f988d30b-75d5-4bd4-87e3-eeb4039e1b87", "comment": "Malware payload (Mirai)", "value": "f93d80740c1f8fc2eaeaa71982555d9d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997363, "uuid": "998b6d71-e46d-41f9-8079-48a8cae22e87", "comment": "Malware payload (Mirai)", "value": "d0c85328b7e5d283d5239f4e67c16f07b836eb82e22fa2647ba61ea0486cd47a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997363, "uuid": "02881535-e69a-4adc-98c6-7c1132a1274a", "comment": "Malware payload (Mirai)", "value": "8ec34fd3f1e43278fffe3c8167ed0b41e3d7cc0f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997363, "uuid": "bc23923b-337f-456b-a344-95c19c9698cf", "comment": "Malware payload (Mirai)", "value": "d49adc27c5a3e690655076fe27061dce2ef64650dadec42b9083a4c1e871eda2a419bb61a610ad7de70a7e215951425a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997363, "uuid": "6248a7be-c26c-4134-bd83-92a7ad2a68aa", "value": "T1E201408B0871D7FD8CD9D770BC6249245418D2829DC10F52EECF77A3B999A347076709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997363, "uuid": "57666a4a-db3e-4f4d-a37f-0991caa16922", "value": "24:oSpM6OxAQSmM6OxAQSnM6OxAQSdM6OxAQSEM6OxAQSFM6OxAQSvCM6OxAQS4CM6s:diFAl7FAlMFAlOFAllFAl2FAlHFAlQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997363, "uuid": "9d105aad-4dcf-4504-8adb-ec12ee6ee385", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997363, "uuid": "e8d3ebd9-1c08-4317-8f15-d222095da48d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997363, "uuid": "a1d92321-ffec-4286-8ba9-4470fd016ced", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c46c971-b6eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761978162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978162, "uuid": "45a58060-a42e-4542-8ed6-9d94c960958d", "comment": "Malware payload (Mirai)", "value": "b4313905e8f2ce727ca84fe833572192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978162, "uuid": "681f30d8-b743-492f-9384-bf2881dd331c", "comment": "Malware payload (Mirai)", "value": "d23273dcf0ea571e50b912e3da2b26d9ae5114444ff72568e13953f59d1a34a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978162, "uuid": "2a256bf1-0684-48f6-b47f-93c7c4f7e679", "comment": "Malware payload (Mirai)", "value": "412900b4ca87003707477067b740881963dd60e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978162, "uuid": "bf2ea976-70c2-42d3-8242-b8cdfb9b1fd3", "comment": "Malware payload (Mirai)", "value": "be210dc0c341aa60b1c6c0575360568da17da0879928d326050b0b7dece4b52594ab3f19fcef0a677b4b7020e1ca14db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978162, "uuid": "9ae444bd-4da4-4461-aeee-0b846df707d4", "value": "T15AC30759F8819B26D5CA15BEFE4E528D332357ACE3EE3203DD146B2427CA95B0E7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978162, "uuid": "c3950120-e7ba-4177-8a89-8b4c084d12f9", "value": "3072:ZdsZzstxT7ULqS+bnZ4R0PYDC1dOua9CKHdLPlFJ1D80h0brn1T:jsZzstxT7ULd+bnWRNDqkua9CKHdLPHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978162, "uuid": "602ff245-d616-401c-b0f7-003b421c212d", "value": 125768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978162, "uuid": "1cbbb6e7-d39a-492e-82db-38a46bebd8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978162, "uuid": "55ab60dd-3a80-4b33-a46f-6596e2707aff", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983c4401-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989081, "uuid": "1f395f94-8abc-4469-a6b3-cec5dbaf4f39", "comment": "Malware payload (Mirai)", "value": "a00ca782337146fabbdedcdb4c722cc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989081, "uuid": "89e0e1b0-85ff-487b-a49b-6ca4897d21d1", "comment": "Malware payload (Mirai)", "value": "d2ca9b2ebec86c27f85338f502f3f43d211c78dae782c668d2deb5a2fe2ebeca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989081, "uuid": "bc9de524-0590-4ccb-aa02-a1d94014874a", "comment": "Malware payload (Mirai)", "value": "af3096b684db46ff718873778156a88862161ef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989081, "uuid": "fec9168d-7519-4b21-8fb0-01b4a4f2a022", "comment": "Malware payload (Mirai)", "value": "76906b1bd37f08aa47c8bdfa331785e6733ebc37646d11e3f09db5bf52b0646c8defbcf554722e0308dd9e2f5b3c7182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989081, "uuid": "7fb186e1-9dfe-4a3f-9013-0be61589f696", "value": "T182632B96F8818B21C5D51379F92D168D372227F8E3DE72139E205F603B8696B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989081, "uuid": "6efb3338-6504-4fe6-a3d8-d05a15bcad48", "value": "1536:hgnQF5wnHEFO5jneFjYOb4ZlximMQoMBiFRf0a8K+Ja10zt:5wHEFOxn+jYOb4cRf0a8K+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989081, "uuid": "e98f0713-75a0-46a1-aa32-143549a98a4e", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989081, "uuid": "4e91d689-52cb-4282-8ce6-10b01ef3f5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989081, "uuid": "9e9c96c1-69c8-4045-a0ed-381343f6ff94", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a6f3b2-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761995066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995066, "uuid": "7114b431-a559-4954-8a97-4fb4cb71f14c", "comment": "Malware payload", "value": "a57d9d3ecf3a4f8dcb021b1c28c8f837", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995066, "uuid": "9fdb7291-5048-4626-a1b0-77e8fe575209", "comment": "Malware payload", "value": "d2e1116944b1234514d6bafefc02c3d095ee04b113633ac2fca74a24d27f012b", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995066, "uuid": "95f3218f-4287-491c-9b19-6e4fd891b85e", "comment": "Malware payload", "value": "a93700805f00dcbc34c41eefb36be3b2caec64ce", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995066, "uuid": "1b4ca41a-1c55-4a90-8fc4-f4f50bd37d37", "comment": "Malware payload", "value": "1059a2e3027fcb154333a92e7efcad15b30c9fb8c54310370cbd5b5f92486d80face4c1c0d6304e92cdcd94288201912", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995066, "uuid": "d16050f9-08ac-4ba5-ad4a-8a33eb0a3e76", "value": "T1A252E9A7CEA7BE2107D8450758CC28C35E3C934E31A2149C118FEB85F2E8D6E59E80DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995066, "uuid": "efc76413-d3c2-4374-879f-ece7febff392", "value": "192:9C/V25n8JOKLsKQ0BgJc8W6amsIVX6NG6LZjZVr+mn+vk0aIHJd+PgGHBKBhHsA+:9C/yKEv0BscRNmgLZQlP+Irhnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761995066, "uuid": "41cc6692-e060-4fcc-9cb6-5c0c032b871c", "value": 13797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761995066, "uuid": "3ce3726d-bdce-4161-87bf-8b17da3c1223", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995066, "uuid": "766339f3-bafa-4b9a-9b70-4a7a2f76b44b", "value": "d2e1116944b1234514d6bafefc02c3d095ee04b113633ac2fca74a24d27f012b.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c43d5-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974431, "uuid": "f8a3d557-b253-43ca-80a9-efa6adb55e0e", "comment": "Malware payload (Mirai)", "value": "74a8b59e4ac75c479491f19e54167aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974431, "uuid": "fa5172a3-0cbe-41b5-830d-83a20da2a4b6", "comment": "Malware payload (Mirai)", "value": "d34909d0b89c88986d3b0fbacf05b74ba8b4dc84dcd91ef3a7261d50865ebcaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974431, "uuid": "2a42da9e-5786-4756-8a41-53e05e6800d2", "comment": "Malware payload (Mirai)", "value": "04c82385860bc90bb6704fa027a61740f773741f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974431, "uuid": "784fa376-72d3-4dd8-b108-0f2c276925fc", "comment": "Malware payload (Mirai)", "value": "a0f83b608e42d170cb1b8843f305a0598ec7ec47ef97b97820abe88a1db869f5fb44dbfa6228b8cbf6b71de6dc017824", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974431, "uuid": "e26f2eec-5f4a-40c7-8309-1d3cf5a8ac00", "value": "T17704392F258181F0FA411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974431, "uuid": "9114f3f1-9a70-4bc6-bc2d-eace931663cf", "value": "3072:CkuyjRAgJoj+f0LucJQ2M1GByaHs6qgO8NPAM+NNuqCvH5505UXT:CkI1zdy71GanuXWNOvH52aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974431, "uuid": "dd4124e8-8074-43bd-a883-e4c80c87fae0", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974431, "uuid": "63ac07a1-06af-4318-b2c3-9e9589074946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974431, "uuid": "dc594a59-1b9a-416f-8d76-981c04f3c98b", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91d020e-b6fe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761986666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986666, "uuid": "cf9cbad3-d136-4b79-945a-b86df0184082", "comment": "Malware payload", "value": "4e2d878a6eab92a92fb2a2e0f5470c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986666, "uuid": "da27ab38-8d7c-49c3-9682-343b8c6df350", "comment": "Malware payload", "value": "d37c085dfba6f6c59075d1ba15d196766b932b6a174551c880911e2f04c42905", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986666, "uuid": "97a6118c-8522-43ba-87f6-cf03e7a8d5b9", "comment": "Malware payload", "value": "e8c6c73fa311de44a21f8521979fca13d7c6700c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986666, "uuid": "f6de5e1f-db30-4dc4-aa1a-341dc7f2cb53", "comment": "Malware payload", "value": "3a37bad4d0a6924d8132a9a1446473f9f5c65d350a3918ff164907a97902ac2df57d7b67e7dd2c842b48aa0bd0b85788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986666, "uuid": "be8ae944-32ad-47d6-adc0-5b8dfe17974f", "value": "T103246385BFA13FFFD81ECD330295DA06129C890A5294BFB72A34D518B69B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986666, "uuid": "ccad15d0-48d4-4dfa-b98a-9742198fcf8b", "value": "1536:YT/nXWXwajTrgXUJmmIOFycuwhHHZm11Cj6N/tbDr/ZNRiQUvlih+RaqdsElEct4:YT/nGXfjQkM1cj6NzH4Eh+RaJnxlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986666, "uuid": "7f7358c8-5d8b-4609-99c0-6c16401c3ab4", "value": 220804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986666, "uuid": "29a7ba11-c85a-4722-b896-74b37c377f9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986666, "uuid": "7eb9b41c-dda1-4c20-8f99-13ae30f75adc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf556963-b71b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761999051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999051, "uuid": "1df15f01-d414-4f99-9aa1-3ff2b033bfb7", "comment": "Malware payload (Mirai)", "value": "35f06a16e1c0b924eaa463556143708c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999051, "uuid": "58d6bbdc-99a0-4db6-a1bf-21bc18fd1ab6", "comment": "Malware payload (Mirai)", "value": "d69b3462429aca8b2eb85198314041fa53d2bbdbe1101c5dea72d3edff134356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999051, "uuid": "3d9bffdc-796f-4b18-a55d-9667b70bef38", "comment": "Malware payload (Mirai)", "value": "98c5e1904e6d5f68ce530d6d7a6c74fe0b737895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761999051, "uuid": "f89b5c71-412b-494b-a585-07f293b9541a", "comment": "Malware payload (Mirai)", "value": "04a36a18de44a2a9333ae13cb8b7962385e12fad1da46df71c71fe7ce5a89884f30777c5a6dc1fd93191db7791decc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999051, "uuid": "9ae6bfae-7ad6-4f79-bf39-128623ace87b", "value": "T1E183D816BF600FFBDC6FDC3749E9171529CD550A22A97B3A7934C82CBA4B20B15D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999051, "uuid": "f65af33f-3194-4134-b256-261f3af56409", "value": "1536:dw9b5cPjJvxD4TNnMnjuBtE01/75ydknOWSt:d65cLJvxcyetjc+Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761999051, "uuid": "0c5a950e-186d-4ef6-9d4e-1ba17690f354", "value": 88528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761999051, "uuid": "75c079df-7c2f-4f3f-84c4-303dc39123b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761999051, "uuid": "7f3e9aa7-0d15-477a-bf5a-4eb64499d2e1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c903009a-b75b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762026529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026529, "uuid": "7c4b3fa7-12f2-4d91-a064-4e5901796f01", "comment": "Malware payload (SalatStealer)", "value": "f0d32147b524d83dc765e9d15260e682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026529, "uuid": "1140016f-735a-462c-8254-ddd7263234da", "comment": "Malware payload (SalatStealer)", "value": "d6cef44bcb3feb8477b33fe9185d058fd57b767dd1470d3bfa63f86fa53d491c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026529, "uuid": "33725962-5d01-4aa5-b06b-fb371705b3db", "comment": "Malware payload (SalatStealer)", "value": "ce3a65aec617323f69210f81ab86fdaff45df5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026529, "uuid": "dd3019d8-227b-4e2c-b421-3d1ccee03ddb", "comment": "Malware payload (SalatStealer)", "value": "5a0e171c36b0267e927297251bbca6c0557015cae7feef3b03baa703fd7e050014cf91f6100db1258ccd08011cd64d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026529, "uuid": "b3ffe50f-c55f-4ee5-8e22-abcb70ec8649", "value": "T10BC63911FACF54F5E9035931416BB33F23305D058B28CBABEB587B6AF877695183A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026529, "uuid": "67335872-e12f-4cd0-bd9a-33fc2b7aa173", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026529, "uuid": "e4663653-2e03-4065-b673-ad0dab997278", "value": "98304:StIpogR6Xgcv1XispV70tzkBHFBo2wEyQbz6G:YgRMis7WzUHF+CyQbz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762026529, "uuid": "6c238a48-9325-4556-847a-36099387e250", "value": 12469760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762026529, "uuid": "a1ea3bd6-d547-4cd7-81e1-94a3af2c08a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026529, "uuid": "41460183-1f7f-4952-bcef-0fcf156ef697", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eae609-b741-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762015360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762015360, "uuid": "6a9304ff-dd2d-4c9a-ad56-21c5c26070c4", "comment": "Malware payload (Mirai)", "value": "fc8333d1cbf845cf80087b5de5416b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762015360, "uuid": "c4175423-d529-448b-a11f-a0a7ce4e2eb3", "comment": "Malware payload (Mirai)", "value": "d7d8eae04a0af673b1959396ed486dcf46941afec0be3a955f530d2777c82f16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762015360, "uuid": "153298d2-09c1-4a5c-ad29-2d75e8d4ef0b", "comment": "Malware payload (Mirai)", "value": "c1fdc80ea5c225e611360e51b69231306d6beacc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762015360, "uuid": "b41dda52-347e-40ad-9a04-d4697319b01c", "comment": "Malware payload (Mirai)", "value": "91ba940774e4985ac128e7ce0d9a450ce383094e03aeed481d61f7fc2b18e2285c2c17f29a3a5a4f9940bf94508a8081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762015360, "uuid": "a0447550-3223-4494-b94a-d89b6f47ed64", "value": "T148534B21A9B92D17C4C4A83A21F34378B1B2174E71E8C72E7D721E8EFF14554261BAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762015360, "uuid": "692627b3-8640-42a3-a3f8-9c1372f733cf", "value": "1536:XZ4Si4UuTmRxaztAZe/40QHqEKEtNa0LFlei7uhR:JdlW6YWf8nBleiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762015360, "uuid": "0cb7dc5a-682a-47f2-a456-b4432a2cc44f", "value": 66424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762015360, "uuid": "896aa0ef-6f7f-4a50-a679-49680b6f7894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762015360, "uuid": "fb286e09-6db0-4a58-ad78-3cdfb4bc165b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24a7f4e-b6fb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761985366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985366, "uuid": "95b7a8bd-8529-4f3b-95a7-b7ebb4488e6e", "comment": "Malware payload", "value": "968fb8024ce201206d4f9c44c8492e0c", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985366, "uuid": "998cf7bc-fde7-4cf0-8d46-c4f80aff3cef", "comment": "Malware payload", "value": "d7e18cc84d0a980bae30ae4c5c849b7723d3a0ad115c6863bbc354ad00cb6941", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985366, "uuid": "9653acac-b676-40ed-8eb8-ef8c35375e48", "comment": "Malware payload", "value": "d8c3e2060baa80fd2b7441f8736307c398df487e", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985366, "uuid": "b1997071-8434-42d1-b056-89892b011c23", "comment": "Malware payload", "value": "a3076c6729d0f774bfbf17d3f37403b432d78d36ea848fba72a98f6b049b39199aa531f95c761a35f1a8e85377ece659", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985366, "uuid": "fb6956d8-d4d1-4cc7-b365-1930006e02e7", "value": "T184462304AC4BEE85C25AA1B511E30F23B6779AE982575302CF3AD4BD3DE1308FAD6D15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985366, "uuid": "1f6c71c2-276e-46ce-8074-66b5a38f99c5", "value": "98304:Zr2iCZeQwvKbhpz+lk1d5EWaa+lU2iKsrnHJDs3DlIhlLp5:ZBvKbrz+lkFEWr+2dS3DlI/p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761985366, "uuid": "c24e994e-2c54-4464-a850-fb23d24b27d9", "value": 5408086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761985366, "uuid": "0d0e2d09-2b2c-4cac-9c4e-18d3254a4fd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985366, "uuid": "c2866e91-04b7-4056-b92f-f3a282c4665d", "value": "contool.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840594c7-b729-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762004938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762004938, "uuid": "6f5b5967-cd53-4a07-8c7b-4eb34ea0e305", "comment": "Malware payload", "value": "4d0459307e2fa560e12d76270dd561bb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762004938, "uuid": "3548b7be-ed74-43cf-aa5c-551a952a12d5", "comment": "Malware payload", "value": "d8e50b489b345f7b96e50e157411407f5e3d414203524f1064db38b27ee747ba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762004938, "uuid": "bd646a44-a8d2-45ad-bfde-9bf15312d4cf", "comment": "Malware payload", "value": "8d0b39f84f45c1330aae02205097ca24d0fa827c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762004938, "uuid": "1a7e1d9d-c96b-4755-97e3-eea1360d4cb8", "comment": "Malware payload", "value": "f8aead66891fda8999c2e68df2b0d958d628c1605f865d538e1551da6ca11c3f36a55050ddab831df867e3cf63dadb72", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762004938, "uuid": "5b6cf916-f892-4ec9-871f-39e84fa7fe27", "value": "T19356F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762004938, "uuid": "4db6802f-808d-4af8-adec-a76fe8fd4ad9", "value": "98304:XWPhUoTwrYBKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltb:mdKOfyaIbaciAFvrEZpXqmY9XrF/mpC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762004938, "uuid": "8b74573e-68ef-4dbb-b18a-84fd3a9db72d", "value": 5900099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762004938, "uuid": "6aafd2f6-41b9-4ec5-9b9d-c69572cecb29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762004938, "uuid": "b5d1f991-1a90-45d0-8ab8-96bd126bc28d", "value": "Fullbet138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9648d714-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989077, "uuid": "e253fc7a-a293-4863-9322-767cf330e694", "comment": "Malware payload (Mirai)", "value": "b29b8aaa36c831d3f6d1635431dc51b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989077, "uuid": "59793a89-e98c-4b0b-b7a2-43793944d2e0", "comment": "Malware payload (Mirai)", "value": "d978e3e9cba6a612d0b32c45df20c47ed98b2b14b27d9fb3f177d3507f48e0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989077, "uuid": "98e4f729-c265-4c9e-b216-17153adf6aca", "comment": "Malware payload (Mirai)", "value": "071d449a9964690f013917ff6804f57773f4af1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989077, "uuid": "94ea8a61-c9d6-40dd-ad07-a7766bee17c6", "comment": "Malware payload (Mirai)", "value": "0cedebd3356c02c2f5d808a1d25eeb3b5f7208b17977e3ab01ff6f4adea1cac720d4f28e2a478df5414a83a10ac709d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989077, "uuid": "7f211e6b-c61e-464e-8dd9-6dff120d7b7b", "value": "T18673C70A3E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989077, "uuid": "69f1adbb-ac24-4924-b38d-2daf78d482a4", "value": "1536:bpxe5qoct9fvgQBI6r7EnUFndlBotYG9CJa10JDv:Fx3oANvHrndvomgC4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989077, "uuid": "d65371a6-7523-4d99-9f92-548040850770", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989077, "uuid": "0c98bf0a-6302-4cb7-be45-b8ae60ab21f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989077, "uuid": "06859c86-d5fc-4353-906e-5809671c5d3b", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d9da3e-b6ea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761978019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978019, "uuid": "dddcb7c6-c3d7-408c-b5cd-bbe5016a919e", "comment": "Malware payload", "value": "1123ecb4ade30033578283e4ce3e09ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978019, "uuid": "a3aefaf4-1f05-4d84-a00b-d8d14f126296", "comment": "Malware payload", "value": "db02f4ca0e9b47802a7953405f2810aa3950d02e40cd417ffcdd2e5031ffb7d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978019, "uuid": "cd4a0fb6-d58d-4d3f-9c04-9a89a0110371", "comment": "Malware payload", "value": "5cb06d9407b39a6d1a58a11b12354d0206915577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761978019, "uuid": "491c6443-4337-404a-8237-bdb6ccc1c172", "comment": "Malware payload", "value": "07cae9f7589c6ccb57472d0630ac355d669ca8b65d06a4838a18f77dd55bb5c195c92e2663e432c0d6c1fe874edb4f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978019, "uuid": "5d019378-173c-472b-a6aa-2cf181b3c619", "value": "T1B534728ABFA13FFFD81ECC3342958A09129D490A52D8BF762A34D508B65B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978019, "uuid": "39cbc521-54a3-4f47-8dd3-881f74639f8e", "value": "3072:AcPW75oo7yUN+4coAMuKeWT9FzyRnzzRw:lToAMuPWT94z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761978019, "uuid": "bd9abf62-0eb2-4654-bd00-58bafff15e81", "value": 231084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761978019, "uuid": "fa8cd5e7-ae9d-4b01-973c-ac6a8737d921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761978019, "uuid": "e519a812-858d-4abf-b72e-4f1b8300d341", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1673a79-b75b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762026489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026489, "uuid": "04cfbda6-13ca-4c08-9bb5-815474e3c677", "comment": "Malware payload (SalatStealer)", "value": "58d9f68bcefb1cb3bf5006c3f51a7a6a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026489, "uuid": "4a5b397b-8940-49b3-ba8a-3c171c4c62d3", "comment": "Malware payload (SalatStealer)", "value": "dbda930a13d5d2222662c498ecf4419f70fddaabe111eff065d076731ea3212d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026489, "uuid": "1918f6bb-2fa3-4b6e-ad96-ab9194431b28", "comment": "Malware payload (SalatStealer)", "value": "2f274d65afeb68cda5edb12f73cf02eab5e2fd1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762026489, "uuid": "dddd7507-4f63-44f7-871d-eed932e30cc9", "comment": "Malware payload (SalatStealer)", "value": "7423a30e1b0543e30ca65e3105e1325310a135135b0cd4c3dd2b01aae0db85d2ff5bd549f3f337368a0f1928a5964d56", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026489, "uuid": "ff3c7223-b8a9-4ca3-811c-dde993ee9caa", "value": "T1A8F5335DC6D06872F48632723A384045274E3891EE6E97C19362D902AFDB3DF9FA4C9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026489, "uuid": "a4f8b323-f6dd-4f5e-839e-a6f1c2580289", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026489, "uuid": "98a03571-d5f4-4ee3-8e9a-4227ad51beb3", "value": "98304:pKXUEr7Jqyq+GId+waHKbSBBG0wSJ8cevIGZ8c4Xa2fgzH:R9+MpHK+BBG0VJ8cevIU8c9XH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762026489, "uuid": "48288fc3-622a-4a89-9611-29d3fb81d6d4", "value": 3558400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762026489, "uuid": "9bc9065a-7d51-4a55-ad3d-ddb8b5ad679c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762026489, "uuid": "5f9cbaa7-ae9d-4211-8641-909c7396afad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca39fb7-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969438, "uuid": "b39e6e32-5cd5-4503-ab18-9c235136cef7", "comment": "Malware payload (Mirai)", "value": "365b76ea07514039336dfe60692c3050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969438, "uuid": "35789941-6996-45e7-ac0c-7b5cb8e2da2f", "comment": "Malware payload (Mirai)", "value": "dc99f12631ff2b28cab82074bc87d7e7106921c93ca03403a4975b210697978e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969438, "uuid": "9c8e0192-8326-4956-90f4-999daee2bf43", "comment": "Malware payload (Mirai)", "value": "25d4e40956621591f8715fbb43d3ab9ff0e86af1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969438, "uuid": "0ca2beda-42f0-4ab1-b2fb-9d493d45dc8a", "comment": "Malware payload (Mirai)", "value": "b6c0118d81997d97b28fbefa564437628e4c4346d4cc00f23e418caabf9e39b807634ed9f6f390392930ae8f28139920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969438, "uuid": "075df727-3b7a-4209-b8cc-31a7642a5cf4", "value": "T11FF31A42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969438, "uuid": "83577c23-0773-4ea0-acaf-93d7a006b3da", "value": "3072:XkGROPfU3yLPrW40QdIA2XSaRuwXOcJvBCRlYOP6hh1zU5:X3RgfU3yLPrWlesXSaIwX6RlYO+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969438, "uuid": "4738d8ad-a485-4462-ae4c-f959cbad379b", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969438, "uuid": "06999101-1c24-4945-a372-db8c90ca020e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969438, "uuid": "f5db450d-bd6c-42c3-a1c9-e44f24efd034", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafe2a2e-b773-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762036867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036867, "uuid": "0d04413c-2562-4e10-9683-a16ec696189d", "comment": "Malware payload (RustyStealer)", "value": "94209ca2e3846a82d39eec5f451ece1b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036867, "uuid": "c9972a8d-b2a1-42ee-8fb8-606a80762ff2", "comment": "Malware payload (RustyStealer)", "value": "dd0bb9c739d5e27fc13a02e1f036df8d07adb757f6e86421e38768a43b76b590", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036867, "uuid": "02f1e884-04fc-4266-9649-c94df078e2b7", "comment": "Malware payload (RustyStealer)", "value": "9bc0b51bcf180b79d095e428f041a929d66095d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762036867, "uuid": "972bbb40-6b6f-4063-8c8e-95243308e42d", "comment": "Malware payload (RustyStealer)", "value": "4d0416ef92dd467315267550c0704be627f0d9275821299b9208361f95bb67dc6c06b437a04fd181c2496ca76a3c314f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036867, "uuid": "7ca8dd6c-0ad8-4c89-8557-f856d1207e3c", "value": "T14766333E973F0D15D7ABC2770CF771068305CBAC63920A49567AA88F652333B4A6F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036867, "uuid": "414bda7a-7a59-44bb-ba81-50b1a7bd4b3d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036867, "uuid": "23f177cc-0693-4d06-962b-0d4956e69d5e", "value": "196608:aANlaCUoV+F/MzPeYbr0FnyfYKI4YnF1Y:aANA3OWMzPeQronyHtMF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762036867, "uuid": "8b92eac2-f1e2-433f-acf8-c9ae5bbb6df9", "value": 6832128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762036867, "uuid": "72bbaa95-4379-45b0-a9f0-8dab5d65c889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762036867, "uuid": "3a264138-0f6e-4261-b92f-f8bd7827dc1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db6d20-b72e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762007008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762007008, "uuid": "c97c3fbb-2438-469f-9536-67e7da2b9f6d", "comment": "Malware payload (Stealc)", "value": "f4c0b0d292e10c654c46d5d984062554", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762007008, "uuid": "eb79f377-9718-4591-9edf-0dc254bf8958", "comment": "Malware payload (Stealc)", "value": "dd8d9485a41abb830e173996a4b31b2b1febbff3bbd9b955f779a20530392736", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762007008, "uuid": "32187873-7c2e-45de-8f80-145fc0b98800", "comment": "Malware payload (Stealc)", "value": "27b1882a1e65b09ce18d3734750624d47eaa57a2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762007008, "uuid": "59ff0bd3-6a73-4e46-bd01-fec2536af10f", "comment": "Malware payload (Stealc)", "value": "d27c3e0616de4526508b9da6de818ccb8636826237404b4807be21ec8366cf3b0b5f01fb0cbcf399be9f0d3fc96a32bb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762007008, "uuid": "e3e004c2-bb70-431b-a262-80cc0aa5e4d3", "value": "T108F53328A3919D58DBC936BA1F1AC63003B0EC5C6C94876C71F73F2739FC6676266066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762007008, "uuid": "1b94541f-191d-41ff-bcec-fd130b7a3275", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762007008, "uuid": "d08dc0c9-5ed6-432f-9bae-bc4b2f77129e", "value": "98304:o7zPXE/v8MgIFrKJc6XjEat2kmMCw/rv5p6:oHcLFicKjJ2k3Cw/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762007008, "uuid": "fc385748-0e25-4d95-a842-e6d3699ab52f", "value": 3358784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762007008, "uuid": "a94c81a2-f53e-4928-b15e-67d1a4b8cef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762007008, "uuid": "cccafe88-55ab-4c29-9e41-b53f0c7cf44b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424466a2-b705-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1761989366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989366, "uuid": "9e6c9299-8306-4c79-9ef6-8bf8efdbb2a3", "comment": "Malware payload (CastleRAT)", "value": "c1e6ddd68a560b08ff38ec3dcfe213a3", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989366, "uuid": "fa4f0ad4-482a-464e-b2bb-731f4fcb58ec", "comment": "Malware payload (CastleRAT)", "value": "de1ea932faf2c91ca4952f29652de6adafc8d4fd6659c29e0e0476a4ae94962d", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989366, "uuid": "46a16bf0-e80c-477c-9ffb-79b6fd979b93", "comment": "Malware payload (CastleRAT)", "value": "3d7394c7056c6b3463129826eeb45ced45cc6022", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989366, "uuid": "d0dc2386-f1f0-403e-b5a1-4af22d044ed8", "comment": "Malware payload (CastleRAT)", "value": "fa70d843276c99d434d78eceb1893ebc77fe6e8500f2c6f5459c2a3eb541b6d173df40490f9a2d3cb117b366f7538080", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989366, "uuid": "1da2d543-f378-4306-a758-d6beefff3d4f", "value": "T18D342A06F7A628E8E8B7C13989A3662BF6727C150730DBDF475046165F23AE0AD3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989366, "uuid": "2631df5f-6d68-4b31-a636-8672102f951f", "value": "a2d5e1dde0ab5a13b06a2da7ed77624d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989366, "uuid": "1f02ab7f-a021-4bb5-b2e2-84dd63bc0f4b", "value": "3072:d1cdrRv4vY2Eit+lwNbi5RBku2NKc8mHME8nXJrRXulkne2p2yJJSTMBFff:d1urR+w5np2NlriJRXuQfI6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989366, "uuid": "d5ffe8e7-dd81-4cfa-83e0-e0f4fc9fb90a", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989366, "uuid": "0b141b18-5ddb-419d-86f8-5d4b87da2956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989366, "uuid": "04fac663-7684-432f-a595-bfe363193b84", "value": "de1ea932faf2c91ca4952f29652de6adafc8d4fd6659c29e0e0476a4ae94962d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7e6c53-b705-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761989359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989359, "uuid": "9ff0c318-79b2-44f4-b16b-4ba3a9842dc1", "comment": "Malware payload (Formbook)", "value": "229c2c1d3af893f9ec364e3a9636dc52", "object_relation": "md5", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989359, "uuid": "70fe546c-8e5a-467c-8866-c2d5300a3839", "comment": "Malware payload (Formbook)", "value": "de22e9a023d5dc7c68729bf7b3000de8d4bcdfbf62940c2f9c85c8f0a40512cd", "object_relation": "sha256", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989359, "uuid": "3d84e27f-af70-46d4-acbb-4bdee71f27f1", "comment": "Malware payload (Formbook)", "value": "746760f6bbcc8b64b41b780b563660a7054e526e", "object_relation": "sha1", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989359, "uuid": "15950698-6c04-4893-9c9d-a7fab5066662", "comment": "Malware payload (Formbook)", "value": "dd0bb3ddc8caed0f057fc5757e2ae78fb2aa2c6fbd017b839b08d0b6ae7ec252b6d92c70b74375cbac6cfa1ac99b4a18", "object_relation": "sha3-384", "Tag": [ { "name": "104-225-129-171", "colour": "#002E84", "exportable": true, "hide_tag": false }, { "name": "144-208-126-50", "colour": "#95FA93", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989359, "uuid": "a4c3f5b9-4b62-40ef-91f1-e2e32065f9ca", "value": "T1612633F10466EAA6478305B90478A4DCF2930595ADC0C9857DF44A272CF8AF7D8B3DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989359, "uuid": "2a1ba79a-d8a1-4244-8237-a1203f4321fa", "value": "98304:yg6/QUjMWbJdEuAlojJxxVSfxiGO1lhdqw4QbZBr59nqruX3EfB8m2ss:06WbRA4x/PzhZhBHqmUOm2ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989359, "uuid": "42bc4b76-f5e8-4bd5-a841-e76c89f56cf0", "value": 4535845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989359, "uuid": "750ab598-85bc-4eeb-bb09-a42ab2962279", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989359, "uuid": "37b59d26-27e7-438c-81ef-a757840bfc4f", "value": "de22e9a023d5dc7c68729bf7b3000de8d4bcdfbf62940c2f9c85c8f0a40512cd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e2f067-b74d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762020260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020260, "uuid": "5cb606e6-46b3-48ce-8c8c-f145e95f2ab0", "comment": "Malware payload", "value": "7b7f2a8e9fc6d224837c6c108a41af1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020260, "uuid": "f14c44ea-26d3-4618-bd0c-f1a6d2a85385", "comment": "Malware payload", "value": "df0b5a447b32eef5d8339a0103dfb8971c0690dc00ebedd20b217173720db8c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020260, "uuid": "33b8d41c-32dd-403c-9c2b-6264613ae198", "comment": "Malware payload", "value": "5bd353b707678d3704f364887c440bb14c100147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762020260, "uuid": "cd7cd652-c546-4362-987b-ec6d757236f5", "comment": "Malware payload", "value": "54d0b8be580f068f5b013d1ef2c2daa3cd729f4155d1d9f24371dc5c1a3615d7864b65cd183c9300833de9c67cacc757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020260, "uuid": "05e3a25d-90f1-43b8-9ab5-6b8a640646cb", "value": "T1F4530982B8919913C5D4A2BAFA5F41CC332513F8D2DF3217DD216F557B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020260, "uuid": "5a7819e0-b14f-4d01-9a46-94cfe3e1fa74", "value": "1536:jRTISEwjiJJMCv38yNraOrjMlqKJ4uybVR:jRTISCJ8eaq4ZJ4uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762020260, "uuid": "e5a3fb26-8428-4ba0-ba95-86bb9f6ec2fe", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762020260, "uuid": "457c5d96-3348-41d3-be08-423eebabb023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762020260, "uuid": "b09469bc-9c0a-4a97-a510-cdd66573065e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264f7cd7-b719-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761997909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997909, "uuid": "2120e041-adbe-4f57-acdd-689ba7d4d0c3", "comment": "Malware payload (Mirai)", "value": "920c6254d5570206a7aa23f14068896b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997909, "uuid": "758bc215-bd47-4807-b90e-f47c221d81eb", "comment": "Malware payload (Mirai)", "value": "df55f393fb3f9ff46a160e942c8b7960d9317f032f35e054628bcddca08486a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997909, "uuid": "63dded6b-c25b-4dc7-8103-103d76b49d43", "comment": "Malware payload (Mirai)", "value": "37ef34c7103dc869f6cb56dabbb15a38424bb61f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997909, "uuid": "05133e21-1da3-4f35-b508-80117a1809ec", "comment": "Malware payload (Mirai)", "value": "f240a7f3e87f46f52ecf867f60951da37ceaf3bef09f3e0677bf170ebc12f8c525b90082d943ec331d7ca4b4c545287f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997909, "uuid": "e2f77caa-fb52-4625-872e-656dacb5cfdf", "value": "T1E6435B02721C4957C5E74670283F17E093AFAA9021F4B7CA684FAB4E8675E73408BF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997909, "uuid": "5736bf3a-4898-4abd-9187-d8454c75e5b9", "value": "768:DQz9VlnVyRfkQ6CS7FBeLNc3T9o2ooUaFzyBjQuybVRc:chVVsbS7FI41ooBFeBkuybVRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997909, "uuid": "f1081767-1551-4f08-b83d-b40d958d6406", "value": 60504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997909, "uuid": "ea0eab55-edf8-4d12-9cd0-15dcf99e45f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997909, "uuid": "50a14d8f-9d7b-45c0-a067-c3986dd16250", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740b5494-b722-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1762001905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001905, "uuid": "96175f5c-fd7b-47d2-9fbe-d508049d41a8", "comment": "Malware payload (ConnectWise)", "value": "978bf650e2a1201ca42d411a0c20ede9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001905, "uuid": "772dce13-c214-4be9-a982-6d503e954cae", "comment": "Malware payload (ConnectWise)", "value": "e0af0be8429ca59caa591431d0cd4189f79a2a4e06850a96328206e660cb637c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001905, "uuid": "2fdf74a3-4932-4a55-8905-e74a9443de8f", "comment": "Malware payload (ConnectWise)", "value": "c7a9bababbb2e36b3a0284abf74a61de18c8388b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762001905, "uuid": "f115e34c-cb76-4fc4-b1b5-eb78dbea2262", "comment": "Malware payload (ConnectWise)", "value": "717148c0be22353ff012c1d87b65fd140e9a7fa6b274971926a7f61579d23f4829106dc190e9c3b568cd03f09abae6ee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001905, "uuid": "bd7f4d45-4002-4518-a05d-a86c323d6022", "value": "T19CA6233066F8D226F1BB0A31FD3991B14C7ABC64E922C15F0364391E1DB5E81AA72777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001905, "uuid": "5977147a-ea04-48f2-83e4-cd993022176a", "value": "98304:vqPUuYs+fvXPYGyOQGG3L3WsjOW9BMQnqPUuYs+fvXPYGyOQVqPUuYs+fvXPYGyR:vgnsvfw3WsH9BjgnsvfYgnsvffgnsvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762001905, "uuid": "65161201-fd22-4517-ad87-9e211a53660e", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762001905, "uuid": "2f83a69e-e5a7-4035-843f-57bb12d11465", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762001905, "uuid": "203bced4-ecd1-4132-8292-5d26ec41e05d", "value": "PDF-READER.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d34f47-b6ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761986711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986711, "uuid": "a9f1b7f6-b19a-434d-a208-9195697de04e", "comment": "Malware payload (ValleyRAT)", "value": "f40a815c1cd3d6355a9e72452e16a942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986711, "uuid": "38d59b3d-5241-4732-8b9c-f20e9e9ae786", "comment": "Malware payload (ValleyRAT)", "value": "e309360f3f14f64b25b4c95cba9451c58b3e934882121b7ca545cf3552629892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986711, "uuid": "95faeded-ce07-4ab8-ad83-0a13f16bde45", "comment": "Malware payload (ValleyRAT)", "value": "e76987c736753509b68264df3adecdaa37e549a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761986711, "uuid": "8b8f0376-ea18-4864-b509-a7c1fc8ad548", "comment": "Malware payload (ValleyRAT)", "value": "bf1340cf76603b0b7dd7ca822a1d38885d3b1a68f4d5e0c4195c69744ab76fbb057970daf9dfd15fb0f9b367aa781f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986711, "uuid": "7b13cf27-8654-4b0c-a504-abd3f1963ab6", "value": "T1DD542BEC20D8B621C4CC99765F5C7FEA01F049732DF30B989DA6FB534A94AE448E7909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986711, "uuid": "0b52187d-a92b-46d3-b690-d8fe22f0fcbe", "value": "71bc27ecfe22083f6c0d032311b8d4f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986711, "uuid": "1bc75725-7bae-4464-81b7-ff5ddfddae79", "value": "3072:d1ctdI7iLGONAfK+kkzmnFPgLx8sPIsMcamKYY1/5jfEka1WNq:ovDeL8FPgt8sPI5n2Yzrha1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761986711, "uuid": "c3766d9f-5ee1-41b1-b360-ca556a506f69", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761986711, "uuid": "27b3a5fb-6f7d-476d-ae04-c7842dc05f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761986711, "uuid": "4b980b8f-5c2f-44e8-be49-f3bca7f2eb61", "value": "F40A815C1CD3D6355A9E72452E16A942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10507a24-b6f0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761980263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980263, "uuid": "46252f71-9600-4979-a7bb-e22e284988ba", "comment": "Malware payload (Mirai)", "value": "ff0cc181f7c06082b126eac37d05cf71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980263, "uuid": "fe3a138c-5d52-4097-8c0d-1222363f8e3d", "comment": "Malware payload (Mirai)", "value": "e3b633f1ae817743979a39a88158aad061deb5a098feb25f06d92b634f84aa38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980263, "uuid": "53f22a9e-e898-4b4b-96c4-cf7f63df776c", "comment": "Malware payload (Mirai)", "value": "50412e5b8120e8beef781e176882b79e484e4469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761980263, "uuid": "3ea20808-5935-437a-8dc8-1e8994b90cc1", "comment": "Malware payload (Mirai)", "value": "11b0bc0444b49dd1ab517a96527e046fb57f4b379a2da3565aa7553eaa2692f24c1dc574661dabf81ea1dd93e47eeda2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980263, "uuid": "c47be3be-1d19-47ed-8dbe-a2e213ed1eed", "value": "T135D31845B881AF20D5C626BBFE4F118A33135BACE3EE7213DD145F2427CA95B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980263, "uuid": "5ad868d2-8c8b-437d-9142-bf78da782563", "value": "3072:pC+uzhnjjtRbHz6P6D5rV9vkHIrxTgdjrcJE0PVatzZBkIa1Pnzr9:E+uzNjjt5Hz6P6D5PvkHkxTgdjrc3PVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761980263, "uuid": "71811473-fdfe-4bd7-89de-38c79606be73", "value": 130604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761980263, "uuid": "a4d6e377-f6f9-4ef8-81c9-ed0f32682147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761980263, "uuid": "83887862-fd4a-491e-beec-d7c02a32e267", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a888b615-b6e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976223, "uuid": "0f06a944-1f2e-41f1-a2c0-6f64ca1216a2", "comment": "Malware payload (Mirai)", "value": "767bac67a01cf4ebfcd9c91bdb22f360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976223, "uuid": "d9368aa9-b3c3-4d5c-a3ea-5e89963e2e05", "comment": "Malware payload (Mirai)", "value": "e4167667d31db1e9e616d84ca71dcb488dfb4f71c3cce5896473027a452109ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976223, "uuid": "f47909bb-d1c5-43e2-9e9c-5380c120a360", "comment": "Malware payload (Mirai)", "value": "5bd0da31c4ba9e9513e7357accb70a87f351c8a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976223, "uuid": "37f47cda-5d75-49ce-9f4f-391a89054f73", "comment": "Malware payload (Mirai)", "value": "c36e77346414d1c3e7e68967afd5720b4d9532e80dc59998a269fa4210d14cdac8426378ef2ca4db5d1aa3b82baefc49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976223, "uuid": "f6d1d09a-66b9-4633-add8-5a1f5e80accc", "value": "T139148220FA0663F1CC721A38A7952E5A6E7B04559FEB16312D1F533CDE628509B31F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976223, "uuid": "13d82e5e-060e-48f3-b168-98b21307d122", "value": "3072:dYQkCaOg1wR24Y8DwnKlDMvTsKNjC1JG3+UK4:dDPRnlDeTsQjfrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976223, "uuid": "27be4d76-c7f1-4b58-a88e-af5cda7c387f", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976223, "uuid": "c1ca0dc2-5170-42ef-8879-f85a77199031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976223, "uuid": "4d7c39e1-ed78-40fa-8804-c9f21568db94", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a889f63e-b703-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761988678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988678, "uuid": "84f83802-d1dd-44da-bbb6-d12fb6296f38", "comment": "Malware payload", "value": "102dc30c0308f21a0eaa8da1ea96b0f1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988678, "uuid": "5f771d43-903e-485b-98b3-c5d7af55b768", "comment": "Malware payload", "value": "e45f169608b3ff3b8664324ee539305c7e3687814544507f135605a6a1d1113d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988678, "uuid": "1aafecf3-59d5-4bf4-8dda-dc3d363d847e", "comment": "Malware payload", "value": "177147ab9c97305d21f59ed71306e34950323fea", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761988678, "uuid": "487ee141-0c30-497c-85a4-6be5adc63264", "comment": "Malware payload", "value": "dd2ddd3ad837c61eeb03575d7c27be4a7cea2784f7a89e9e18c95f0dfaeac85804670602871c1059c9a8ce836c7727a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988678, "uuid": "1891f53d-0865-4c03-b084-07a9df5c03b0", "value": "T1E3463397836B1454E2DDB37F982A5D5FC13E19E3C2EA772A4A0CF12228C4D9D0961F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988678, "uuid": "1aa66b3e-a906-4c1e-bc4e-bfc94fd53a7b", "value": "98304:28cfGySRavjIProX1kmnrLzWDKC2uqJtxuvCuc3YLdP3fN4QWZaMYyqz+TI:+fGbI1Vv6DKi2yCuc34d/l4jZaMv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761988678, "uuid": "630ff819-875c-48cb-b047-aec3af8793c3", "value": 5351278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761988678, "uuid": "9bbb354f-8bd0-464e-b3c6-31f8449cc90e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761988678, "uuid": "67502dea-a22b-4a26-8fa7-4855075d253f", "value": "dropper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563c104c-b756-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762024189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762024189, "uuid": "1522709c-c17f-4984-b46b-1320b16fe776", "comment": "Malware payload (Gafgyt)", "value": "67b839ff183e9d52ee7111d3bbd8f663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762024189, "uuid": "154f6b74-f05b-42e2-be66-607d25e3d43d", "comment": "Malware payload (Gafgyt)", "value": "e5681077d39628a82df1c682d22f5f314ec2906d10151d4c0faf33a6e933e23c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762024189, "uuid": "1b4bf4f6-206e-45d0-b57e-52018ccfe04d", "comment": "Malware payload (Gafgyt)", "value": "f06710fe96407814302c19f051f564a003e1bc33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762024189, "uuid": "fcbc3a3c-d81e-43c5-b7f3-0caadda7c8cd", "comment": "Malware payload (Gafgyt)", "value": "be40d78c47a8d6fc98a48294864452d3544da35fbd32bde006d78b276aead35f81a5bef4c5e6815e4a9d500cb9943c83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762024189, "uuid": "1900f192-df44-4bf5-aeaa-4ff8e47ef7c9", "value": "T16BE3656E7A22ABBEE168873107F39F70D39515E227A19341E2ACCB185E7138D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762024189, "uuid": "d7f4122a-5a52-4e88-940d-01b9273c994f", "value": "1536:0n/SF/iP6OzAGS2rKZluV0Qx1ExNQJd5OpgSJDsBHEgBuuAzWgSHVV2z/2m6Cnbk:X4OKjnbSBsQupHVm2mbnbUHIfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762024189, "uuid": "c944eba0-c139-4725-aa8c-09de9aad5a31", "value": 153904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762024189, "uuid": "0fd22f8c-919e-42bf-a70d-96ec3667c027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762024189, "uuid": "8188259c-f18d-4580-9e30-ff69970fb5ba", "value": "mips.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979497b8-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989079, "uuid": "d5fe50e8-6548-40d7-83d2-21436b7dbdbe", "comment": "Malware payload (Mirai)", "value": "bec07f565afc9a290f6fc6c971b78bbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989079, "uuid": "2d013ac9-03bb-4f0f-8329-c79ca90cb00d", "comment": "Malware payload (Mirai)", "value": "e681526965ce6360df799a1eaf722dad49fe2bc5150c49e648fa31ad3412ea34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989079, "uuid": "b1d24b59-f784-48ba-ad92-3bead18094b6", "comment": "Malware payload (Mirai)", "value": "81f6a744e78057443af79e7d0c2b86b5896d33e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989079, "uuid": "8c80cfe1-1242-4e52-ba76-1405b20fb73f", "comment": "Malware payload (Mirai)", "value": "39f77a3419706a6fed39fc43743eaccfe8088f4aa5c03b4bf173623b73f9ddf5e33efb464056547d493e1ec7a8e9e6f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989079, "uuid": "3f24f2aa-54e2-49b9-b2fa-6b9986f066ee", "value": "T18A73F819BF610F77EC6BCC370AA92B0129CC954B22E57B767934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989079, "uuid": "86c697eb-f676-4fcf-a827-81ed34421b19", "value": "1536:7J5dbFB4C92nKDIua98M26ofWU+UZ9CYXzdJa10N:7J5dxB99uKD7IUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989079, "uuid": "e8c9aec4-7275-41b8-a6d8-3a708653d3c4", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989079, "uuid": "f28e6959-077e-4995-b984-df90646de662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989079, "uuid": "1ee569ff-d281-4b10-90c1-75f1a26bdc2b", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc28e77-b6e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973786, "uuid": "d9942ba2-cb87-40f2-894f-3a2b71025f6b", "comment": "Malware payload (Mirai)", "value": "f889f8e0e7aeae43bd05cd9592be0157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973786, "uuid": "d88acf06-7de6-4c92-b6d1-997855820e51", "comment": "Malware payload (Mirai)", "value": "e6ec6e45276d77d17cab2c880001939e6fbed71b86168f648a676ac6c3452f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973786, "uuid": "bf5857c4-5d58-43fe-9eac-1704fad69d91", "comment": "Malware payload (Mirai)", "value": "671c79a1c77f554f5842c3406407760d1dbe2d60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973786, "uuid": "a5f2e190-aa3f-4a4c-9d6c-135ffc450cb2", "comment": "Malware payload (Mirai)", "value": "378739bc84d1c7e8f4a3fc1f5e6227df5625fb62f72adb9f5813f79fbbc32e1cd8abd0950d64232ece74fffb3c051d27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973786, "uuid": "3238cc99-a187-47fc-9d47-dff56062ec3b", "value": "T116F31B45F8815F12D5D211BEFA1D028E37132BB8E3DE7212AD205F747B8A96B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973786, "uuid": "01daf11d-cfa8-4167-a3ef-28d63d0e7421", "value": "3072:O4m0XMS2dIJSDMXe/yqH+yRIUZ86+naLRJm121G:tm0XMS2dIJ/XfqHsUZ86+nae121G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973786, "uuid": "9a0a6291-d8be-45c3-b7e2-a5e787d9334b", "value": 163196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973786, "uuid": "95a17e1a-ee17-4a3f-a1a1-07b1cfd34508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973786, "uuid": "1c0374fe-5b3b-416f-80d8-0b93eed6ae54", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6ac0ab-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761995132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995132, "uuid": "1581972e-c8b3-447d-8f01-026a4f5a122e", "comment": "Malware payload", "value": "dbee8158db16a83df161faa77df938c2", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995132, "uuid": "11e257d3-08b6-42a7-9501-c7f04aba2bff", "comment": "Malware payload", "value": "e7558360f8330e70e5e92bb098b2debce41f17fdfa0a941e536db432c4d7d45b", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995132, "uuid": "830d6f10-10bc-4bcd-9991-4a4ddd387539", "comment": "Malware payload", "value": "9ffd959958ebbaad9049dd568e52bfcc14e3e8cb", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761995132, "uuid": "2bf6e769-7a94-44ce-b865-232b3e868855", "comment": "Malware payload", "value": "825fb2f20d927e8fb9a40d6ccb1dcefd4bbc23ab97e0029d3b089f5044f1bc965e57928c4d5d6d593ce0b489b968d61b", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995132, "uuid": "a2d7808e-bbb1-43b6-866d-43bb068198cd", "value": "T1F5763363D1BC6D0FD923BA785098E9D707A8A700B4D9253EB9CC12956ECB4C17F1B82D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995132, "uuid": "7b327aa5-e8d5-4ad7-82bc-5964b41c3c12", "value": "98304:LG3psuTztIBY6ZxsHAbQx91ryPDmmUh8xF//yeit9CMS3ykffm8KIKhFkvmdPugF:L2psozt0mOQ/1mdkiMS3q8G0OdPTHLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761995132, "uuid": "e44d3aeb-3ef5-4525-b474-dabf9ce4345c", "value": 7186364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761995132, "uuid": "f3083c1d-e3c8-4507-9688-df970ed4ada5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761995132, "uuid": "86612ac9-19bd-4399-97be-211828bd137b", "value": "e7558360f8330e70e5e92bb098b2debce41f17fdfa0a941e536db432c4d7d45b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2737fa73-b719-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761997910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997910, "uuid": "75c41d69-ad85-45ed-8836-a2d9437c4242", "comment": "Malware payload (Mirai)", "value": "f97d0f1aa5aed6d73642c37c9bd6c924", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997910, "uuid": "2ff4d056-239a-4811-9070-ecf54e83af20", "comment": "Malware payload (Mirai)", "value": "e83ebc8801697a0d7e8abf0b424087339c8c03c405d543b0f12e836167192e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997910, "uuid": "0464064b-9829-4eec-a39d-70cfbba937a3", "comment": "Malware payload (Mirai)", "value": "cfdb5175c306b99f97f1c19e98d3195dccb6095b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761997910, "uuid": "d66797f1-5215-4cba-b48b-c6346731dbcb", "comment": "Malware payload (Mirai)", "value": "487a646d1fc9fa3f1351add413ca575eca81d130a5842a0cd8cffbd1e1f5a1393fc2f793181ed2386e648d77d2963435", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997910, "uuid": "2e270aa0-968d-438f-b86a-a70d2d101061", "value": "T11083E64AF9819B11D5D922BAFE1E11CD331357A8E3EF7212DD105F247B8A92B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997910, "uuid": "3fdf64bf-ebef-4343-b4b2-50b076ab4d33", "value": "1536:BOnuBHsiqWGaIESjidqEqhnfOmcOjGdBpWxGOM0RqhllrIi0rMn8zYuybVR:3HXqVESjidqdtoOK3pWxGOM0mmrM8zY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761997910, "uuid": "4a580615-b854-4f32-846d-8fccd4a3a0f9", "value": 85320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761997910, "uuid": "f94f4968-5c0f-4455-93dd-09342a9bed2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761997910, "uuid": "53d4035e-fd88-4a60-9218-8ce0115fc7ac", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfac3ae8-b729-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762005092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005092, "uuid": "5d4b45ad-8d84-462f-afd6-e0518db19b80", "comment": "Malware payload", "value": "225228c5f5fb212a371161b9fbd68bb4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005092, "uuid": "24c63784-0d8a-4f08-adb6-d01124fa15b6", "comment": "Malware payload", "value": "e9a90d6f80b6bfadae40c0c044c696d06b5eeecc9d2274f44cb9d0e62b185ac5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005092, "uuid": "0c9ef2ae-7aed-4585-a255-ab87081e0e79", "comment": "Malware payload", "value": "43072b840bee22243dd37aa6f1a72bbafaf04dbb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762005092, "uuid": "8c90ae53-bd11-4bec-a20a-b8e2e859d9bf", "comment": "Malware payload", "value": "036d3f709b1ab94e82b2ec971ce84dfbc595300392ff7094d67e94c08ec9a0dd02d7b3ff8576a70ff115594ff88b163e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005092, "uuid": "d4a8ff09-1a56-46c6-8d1a-6e866112f04e", "value": "T1CD7601C5F3D8A92FC8775032C9BA12E251478C428A83DF476958760C6DBB6D84F5EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005092, "uuid": "b0f0eb96-d5f9-40e1-a4dd-39ce6d3f9b55", "value": "196608:V9xAYUa2mwyZV1U+xKnJ5v7mc9hCFdNay15qw5BrGoNi:V9xADbkC/Z9hTIwwvrbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762005092, "uuid": "8df257ae-ef96-468f-81e9-85455d5ee88f", "value": 7306806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762005092, "uuid": "54ea49c9-c8e6-48bf-b1a8-d75be95aa1b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762005092, "uuid": "e965b4cb-527e-4955-b1ac-baa878e54fa8", "value": "Trusted_Gali_Disawar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c038c09-b6ea-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761977759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977759, "uuid": "713e057f-1256-415b-8bfb-35e9efbbd176", "comment": "Malware payload (Mirai)", "value": "0bc14f2efa00090d6343647f4c61b752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977759, "uuid": "f9512f15-8e8b-41c0-a31b-31ed580fb42f", "comment": "Malware payload (Mirai)", "value": "eab6f10699baff8ef77def98c0408896a5c66fcd993f1b4892a6b914d4ad8c2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977759, "uuid": "67e4391b-c86a-485b-9292-a1a3c2196612", "comment": "Malware payload (Mirai)", "value": "736892883b5e4d2a687d441380b6122912d67f48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761977759, "uuid": "285775b3-59d4-4c01-9b48-d7d7159a5493", "comment": "Malware payload (Mirai)", "value": "d8b139d3a535ac943a910af8ab43fa74a02287665229d9e1a3c900a8dadd1c1476d482a95967f0300bb0e49190dbb95e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977759, "uuid": "3e11484b-0158-46de-bfc2-749794e4080d", "value": "T12B14961E6E228F7DF6A9873447B78E25975833D613E1D645D2ACC2106E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977759, "uuid": "8153d997-4251-4120-8379-fca5dae0ee46", "value": "3072:hhY3qjxgZGZ62dzs+u3Mp8d9tbWDv8Qmy9gl:h23ixgZGZ62rh8F0vZmy9gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761977759, "uuid": "e82218e1-38ec-4d6f-9df3-8ae1e1822022", "value": 198236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761977759, "uuid": "4aed85fb-5192-4e27-8e82-7bea1be1b96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761977759, "uuid": "2a33c044-1d36-4f78-a0f9-5f453a7fd7e0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e117a55a-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993068, "uuid": "a2605d83-133a-4935-b10e-4cad2983dfb2", "comment": "Malware payload (Mirai)", "value": "32328d2d74c27949426798c238019d89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993068, "uuid": "db500f88-552f-4232-bc2d-f6edc82b3987", "comment": "Malware payload (Mirai)", "value": "ebb482227e068b71b99f5ae6baf60b1b4ab426a736f15c1de00f82f54c264e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993068, "uuid": "bbc2f31f-03a4-4b47-bc73-859a527a29c7", "comment": "Malware payload (Mirai)", "value": "2623c846334c0c2e160c493293d9d8f3d60fa033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993068, "uuid": "821fa545-529c-4fe1-b523-ae5df7e4242a", "comment": "Malware payload (Mirai)", "value": "ab1841de1af56b2c52557b10ad7446adc5ba04f85bfcde0b6a979427bae6b35207cfd2bd41100b0951046f7c46d4142f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993068, "uuid": "e4eddfb6-2b85-4a5a-82ee-0879e36c98f1", "value": "T10D631891BD416A22C6E12376FB6E428E371153A8D2DF720BCD226F103BCA95B0E77751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993068, "uuid": "0fbe14c5-2e29-4dd5-928b-c217e90b83be", "value": "1536:8nPZ2V7r/CKCMCh57ccnrM4P65Idu9tdsYPc9MmOOikktG/BgvEiH:8nxO7LCRMC5ZP6/dlPceUYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993068, "uuid": "7351b8b9-55cf-4f14-9885-a7eaa28b61e6", "value": 69512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993068, "uuid": "4c2e2ab4-12ab-4a79-9634-027f10c13f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993068, "uuid": "ecd336f3-6479-4be4-9477-8fc381594f11", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb39c411-b719-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761998239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761998239, "uuid": "810cd5de-3785-4760-b461-62bfaa3398e7", "comment": "Malware payload", "value": "b702839e9d025525d015bdc36f794edb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761998239, "uuid": "76eecd1e-4ce4-42a0-ad21-91b3c3efea81", "comment": "Malware payload", "value": "ebdabdfc98824addcb4d5160fdb4efc9b18ffd7464cf4d40d08977b21d635f8d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761998239, "uuid": "6a0e22f0-28a5-4c37-8f4a-5df1973f8da4", "comment": "Malware payload", "value": "82fa1df1221b669d894ed3d3d0c072a34a820405", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761998239, "uuid": "4e9a57e0-ee77-40c3-8662-d919fd4bad68", "comment": "Malware payload", "value": "520ec162317f7d4df601e3a38f41af3586ab94c193f281161225d83facf343fcd891db674def3acdb5f33667beb7717b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761998239, "uuid": "9ad49a0c-6eaf-4460-a14b-754bd1228725", "value": "T1A5A5DF189AD46B27D23EC371C9E3889073B2999AFF47D3479984B96225423E097431FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761998239, "uuid": "07aa44af-2119-4ae2-8bd9-90f6b6fe06ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761998239, "uuid": "32643299-add4-42ab-bcf2-fccf893141b4", "value": "24576:zyLL1sdj0Qzjf5qZSOO9LV5EJzrDIrTuduQ1KL22m/EnYarSdeedOZ5AS97+TcI4:S89SSOeLVuJfDQyRKM/aD7+2EqAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761998239, "uuid": "0ddd25a6-a3e2-421e-bd69-62738904bd76", "value": 2118656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761998239, "uuid": "010cffd7-27f2-4ed1-a589-0b77bed2748d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761998239, "uuid": "86c67ffa-1973-4971-bb02-3327226e2d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c592dd-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990175, "uuid": "09f7ebe3-13c4-483a-b6cf-eab457027569", "comment": "Malware payload (Mirai)", "value": "24d2281e9622d3782e62bfe795b1ed32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990175, "uuid": "62739c50-e391-4910-b654-5abd3e912617", "comment": "Malware payload (Mirai)", "value": "ebe485f3ef32dee5382e0668fe7d4fb6b4d144ac050917e7c91979b607e8ec27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990175, "uuid": "a52a12e0-5506-431b-8d72-59b29c0e97e6", "comment": "Malware payload (Mirai)", "value": "2af257409220df7a6e23ce3d44902ff49cd38eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990175, "uuid": "ba2cef38-682d-4455-a88f-b5a83de10431", "comment": "Malware payload (Mirai)", "value": "4d0948662a2fee94697bd98bf331cb174a482a70be40f6f79baf178a1bb3fae4fbe301129e4d9096111855fa32989cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990175, "uuid": "31b63e89-dfbc-4393-aad3-e9cb71fa3004", "value": "T11B636B01B34C0D43C1675DB0363F2BD59BAFD9C122E0FA86665F9B869272E33154AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990175, "uuid": "c1a39746-c87b-45e8-a021-8eaa1e8b0a8d", "value": "1536:7Mza18gy8T+WQKgCVMQvVI+QcsSA+zxLw1F:7ua18gx+HiVIdcsCQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990175, "uuid": "335c7b78-4200-43e9-8b03-a3d1cf4f19da", "value": 68816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990175, "uuid": "9713a1af-762d-4b7c-8769-e74eaeb9c31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990175, "uuid": "f4c21c58-98e1-45e9-a8b4-9bc3d95ab548", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30390569-b6e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974733, "uuid": "c8046b3f-9fb7-40d3-88d1-78138a6c9858", "comment": "Malware payload (Mirai)", "value": "f2226e300a6959a429f55cfb9bf7e821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974733, "uuid": "d6a6f325-40c7-4fc4-b37e-4b645dfb6e5c", "comment": "Malware payload (Mirai)", "value": "ece155b6d46ecd3eb0e158f605375dee252db72566d49db6ee3d724f73124462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974733, "uuid": "88966a0c-74c9-425e-8bde-360df80b4746", "comment": "Malware payload (Mirai)", "value": "372fe689f0eec802cf9a97c16c7587dd91536e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974733, "uuid": "865c2432-16de-484f-bc13-39ec753fceca", "comment": "Malware payload (Mirai)", "value": "06aef01581167b796cf425a95ba490231242d235f65abf2a9454eea66366dd5fe066e01b0d5134a000afe5b696319e12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974733, "uuid": "1077b49f-5ca4-4fe0-9f58-d61f2bfe5c68", "value": "T12BA2D0119A619863D27448BDBA7645033B8746F5C673B0BA189803B1AA42AC036FF2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974733, "uuid": "6fcf5c95-fa87-4acc-a4ec-a70e4d436eef", "value": "384:QZZv1sBmTRKWeH9pge0R7fYPY2nI5BYq2cQ0iyS34EnsqTVlBDihymdGUop5h8M:QZLsBm9ZeH/mcznyBYrx/yS/sqTVPDiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974733, "uuid": "9e4005bb-30e6-4fd0-bc66-cc1dfcb37b71", "value": 21464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974733, "uuid": "816f48ca-8c1c-4fec-a699-a650da5beecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974733, "uuid": "0e3e4167-d069-494b-834e-6c3156da076d", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce08251-b6e4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761975318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975318, "uuid": "61aea75a-4a97-4837-9164-f719d04ea468", "comment": "Malware payload (Mirai)", "value": "b8807f18fd28df028f0138c94f1e94b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975318, "uuid": "3544dc9b-eb4a-4b6b-ac24-2c58efe139ca", "comment": "Malware payload (Mirai)", "value": "ed9580b6bcf2a493891e77da626f8ff5b9dc1cb35c6959f03fdaf2c2b50202da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975318, "uuid": "1ad66f4b-eb9f-49ed-ae61-9116f4ee8e54", "comment": "Malware payload (Mirai)", "value": "e20808b7dae0b21ab602b14d38cd32363da74390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761975318, "uuid": "2ae59481-dca8-4486-8f4c-bc0e6dc855b4", "comment": "Malware payload (Mirai)", "value": "31e6f59270f4e3125e182472de762303755821f1fce62d532003d59ce69fdfedde5c256b237d23a03296fea3b526961b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975318, "uuid": "88c8b6f9-46cb-4001-8860-3cea80d438ef", "value": "T1DE6302FD05F1F0AAE1CE18A859A5A80AFCDD50C684C2B646EE21F464A79D4F408AD34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975318, "uuid": "d3367959-b06f-412c-a4f6-5cef7b18ea87", "value": "1536:8/K3qNDr1+t9oiEVYA6bZPxJAnRJZgZMJlHrPMg:GK6NX14mi8ibWHZrPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761975318, "uuid": "e4334aae-70cd-48bb-aa7b-e5ca5c8c5d6d", "value": 71740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761975318, "uuid": "7bbe9db7-9403-4263-b2bf-bb302ef44aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761975318, "uuid": "77124011-eeb9-482f-a13b-4970736d993e", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e80fec-b712-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761994955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994955, "uuid": "74546f87-1f2e-4587-a9f3-f283daa43fd8", "comment": "Malware payload", "value": "e021404caab0f3e12eae9e49384282f6", "object_relation": "md5", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994955, "uuid": "70da00a8-b8ab-4140-803a-7510ef4b4111", "comment": "Malware payload", "value": "ef76071204328b5bde9a2b5f2ce49eaf388e981d189c9826fe2576f1c5333a90", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994955, "uuid": "52cfc294-5f21-4983-9279-6c72b785109c", "comment": "Malware payload", "value": "c476367455e4fcb8ce4ac79b37f6907fec9ce84c", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994955, "uuid": "f8b86bb6-3846-4adb-ad25-c7f5018bd7e1", "comment": "Malware payload", "value": "7ad2de151dcfb3c58262bd0f8a50abbb9f291945110452067b46b12c1f75d03080c43d401f7dab66e109d1f2d18e50ea", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994955, "uuid": "821939bc-43f1-4792-abf1-0897fcc503be", "value": "T1AB31B1C205C13F7ECC89CA217352647E5138B9C8AF2B9FD8D4DA18E9B740AD2B154D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994955, "uuid": "617bfa80-321c-4a85-a870-b2019a31cf34", "value": "24:L6EBvi1PmeBFBvK9hqt4TtqBvTm7Td31BvWPOTBQg7EByTvDp8dzrQtqBVSjRd9a:uoviPB7v8hDcvINLvAkk07pG46IzjPs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994955, "uuid": "af19f5d5-e521-4d48-a131-6eef19d87d01", "value": 1487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994955, "uuid": "d81f5fe7-0d85-46f9-89db-e9164169c9dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994955, "uuid": "0acbb305-dd36-4c98-b087-71f15ce65436", "value": "ef76071204328b5bde9a2b5f2ce49eaf388e981d189c9826fe2576f1c5333a90.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bdd210-b6e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761973878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973878, "uuid": "add7bdf5-db75-4f9d-8f70-a423e14be2d6", "comment": "Malware payload (Mirai)", "value": "ee796d503c3a22aaa7ffcfe25979de38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973878, "uuid": "95d33438-738d-4590-8b84-cc8f6d1f33bd", "comment": "Malware payload (Mirai)", "value": "eff6dbdd2b851a8d7eafac524fb734dad553fc57f15b2f89fd8d11b40a5f322b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973878, "uuid": "daa238c3-87d1-4944-85a2-5dccfe79441f", "comment": "Malware payload (Mirai)", "value": "651289304aba8f2c5497612e9ac94c220e4264a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761973878, "uuid": "707e6b64-cf73-4e7a-8408-43dbc18f750c", "comment": "Malware payload (Mirai)", "value": "fc29f02f9b80d669750210a27e25197c4001629adb16fb00563d79c5244f3232b148bab6a29eb57ef3f703cb8b14819c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973878, "uuid": "eeb3fec5-731a-4a23-9981-f570054ddaf6", "value": "T11E01924711358B209434F7057CC64D18D40AE38121C13F68F6CF3E794B89E1CB93AB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973878, "uuid": "2b0e7546-3b3b-4066-8811-cea19ca81c90", "value": "12:784HbM4HyM4HxM4HvM4HX78M4HXM4H7b+M4H7k+W:oSbMSyMSxMSvMSr8MSXMSv+MS4+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761973878, "uuid": "909350c5-2676-4cb3-9565-8ce860bd5bb6", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761973878, "uuid": "08ac2189-1e4e-428e-bfe2-663f3dd37171", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761973878, "uuid": "86e25046-d1e1-465c-8df8-f7215818a44f", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206dea91-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987162, "uuid": "b175aeaa-ff38-48f7-9ef5-4906a424fda2", "comment": "Malware payload (Mirai)", "value": "d126276bb162407a019e67d1b9741649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987162, "uuid": "f13fdb0a-1715-4880-ab35-d097d2038b98", "comment": "Malware payload (Mirai)", "value": "effc3090fd42977b4f6f5a1cd990c0dc20103ad4b219f28cf24af87290bca8ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987162, "uuid": "f197b63f-7d1a-4d21-97e5-bcd147051c96", "comment": "Malware payload (Mirai)", "value": "f9dcb222d9646183ae8e3010095706c68dc5d43f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987162, "uuid": "3f46689d-c6e9-4fff-b252-25927e304964", "comment": "Malware payload (Mirai)", "value": "e8cf9b65ad4b4eaf0718b2c4e2bdd4bd78b2ebd1ed3c6468f5fa8a803fc2d24633952762fcfbaf930a84dcf641154578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987162, "uuid": "baf2da54-e564-4da3-806d-825e0d28cbe2", "value": "T195D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987162, "uuid": "6837b9ba-839f-4000-8648-8da69c7178de", "value": "1536:UFKdzElm18uZJNb4AdFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTk:UFKp50yU8e947Lb71izSftBdRalKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987162, "uuid": "7201c9f4-687b-4c8f-92da-6dbb63666b5c", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987162, "uuid": "e80f8dcc-9ca4-4ed5-afb3-2030306e34a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987162, "uuid": "3c4457b5-e872-455a-8d6c-7859059440b6", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c11f2ca-b747-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762017702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762017702, "uuid": "d6003269-882e-4ccf-a66c-abf3fde26e26", "comment": "Malware payload (Mirai)", "value": "53cf4061d6ce62132aec426e01ced4fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762017702, "uuid": "98d3f5fe-5aea-4a9b-a644-b64aab678196", "comment": "Malware payload (Mirai)", "value": "f094dbfb09c537305457c83d9bcb568cff484fd30d9060c8d85941cb3f91827e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762017702, "uuid": "d48af6ab-f0ea-45b9-bc74-b780904eff8b", "comment": "Malware payload (Mirai)", "value": "cff5d47e2d346aaf9fcc64c23ce51673a86e4977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762017702, "uuid": "e2761a60-9054-4b42-8eb3-be31e77f924b", "comment": "Malware payload (Mirai)", "value": "aaa3619c373072b882327c45ec3a1c312917bc3462d55c102e7f77e10ed1fd3a95ee6a7a8b1763ccfed00f205cbd62e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762017702, "uuid": "aee157bf-4a19-467e-8735-3ada453fa836", "value": "T1FC337D7AC82EAD94D54822B4A8328B756B03D000D7563FF79E49C5A59047EECFA0D7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762017702, "uuid": "58cec09b-34d3-4d83-abe0-0c2e4a5aef51", "value": "1536:MKavwtmHNUUTtH7TaBGCiZ5QgkCXxuybVR:HQrNzTtmsDbQgk2uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762017702, "uuid": "75d78687-1461-4a38-92fc-21f7081c480a", "value": 54880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762017702, "uuid": "bba047db-a5c9-4dc3-a501-315118fd7af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762017702, "uuid": "f1437332-897b-4903-abea-4d5a3f3da320", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2e72a5-b6fc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761985406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985406, "uuid": "3fe51966-5942-42fa-ad3a-33c758afe3be", "comment": "Malware payload", "value": "ae400bd7cdf234397998f2feb5c8694b", "object_relation": "md5", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985406, "uuid": "5d5f76f1-f162-4450-8950-155695148cca", "comment": "Malware payload", "value": "f2895bcbeb97561042b76ad32c5ff36b4b0d4d6b595cc1d3eca897e557daec03", "object_relation": "sha256", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985406, "uuid": "3bb332d0-3f4f-48dc-88e7-4606000e4c1f", "comment": "Malware payload", "value": "d23af616c8332536670b1821a68e588eedc440d5", "object_relation": "sha1", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761985406, "uuid": "53a1c62c-40b0-4084-972f-c6fe79a84605", "comment": "Malware payload", "value": "a6550b670cda4f6e8d8c91d5e463d6b09769b695b5a6f309502fae48d666062bac7a81210e0a867f703bc9b4605585b6", "object_relation": "sha3-384", "Tag": [ { "name": "bilkaso-com", "colour": "#A1E40D", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "CastelRat", "colour": "#943F50", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "jeg238r7staf378s", "colour": "#5078FB", "exportable": true, "hide_tag": false }, { "name": "kakapupuneww-com", "colour": "#5983F3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985406, "uuid": "c3145d7e-0aa7-413c-a16d-0f0597cf7044", "value": "T10095AF78F4B47A65F488C27A82E02CB5C7EC7D30935E2FCA5A30615F6A9351D9F69830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985406, "uuid": "6d638fe3-b4a3-4710-9464-807691e7cb5b", "value": "24576:SkrTnaVqqpcVCUWFmWOJZVv0lBi4qUHwdvZE8fLK/pCvs2Gv:3reVqqpcYULrVclE4qU6RE8TRvFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761985406, "uuid": "d18de526-a673-423f-8ca4-c6c0e2db0b24", "value": 1974092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761985406, "uuid": "f89fbeb2-3e5d-491b-8f57-47dfd30f3bb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761985406, "uuid": "4772c179-ea4a-40c8-92b8-9eeced17da23", "value": "wmsgapi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80c57c9-b70d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761993080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993080, "uuid": "e2cc9878-3051-4ce0-a01d-bcc03f3196e6", "comment": "Malware payload (Mirai)", "value": "4aa67ef2a957efb30e47841daef519d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993080, "uuid": "b22fd0c7-bebc-4ac2-b4fb-267ef6d88c21", "comment": "Malware payload (Mirai)", "value": "f3727c32fed8331af3c02f781332053b9be39e32c6aa02202718ffba5aecd11a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993080, "uuid": "d1810ccc-3c50-4cf1-803d-2b34d3778c63", "comment": "Malware payload (Mirai)", "value": "31df3f88cfd94f05484ef75f2a9b580af2865009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761993080, "uuid": "d0fd6fa0-e802-4a22-a2dd-3d94bb4878af", "comment": "Malware payload (Mirai)", "value": "dcf1b86b97f097de149a1131f41b7fa8b8699d3e21b69bbe9acc46d183c738dc9cb282977434fe7e4806e78a049f3399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993080, "uuid": "196a3a39-a10d-4db2-8dda-ab57ed2285ec", "value": "T1C27318557C814B15C5D5227AFA2E018E3323177CE3DEB2129D216F247BCB96B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993080, "uuid": "cb9e499e-3555-471d-b38a-70197d7877d7", "value": "1536:RZnVdvwapP955SEWbPTLG0qNCKVsROALaFOFWy7jJiROixzOLjuf5uYu+x:YapPA5HKfVPsawFixzOLjufgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761993080, "uuid": "491bee4d-4847-4b04-b695-83995277e6d0", "value": 78980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761993080, "uuid": "04f70696-116f-47bf-8712-43e2a4432962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761993080, "uuid": "f0d11e7c-8fba-4e4c-a8b6-48c39ced73bf", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d69f3c-b754-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762023466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023466, "uuid": "d5adba54-3ff5-4d0c-b4c7-1bcf48adc0c0", "comment": "Malware payload (Mirai)", "value": "ffb3212a18452384415fdda667e96535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023466, "uuid": "59247a6a-f52d-4e5a-a4d6-d0b5868ed1a9", "comment": "Malware payload (Mirai)", "value": "f389847ecada7124835853bc2950b2e7cc6c06ad94f9babf1ab84e0a7d4ec134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023466, "uuid": "6f336f65-7d22-48c6-b30e-8c2f7b369095", "comment": "Malware payload (Mirai)", "value": "5ec23008931a2f087dcc1b6370030b623f25080d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762023466, "uuid": "b396d7b6-4e1e-4600-a561-271b7c025893", "comment": "Malware payload (Mirai)", "value": "26c4998e283535b592d25b252fedebe39a6292ee80266bc2a4377c5b1625b1c34d44a508204946ed80d23da5089116b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023466, "uuid": "b576a956-ab31-4eb5-b625-c2778d19a337", "value": "T170C3BE9B760B5820C86203F11BD39F8D3F6372169E4BC9F72D0D663B28795DB194A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023466, "uuid": "335fd7d5-fa75-4ca8-b22c-3d211edd1675", "value": "1536:HLP3iNiWwUMq54CvstbEQuC8OX0+GVrPHBlMX3hFp47xNqugHn3/LWT:HuN7w4eEQv7k3VrPHBI3hFp4VgHn3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762023466, "uuid": "c589c538-8d3a-43aa-8293-751047f192a3", "value": 124280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762023466, "uuid": "6df4c28c-62d4-4191-a990-bd632dba6c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762023466, "uuid": "7d049398-59e6-4e24-9c8d-616fa7bfebcd", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4486d58e-b6d3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761967895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967895, "uuid": "cbdf139a-7e13-4f67-b9e2-23791e9916d6", "comment": "Malware payload", "value": "de686d94794d2a082bbb1e8613a33673", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967895, "uuid": "3f232350-f35a-4749-a335-d09bff453210", "comment": "Malware payload", "value": "f4507787b2803139377494f3334457b1b581b0894d5c2bdcfad94ed7b0f58f16", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967895, "uuid": "a97cbc3c-ee50-4aa4-bec3-bc539ecb545c", "comment": "Malware payload", "value": "5107375161a16241e847fe9ad39110889a4bf626", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761967895, "uuid": "99ad6f6e-de82-4297-b116-a0028d376f16", "comment": "Malware payload", "value": "de0dccc98ab031db116a380957758aadcfed8498f7cb323bab304a8d2fdfde57f12d8f0c832ec1cdceb4ba436c8b3af0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967895, "uuid": "79abcd7f-b031-419e-b2f1-0167f0163a0d", "value": "T183C08CA2583DD03156BD0A5EB345F1F4A912A8390BB03872D8189640A1380740C5F73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967895, "uuid": "07b29b07-7444-4d8e-84a0-0aab58f7a02b", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfrLJ8ZCLBttUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfOLebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761967895, "uuid": "d4c109d4-da03-470f-85d4-99417b5d96a5", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761967895, "uuid": "988f7947-c754-41f3-868c-f664e9577a5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761967895, "uuid": "2f3f996b-db49-4290-9a79-df53a447ef9c", "value": "y23dpf2s2u.3sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c58bb6e-b6e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761974297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974297, "uuid": "86392492-0f02-45c0-94be-1f1e8797af62", "comment": "Malware payload (Mirai)", "value": "e4d10d26570670e824c221523f974d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974297, "uuid": "d32af6ea-187e-4f85-90e7-ad625305c002", "comment": "Malware payload (Mirai)", "value": "f4cc0b6b4b25f06a378eeb7d0e3c764cc7f5b6f1644639a00f72a3fddcf47c76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974297, "uuid": "feec9b6c-2a0f-4cb5-a94a-da3d424e164d", "comment": "Malware payload (Mirai)", "value": "2a92798f9264150452b979c34d3664e14f3ab880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761974297, "uuid": "9e78afcc-3009-4e6e-a3c8-75f118f75a6b", "comment": "Malware payload (Mirai)", "value": "4ed86a8d4b644f5b4933263c832b8b89cafd2acb7fcf52495824fb5df1d039c5573dacdb9f3a92c6d4059306cc690ddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974297, "uuid": "2b1d39f1-600b-4a90-b747-d61ca8b0d2a1", "value": "T167230276E14BB9FA51141FF7D880457BA96B03BCC8ABE07395AC04314B910C667DE3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974297, "uuid": "72a09196-3010-4aa7-aed7-5a8356118530", "value": "1536:1b1M8/GBMAMiUgp1CQ7bnLHX1ziIul+WOQagSu:Nb/gUMxLHpitl2tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761974297, "uuid": "069ae673-e3d6-47e9-a82c-471bd947dcea", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761974297, "uuid": "72849ea0-bab3-417e-b81f-66c69a9dc811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761974297, "uuid": "a385bcb4-bac2-4af9-8084-8c73e1f1aa6f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39aa1181-b751-11f0-91c6-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1762021993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021993, "uuid": "1288e862-d54c-489d-9ffc-ad99a3157909", "comment": "Malware payload (Meterpreter)", "value": "eb6ab5c7b011e08a2b38ec567674b4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021993, "uuid": "263dd3a3-16b3-46f2-b0e9-cff95ef56fd9", "comment": "Malware payload (Meterpreter)", "value": "f568efd55b22a01cf6dbe85b46dadaa027d19e698ae770296c35f551864d0054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021993, "uuid": "e03ca798-58e6-4591-872b-8ecdc4e56a93", "comment": "Malware payload (Meterpreter)", "value": "78524f4d742e5d0e073460fc9bca56fb92cf7bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762021993, "uuid": "d5f1189a-5f7a-4230-b4ab-e76f7560d380", "comment": "Malware payload (Meterpreter)", "value": "80c591fcd44268c23e12159bca3adddf6811027eb627f41a7d1dd2549384aee88fd76cb163bf6c394ee877b8d14a208c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021993, "uuid": "a7aa86d7-1e05-46cb-9e7c-31085371f614", "value": "T124F2C3A116324C7CD8F84B74DC77FAEE87A2F60E9281AA3591483185FC7155B1E309FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021993, "uuid": "3acac110-6c94-4438-8f15-08758ab53a52", "value": "9dce7cc2e812752626738e292c0a0288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021993, "uuid": "0a1e2ee6-3b18-41b8-9e99-eca64a3d69d0", "value": "384:+dYgj+lCdJOSNxwy2jvDCeOZBNDbD67jXtAfRm:7lCrGy2jWeOZBNDbD6nXtAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762021993, "uuid": "3a26c414-4d56-49f3-b2e4-c65011a136c3", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762021993, "uuid": "16c0af21-da14-43c8-954c-15183668f8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762021993, "uuid": "d48f46f0-4285-4dfb-9197-40bac01acf69", "value": "dbghelp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e544db-b73d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762013350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013350, "uuid": "cd975742-04bc-44b3-978e-d431130d6fa0", "comment": "Malware payload", "value": "c93b1a2f7690f2d7d5584fac163515ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013350, "uuid": "e53dc8a0-2bbc-4dee-be9f-b0a9861b525e", "comment": "Malware payload", "value": "f5ec65b652a9b9d969996f05819eb6df32bbfcba437465e229fdbbdad6ac621f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013350, "uuid": "4f9f81bf-d6fc-4c7c-821d-f9c585e03276", "comment": "Malware payload", "value": "544415a362ccc64a6b09ee3826610cab9d09cc0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762013350, "uuid": "4b375254-522d-47d0-bb7e-d85672b12d14", "comment": "Malware payload", "value": "bf0d36e62e10b77fd6e045c3214820393848a23ca5c6633914e1cdefde60068bd0f08bcf9a64dbf4378ab119ba533636", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013350, "uuid": "5ee5582b-ad61-4b35-b9a3-335aeaaae5ac", "value": "T1D132D505BBE48045E1BD9B7A0DF28610917A7B178AB2CE0E3DC205AD0C71B959E91FBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013350, "uuid": "d21f68cf-b63e-4f4d-8dc1-8c4dd7fc2a4c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013350, "uuid": "c30955bf-e8a1-4c99-96bd-f9e530ddab85", "value": "192:WyOh5lDHVTCxulCzI5eBxGa+Dg/QE0uzG4FBVWixmoLOdAvBKIjAs/YCZzsI3GGL:WyObd1TCxuEzI5eBxG3YQcG4rUCZLOwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762013350, "uuid": "74e96ea3-0a9c-4d5e-b137-ed50cf50be66", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762013350, "uuid": "e874efff-1144-4fa7-a20f-1ee16884ff7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762013350, "uuid": "784ace7c-8148-49e9-a8c8-34a0f8d9f71b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21430a7c-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990169, "uuid": "ef9090fc-0160-4a7b-9d82-13771e59cd48", "comment": "Malware payload (Mirai)", "value": "ad6bd756ef495c43cbc540da456d0f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990169, "uuid": "9b091e46-85fe-438d-ad80-89c22f8f54a3", "comment": "Malware payload (Mirai)", "value": "f75fbca89d5c74cd4259b75fcb1245e6b780cf426218b2c611d96907105bc202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990169, "uuid": "50bcf50b-a1fc-43ea-9a77-0211721eca83", "comment": "Malware payload (Mirai)", "value": "bf902496cf83e8a55031dcafb2198b19d55244a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990169, "uuid": "a24dc9eb-a55d-4c87-b19e-3d9fd222860b", "comment": "Malware payload (Mirai)", "value": "c82b48192eca5caf0baa29d292946af201bb23e26690274ed4d1e25e15c5fd71234aba193818ec285a73a1cc1bfdc6b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990169, "uuid": "08e59c52-0172-418c-ae12-d0b6f9959725", "value": "T1B9536DC8F5C3C4F6E98305305036BF378D73E1AA22B5EA47C3A69175E862502F916E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990169, "uuid": "378a19ec-20c9-405c-a223-8100d52bda66", "value": "1536:k6ueRaiPlhOhkxjbwCIM4/Vb+LxNKMthoLo/88SLs:kAsYhSkRbwCIx/VKLxcoSps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990169, "uuid": "edeea8a0-31c9-4dd6-95e1-ec7cc63c573d", "value": 62608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990169, "uuid": "ae2d2c68-8131-4cf9-8319-60d9c98fc554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990169, "uuid": "1fd16cf3-d7ca-437b-8a53-87f373528aa3", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3fa72e-b707-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761990166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990166, "uuid": "a55f0c4d-eace-41f9-af1a-78172e5a2f16", "comment": "Malware payload (Mirai)", "value": "13fa3a06081df383974454cf40dc68c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990166, "uuid": "37a2ccfe-6333-44a6-b3ff-76a4dcd3c817", "comment": "Malware payload (Mirai)", "value": "f8eb665894aa0d71c0ef0b534defb0d2f22eb1aab403a7e98dfe519cd258fd11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990166, "uuid": "0836516a-ab70-4dd7-a45d-f1dd28e101ab", "comment": "Malware payload (Mirai)", "value": "7378b91a02eee62332cd88d65644a04547a8c516", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761990166, "uuid": "c7c96b26-8182-4964-8b28-e71c886011aa", "comment": "Malware payload (Mirai)", "value": "d1af443d897d33be0b41adc180ea58d1955a49f255c734418d39645ad5c10c04abe9aec67532bb4832e13992fe15ef95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990166, "uuid": "95d4a7f1-0fba-41bd-afbb-ef78e0431348", "value": "T132515E8522A683312F51AD3673EB44097581B0A7DCE61F86ACFC7BB4B58ED8D304179B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990166, "uuid": "c478fbe2-55ca-4593-b9da-49f0ed106054", "value": "48:iWILWYyYeNWSXWTbWlzWxbW+z3WvY0cW5fLW25JWnjWlVTBW6/WMsUWRw9:iWILWYyYeNWSXWTbWlzWxbWQ3WwDW5f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761990166, "uuid": "b123d2e6-5b2e-469e-b242-644ca24a7792", "value": 2984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761990166, "uuid": "dac12d28-4e81-4ae4-881e-1eb342447477", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761990166, "uuid": "619a9a5a-7226-4942-8323-6ba5d2fe1dd4", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd76854d-b6d6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761969413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969413, "uuid": "e83f6ff0-8eaa-4c40-8c78-c580928345e1", "comment": "Malware payload (Mirai)", "value": "cffab48618b97a195a381065c522b889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969413, "uuid": "8a88d87b-630b-462f-94a2-01e923f8407e", "comment": "Malware payload (Mirai)", "value": "f9a0691201e6e7ea0846b0be257526c0dfbb1ca197fe1e80ec8a988af87d7d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969413, "uuid": "be9d0c86-0b5b-4c74-b6e2-3cbd05624f5a", "comment": "Malware payload (Mirai)", "value": "1018e1bfe80c865467ab11bd29ddf8d61759e0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761969413, "uuid": "3b29216e-834f-4dc5-9f2b-8e9068ab1254", "comment": "Malware payload (Mirai)", "value": "200ae17add0a50b46eba52b126a058153b9d141dbbc38413f44e43e5156fc1a4d0a6f488a7c91d805424698cb3bd0e45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969413, "uuid": "244c605a-a414-4581-9d3c-cf5a3622a78f", "value": "T196F34902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969413, "uuid": "3e548a70-9ece-4bda-ab82-da32590b7f20", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2AZ:tLm3Iy4y5xAVDiFWokPbdE66hh1XRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761969413, "uuid": "674cf813-5e04-4b2b-8726-030e41b4f980", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761969413, "uuid": "e30b9237-2e2f-4799-a8d5-a625cafa86b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761969413, "uuid": "e9346a38-9a02-44ae-b908-e8e14e31d1f3", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577e0146-b6e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761976517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976517, "uuid": "f977686b-067b-419a-a684-0ff37d151879", "comment": "Malware payload (Mirai)", "value": "efc042d0b7c633c486b1c3b02fa139a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976517, "uuid": "8e4e8f6e-0f12-4f76-8b2e-17654f7bd440", "comment": "Malware payload (Mirai)", "value": "fadbf1ea798c63e5fbc2af45db7b155d4d1cdb2f3e27d5858685752bc43a01f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976517, "uuid": "d73e8db3-2001-4469-99a1-deff8e766a59", "comment": "Malware payload (Mirai)", "value": "cba5f309ddde248b1bde14b83ac12757971e79d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761976517, "uuid": "6b41cfba-ebb3-4ddf-b08d-7a86235ac5e4", "comment": "Malware payload (Mirai)", "value": "54fecfa582ffa307c7332b0f4c022903696739da7987e3ceb495331f2e348220982d55b1a2856ae0e0fb87faf0795320", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976517, "uuid": "66b50deb-6de1-451c-afce-4e2b3fbf663a", "value": "T11F0192AA4D71E3E884ADC701B846C85B6419E7E200830F50EACF097743FBA107036BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976517, "uuid": "e3f8a4f5-a711-44cd-a8ba-ae537356dbc0", "value": "24:oSxeQQSweQQSbeQQS1eQQS6eQQSNeQQSvceQQS4cet:dxeQlweQlbeQl1eQl6eQlNeQlEeQlXet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761976517, "uuid": "5d30b474-e053-41cf-8973-a6b9e3ff5b03", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761976517, "uuid": "08b7f41d-5130-4b92-b789-d9ba47aefe4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761976517, "uuid": "f200125c-85a8-4987-b3ed-34226ea5e858", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc6ce98-b6b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761955884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955884, "uuid": "e623e84f-bc52-4b1d-b0a2-cefbe4f093ee", "comment": "Malware payload (Mirai)", "value": "7befcd50024c4f6f06b308730c31b6f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955884, "uuid": "97388234-8df7-42a2-aefe-850cffa1f4c7", "comment": "Malware payload (Mirai)", "value": "fb32e074e970e18717931bba21ec1a75f28fb01fa0657957ae31a6382660a44f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955884, "uuid": "01e596bc-2d7c-46fe-bfc7-442fbe8c51ea", "comment": "Malware payload (Mirai)", "value": "c228f0d1ad984cedd8578cc83f14bd1226d1697b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761955884, "uuid": "6ead716e-d1ad-4b30-bfec-2315b629c57e", "comment": "Malware payload (Mirai)", "value": "400c9e24a61971368f8fcfb82a9fa1c8f7be684f56df131a4694d7a7810f76a797204af674e8eefc7c5a81371e74af97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955884, "uuid": "d417aa32-b7ef-49c7-8ff5-58db8a24f9da", "value": "T11C01449A1422A7218CD4DF51BE6148755C1CD2F31D821F9BEECF5DA3C5E96187032F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955884, "uuid": "0f287052-4ae2-4ca9-b4d9-038937123d00", "value": "12:784HVrOL4HarOL4HbrOL4HhrOL4HXQrOL4HprOL4H7burOL4H7kurOj:oSV4Sa4Sb4Sh4Sg4Sp4Svu4S4uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761955884, "uuid": "891bfc4b-23da-4661-a9f9-a3cca71e4c66", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761955884, "uuid": "2fed9986-8ac7-4c8c-bf2f-3548bb634a70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761955884, "uuid": "bb298299-557d-4d0d-bd3d-08ffa258cd79", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68edde1-b77a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762039839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039839, "uuid": "8af407be-509c-4a62-9bc6-a58a9287b839", "comment": "Malware payload (Mirai)", "value": "8f63bd9ac81ed80c539ba110af084730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039839, "uuid": "6f3bd7c0-b21c-479e-a131-2c5fe4f0a9d3", "comment": "Malware payload (Mirai)", "value": "fbcdab407cef1578fdc4e0329b4fbb9b0c5c68219079ae411fdb6951a7701f9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039839, "uuid": "8a911ddf-2f50-4286-8666-894e5261f5c2", "comment": "Malware payload (Mirai)", "value": "52c518f4ff77f71f8e3adf97546d94e3795852aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762039839, "uuid": "8faa18a0-06e4-4a49-99ac-f6e46122f82b", "comment": "Malware payload (Mirai)", "value": "7dd9985bb6591f7f2a87fa477847fb6cb5637f7ff08088a000d379ea1adc1e26b33e7803ffa6c51d389767081d59a802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039839, "uuid": "93e6e594-7612-48fd-a6e0-24c557f4b7cf", "value": "T155B35A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039839, "uuid": "ae9d834c-d222-4763-bf3a-943e73ce0b53", "value": "1536:1a97/6/q0AmnClOL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClOZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762039839, "uuid": "5f0c5853-d8cc-4455-851a-43e727951cd6", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762039839, "uuid": "3a08fa35-7e60-4041-b473-6bef234262a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762039839, "uuid": "55d63ca7-004f-411a-b4bf-fe75c206f9fa", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7452f442-b711-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761994604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994604, "uuid": "e6343805-b94b-44e0-aa22-96448e54a1df", "comment": "Malware payload (Stealc)", "value": "5d2f32cdb2b2e2130af09ff13d315f92", "object_relation": "md5", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994604, "uuid": "e56b51b1-c89b-46d3-9010-e86951c25e3f", "comment": "Malware payload (Stealc)", "value": "fd4498a7f9bc714466a86f59aa4565a2b5f4c4eee7c1a36e71fac43d7c876abd", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994604, "uuid": "93001b32-2aab-4b1c-82c1-ef523942bc16", "comment": "Malware payload (Stealc)", "value": "6e00efa566cdbcaacbab9d80779e3090f911b739", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761994604, "uuid": "e8b82cac-7f9a-4b30-bfea-a93f8704953a", "comment": "Malware payload (Stealc)", "value": "cbb8df8fbf05a2aa5f2dfe327c2a19ac4f5fd6d0ab8bc3c2ae50b495e2308c34eb12616b35be6641c0be564a2d88ff64", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-64", "colour": "#7AD1C7", "exportable": true, "hide_tag": false }, { "name": "91-92-241-143", "colour": "#8DEEEE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zalukina-avisregde1988-workers-dev", "colour": "#EC46BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994604, "uuid": "5e4e17be-23fe-48da-8728-66ac21a32328", "value": "T147510305D15790B183F5734EED22E069E71F202F5047A61836ACE2916F311FD9BAEF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994604, "uuid": "4a4922dd-6c11-49d6-939c-39bc09cbf33e", "value": "48:+/k16eGkoNQxbeAj8jmatfyfGuG5GYu/JS+s00ezpY2QdEAaKjAVpQtUCjzfHEEq:+c1UbwjVaIbW26eKLjzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761994604, "uuid": "2e8823e5-6239-49e6-8a6f-18c0f0bd405a", "value": 3096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761994604, "uuid": "d9ebd80c-b152-4a30-8037-54892987a21b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761994604, "uuid": "002aaf31-751f-42eb-8ef3-ef434b6f9efd", "value": "zalupa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c33ed0-b776-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762037854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037854, "uuid": "9babb654-d418-47f6-928f-5373e06d0e1d", "comment": "Malware payload (Mirai)", "value": "f694dd3c91a001702bc1e215f12e9795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037854, "uuid": "2f942479-b0c0-4d1c-b9fb-29cdca9633fc", "comment": "Malware payload (Mirai)", "value": "fe8a9627ef732e6fde93fabf93bf4cab311b48a7e63b7a29ca418dcec90495f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037854, "uuid": "deface5c-9221-4323-bc22-b6378acddcac", "comment": "Malware payload (Mirai)", "value": "cc68d418093391fa17f64007c507ace0ebcc98b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762037854, "uuid": "09cf8bcf-50bf-4d69-b48a-88cfa2c613f4", "comment": "Malware payload (Mirai)", "value": "30796d856f1790c6a71ee090281a1f5834d4c9ca5df45624ab09ef308c5682055d352843d8c9aae2ec7d5ff64346750b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037854, "uuid": "2be2c435-aceb-445b-8a5d-916af37c75f7", "value": "T1E9B32A96B8819A25C6C2967BFF5F028D331657ACD3EE7213CD285F60378795A0E3A016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037854, "uuid": "41229539-3b1f-4389-95b2-4908f51bd792", "value": "3072:efjo4rHARd2x5syG9H6UCIwFNj8rftSrxYFvKN0FblFeOzFh9IB1eanz2:Qj1rHARd2x5syGF6UT+F8rVSavn6wh9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762037854, "uuid": "b533414e-396e-4092-b53b-7a473054946a", "value": 110864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762037854, "uuid": "81cbae5a-0699-4406-8902-1259e3164c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762037854, "uuid": "8b6f5c42-93c4-40d6-8d9b-3598a229ca5e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6f9f89-b704-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761989088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989088, "uuid": "bb22001d-84df-4afb-9ef4-514bf1eec9b2", "comment": "Malware payload (Mirai)", "value": "a92335ef55eecd76d997ff73f2aaa882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989088, "uuid": "c74e789b-8efb-433e-abbe-37981ca4c2b0", "comment": "Malware payload (Mirai)", "value": "febc05a954ce79875dafac53c26a1fde9c0f790a987326465b6f7568534cb34a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989088, "uuid": "2125bbb8-ec0e-429e-99df-26a687dbe3cc", "comment": "Malware payload (Mirai)", "value": "b945120711315780167ae6b98288873148b90596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761989088, "uuid": "67ae54ad-9ac9-40c1-974c-57f24ce0182d", "comment": "Malware payload (Mirai)", "value": "7af8d72f022315e8a906a566fcb985a63ab234b17399baedd3dedfc9e4948fe040cb511e4ddfcc56c3bbd5de33bdb7f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989088, "uuid": "a6b91acb-26f2-4018-8442-b9dc3b8986c9", "value": "T194534B32FA362E17C0E1A57921B74B15B5E51BDE21A4C60E7DB20E8AFF606506503EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989088, "uuid": "74a6c1f1-13ef-4772-8826-2a35a7d34f1a", "value": "1536:R29Q7ff3WUiXi7kPUCHvdow8nFvkIfiV0g:A2iCkMpkNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761989088, "uuid": "0b7d2dbb-11a4-468c-8b5f-c514cfb2dfdf", "value": 63504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761989088, "uuid": "542f9564-4df0-42a9-9299-ce7c7cf95266", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761989088, "uuid": "296764f0-2949-4bf2-ae10-c625cbb60cc7", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3eac4b-b700-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761987155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987155, "uuid": "2061164c-68bb-412f-bfee-1499152423af", "comment": "Malware payload (Mirai)", "value": "ccd4b77255e3aeb5219821c641ec04c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987155, "uuid": "c51f2b10-6cd9-4043-a917-57303ce3374c", "comment": "Malware payload (Mirai)", "value": "ff3217b6d16939779767f6a575a5073878ada2e7ac0330b8354238e71d1bf10f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987155, "uuid": "95cf8781-3801-4653-b900-8adb5ca3fd91", "comment": "Malware payload (Mirai)", "value": "18fa9fec6a3d442098bb8d1c9291273ffb570fe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761987155, "uuid": "beff157b-485b-4895-8967-6420d4c86621", "comment": "Malware payload (Mirai)", "value": "85cdd75e5318b14a295859809ac18e1c1d0c0deb4b5c08e858592406c6df3dc6413d99d0190356ac7e1702e42295599e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987155, "uuid": "d09c7c3a-3c3d-4e3e-8ab3-4b416369d867", "value": "T16FC31B45FC405B23C6D612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987155, "uuid": "8627ee7c-f72b-4094-abcd-bf403fb12268", "value": "1536:p/Ka0rG5yC/cMChygtiOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQd:ZKaprMh7sOXWFh4UXcYFkWpZlvWNUmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761987155, "uuid": "87f76a62-ae50-4413-9ab8-c40ebdff80f1", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761987155, "uuid": "ba74383a-dc8d-487c-834e-12d0defd26ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761987155, "uuid": "fe3e6c70-9a52-4fc0-a955-d522d5ae960e", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aad1b85-b723-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762002157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002157, "uuid": "21ad7930-aa9e-4868-b3a0-d9f46ee4473d", "comment": "Malware payload (AsyncRAT)", "value": "f66f281390765d9deef6f59ac48e930c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002157, "uuid": "e4194820-44ba-4869-84fe-4f9d12d4f859", "comment": "Malware payload (AsyncRAT)", "value": "ffa74f7c6cc8e12559de04e5349533ceff8860cda9851a9af748b797cb23f6d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002157, "uuid": "3bf7fc39-be5e-4340-8aaa-a6311ff61bde", "comment": "Malware payload (AsyncRAT)", "value": "71c5e6023833b43549b24f3961efccd50fca2e23", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762002157, "uuid": "f7165bd2-be41-4e5b-93a7-d7f2475abbda", "comment": "Malware payload (AsyncRAT)", "value": "07e24882d58cc5e574cfe687c096e21be02bd44b3f32a0d5e0a8c4f6c2b4328bdd41ff2b2ec573a9d0d21725f7646cad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002157, "uuid": "da1544da-d9bb-4036-a4d7-377ea2029e2d", "value": "T11DF37E6D8A2FBC9CF62830DCF1783E063BD9155AB2F1BE5C918DA0D30D5495A9E32748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002157, "uuid": "65586ec5-8e25-41e5-8252-755ada3cd574", "value": "3072:zdoNCV7XEvMyw1p0gN6l9K2EPJcsH2L01wv10oPLl5iz2rK37VY:zdooV7XEEyw1RCKPJcsWA10xn5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762002157, "uuid": "a77cdcd4-6f8e-47ea-b40e-4e97774cc95e", "value": 163892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762002157, "uuid": "5cdd922d-f447-46d5-a60e-f43e2871bc8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762002157, "uuid": "601246a9-c5a6-40b6-90e3-5a137e96b535", "value": "aoc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }