{ "Event": { "published": true, "date": "2026-04-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-19", "timestamp": 1776643381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "74e77dde-cc02-44e4-b902-bfbbce756b4c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e47480-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635445, "uuid": "58cda75c-c8f5-40cc-8267-97310b97d1cd", "comment": "Malware payload (WeedHack)", "value": "25df48f3a2062551a4e29d48dbe096a5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635445, "uuid": "f870040d-9891-46a6-984f-63602d9bc2f8", "comment": "Malware payload (WeedHack)", "value": "00c40114165f511bfe1ba718b77889d30df4848bcde4af1d402ce49d30624605", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635445, "uuid": "7d1dd614-4764-4ad6-9cbf-ee50645291ed", "comment": "Malware payload (WeedHack)", "value": "ed0e31a0bf385a6e53ba57289c3c0099e64ecf73", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635445, "uuid": "b71c718e-d79e-4bf1-8e30-66279d52cd3a", "comment": "Malware payload (WeedHack)", "value": "d7bc2c958f9766e935a1caf9cb07709081c7e0f823aa119ba11b4fe88611d96660c47eba6861d3f905945e2517c717ca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635445, "uuid": "5883dd4c-1bf4-41e1-aa6b-fa088316adc6", "value": "T1E5260121D65E003AFC17EB73D042B4A478FFEE91631BF0653A79056E882AE81C77E516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635445, "uuid": "046dc70c-8b6f-4551-b8d8-5f6714552c33", "value": "98304:s1R2SKrn8PM0oTd8kMcdXv3k3GrEZN/kMLKUK4ZxG:0R2J2bTcV3k3WYJxKUK4Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635445, "uuid": "600085fd-140c-402b-b26f-5dcd9ffa8e30", "value": 4767239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635445, "uuid": "b643c8b1-86ed-446d-b19d-e1c5261f5209", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635445, "uuid": "e4eb6c14-433c-4711-a0c7-3c3197c1788e", "value": "Meteor_Client-1.21.11-76.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c39baa-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635400, "uuid": "d1bc3c63-51c8-4b9f-871b-af934e27f06e", "comment": "Malware payload", "value": "cc6a6dd1b0a4cae9b0ab1c2edef731ab", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635400, "uuid": "16c2ea71-334c-4473-8552-6ca82a4746d9", "comment": "Malware payload", "value": "017aacd8724c20bd0b006c7d30485d18b9508b5ed646a12466cf9e1ce2bf35e2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635400, "uuid": "3d72acb0-8662-4736-ae4c-87eb3d9f70ce", "comment": "Malware payload", "value": "08e744817f8af10cc1ef8516e243002ffc7f76c6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635400, "uuid": "da56b7d9-1951-4cea-91f3-0eb88a7848bd", "comment": "Malware payload", "value": "945402b6e6da6be4f2ee0aee2c5fc6c6f6876d39ff7c2a43af306b038008fe6b4e16caa5eca3969122a013ea9af6e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635400, "uuid": "adf425ad-4f7e-49e6-b570-39a0667a210a", "value": "T1231523BACADB10F5E55365BD4426A3190FA38620EFF8F314F66D2C8182D9E7272CC945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635400, "uuid": "0b7df8d8-1839-4bd1-8d29-30f8e8847854", "value": "24576:MHHA5RF3Wf8dJ5ZXa06hK6iolPOoi/ryiLIsp:MnA5nS8jLKBh2olPOo0yqnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635400, "uuid": "5b7f04a9-052f-41b8-849d-9ba3a92fb902", "value": 907455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635400, "uuid": "11aff1da-6479-4356-8e76-ed8359e0c62e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635400, "uuid": "69efdbd9-ab2f-475e-a513-af4a12f7df2d", "value": "Fake_Spawner_Mod-1.1.0 (3).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcccb851-3c0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776617049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617049, "uuid": "a9be1dcb-805a-4ef9-8107-9da8caf1f92f", "comment": "Malware payload", "value": "e3db87903fc14a8e8fe4e4fdd2bee009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617049, "uuid": "9d741534-189b-4369-a800-1ae52050265f", "comment": "Malware payload", "value": "01f2a993359b45c83849d866d77b525d1dea31dab8b587469ea28736e800f5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617049, "uuid": "756afece-2ef5-4b66-9dae-b3602a3f4c71", "comment": "Malware payload", "value": "812882d73459954ffed3602f456ac2525929cacd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617049, "uuid": "c30c90db-6f49-40f5-b239-f913c72838a4", "comment": "Malware payload", "value": "ba21d681c8fc30755ed8ebdc6f6125ecc0eb83b5a179ee0723469f9d3b646ad78180ad1ed1aa2d3ccf099712e530716a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617049, "uuid": "079936c9-e859-4265-9497-6bb0890555ef", "value": "T11E835B0933E44E91E9FE0A7B0A7291150372E5925F53E78E8EE1589E2F733828D0D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617049, "uuid": "4961841b-1bdd-413a-aecc-ed7bafbf777b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617049, "uuid": "21eab2bf-5ebf-4da9-9b8a-c31bcf1002f0", "value": "1536:gJwsHslhVsETri9gF8CILbpL2rCufRGqTomkQXg82b0r:gJwNToCILUrCufRGqTtkQXg82b0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776617049, "uuid": "f024e699-e243-44ee-96a8-87212aff6a20", "value": 85596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776617049, "uuid": "4d690c81-909e-4258-916a-55af79fc3b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617049, "uuid": "325ef789-fd21-4ff3-af52-71254f0dbc91", "value": "jellycrackersmerch.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb631c90-3bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776574419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574419, "uuid": "e3d13898-2b5c-4c49-928a-800420a0843f", "comment": "Malware payload (Mirai)", "value": "cc40e161d86df196dd50199630904893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574419, "uuid": "9073f0e1-8d07-4f75-b905-18a2ed1d3adf", "comment": "Malware payload (Mirai)", "value": "025bfef806662c34ca8a3b17219854e4c277b0f1a27de0bf1f3e922d17fbb2b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574419, "uuid": "5395524f-0b90-45a8-9030-aa46d95f6f2f", "comment": "Malware payload (Mirai)", "value": "975f9db480f5c1a956c1780092270cc14e2d553d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574419, "uuid": "2ad2c8a8-f73e-4542-a7be-7e5a6047a061", "comment": "Malware payload (Mirai)", "value": "a8e4114b13b47d60ee2ca89f0db6d871fe54d62e5efec60c4e1233e9aaa6cdfb7bd011dc85c3fa553a4636ef5624a461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574419, "uuid": "574007c1-2160-4a23-886d-8fa4b1187a04", "value": "T1F9142DB2C44DC5D7C922127C61A9AF7BCE3EB2EB1709CD02BED4643089C5E9B7A16D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574419, "uuid": "9bcb2e53-0c0e-47b8-81bc-779ea983ddac", "value": "1536:PXMMqwKAw/AHUxIWLVm9jAzNxHfYCLfiWlaLoeBgm5PTliK+pK7DKrtwp+Vp+wEg:0MqwKA0wWHfXLq8a8aPTgs6ZuytFDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776574419, "uuid": "ee6e95c7-3471-4ce9-8268-b11f87e44986", "value": 194444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776574419, "uuid": "483b0187-5af9-4726-9e53-a7b3f2e40a3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574419, "uuid": "28411b0f-bc6f-42f9-bc40-5940f19bdde4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371ef74c-3c27-11f1-a769-42010a9c0008", "comment": "Malware payload (Neutrino)", "timestamp": 1776627455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776627455, "uuid": "6d1b92c6-563c-4e65-b5a5-12ee8864db69", "comment": "Malware payload (Neutrino)", "value": "21be80c278110af8d5a3fb443dacbca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776627455, "uuid": "32f27adc-8314-4e62-b084-e83a14ccb6e3", "comment": "Malware payload (Neutrino)", "value": "0270c76c010e9b66c19d2d06cbff2b95a7b558296afe8e1172cc001f4f3aa3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776627455, "uuid": "5b5fad70-c4cf-4afe-a0c8-0ca4288d1114", "comment": "Malware payload (Neutrino)", "value": "da1b8f3ba074f19ec949147fcc69ed7d2a76ed13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776627455, "uuid": "fbae8804-b1b8-4847-b5e1-bf80fe38fc43", "comment": "Malware payload (Neutrino)", "value": "8086969c2fa7e5cfef093c9620f02abc5447f6893e6efed56b988d817822955b84ec0d0cd871dd7c774aeb642da8b558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776627455, "uuid": "5afe63ec-bb12-45ca-aa22-183f8b6142cc", "value": "T142E3D0427DA4C031F877023804B982639B7E75879539A55B37A92ACEDBF13D56B283C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776627455, "uuid": "c70b4907-b979-4576-aecd-a297cbe0c767", "value": "8d04b0f9db9f34761ca4b26f9ee1ee78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776627455, "uuid": "7d99db68-d4f3-4081-a81c-97594bbb6a2f", "value": "3072:LbUMEpifpbGRxwgGr3rofZhkxU37ZmGb:LbUMpiRigGjuhkKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776627455, "uuid": "617426ea-e6ea-4727-a094-b1bc322e462e", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776627455, "uuid": "aa64d7da-bcc0-45a7-bc11-c83ac6575c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776627455, "uuid": "d39ccacd-d31e-4ff4-845c-63b5452f3ba5", "value": "SecuriteInfo.com.Variant.Jaik.41709.18634961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8e3482-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635466, "uuid": "f0fc8dfe-eb5d-4cbf-8387-3772e9debd3b", "comment": "Malware payload", "value": "611568a7965a25fe357d1becb8e7b93a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635466, "uuid": "a153f9e5-48a5-41d4-8c0f-a012a1a00720", "comment": "Malware payload", "value": "02cf9f6a9173f077b68c739cb7123e9ba02a16c286c1080c99dea40185a93710", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635466, "uuid": "56995e58-d029-44de-9d95-d6f391813103", "comment": "Malware payload", "value": "c983702729f3cf3f058fcb9dfbea38a8e76c3c5a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635466, "uuid": "d878f781-c1b8-4cca-8527-4366280b7ec7", "comment": "Malware payload", "value": "7bdac2a68581bb874a815d1afe9bee320111cf71664c9497948e9511ffa35afa6a5329ac231626621c2ad618729429bb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635466, "uuid": "c4b00ffd-b12c-47ec-a51a-3b15eeabc02e", "value": "T1EDA63327FC8DE280D8523E33DA92ADE67561C633EB44EDFA784EB51AE7486C057106C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635466, "uuid": "990fbde6-27ef-474e-8782-2f2b9bcb9c7e", "value": "49152:WAYzLkkVBE3ZcpjBRvhQdTQYCm1zpTgeW3o1epcFDKq:wvBEKxviam1BzW/pcFDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635466, "uuid": "fb17de66-cf4d-4dc2-9dc4-3aee3c0232cb", "value": 9883463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635466, "uuid": "74457309-1933-4e96-9ece-f38bf4255b91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635466, "uuid": "658103c8-6447-42c7-ad79-28ed96a07b91", "value": "Radium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5460440-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578704, "uuid": "1cbbe338-1ac4-44b7-acff-3e4154840d3a", "comment": "Malware payload (Mirai)", "value": "43bea2c483ab72c01bb6cb94520401c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578704, "uuid": "7ea3d655-9344-46c6-a9db-a636699ec561", "comment": "Malware payload (Mirai)", "value": "0374044452b61e3cefd223d47bda03e70b58728c3b11e1497b10ce7c19131274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578704, "uuid": "e1238654-7692-4d60-8658-1e90e16c074e", "comment": "Malware payload (Mirai)", "value": "580758f38ad529e6a139bd0e6330d4bef604e3ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578704, "uuid": "795b53a2-bf32-4d13-881d-e074b819fd4e", "comment": "Malware payload (Mirai)", "value": "d7dcfe7a27354606d2206d7b67e42993be6755f812f1ade2bf6d4d5d0d163701271914b63962c99db850d5183b2e726a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578704, "uuid": "815080f9-d761-46e1-9f10-5de4b7e64d47", "value": "T148733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578704, "uuid": "b214cb1e-6944-448e-a29a-f09128807805", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNj:OZWLnJpcO72RDRZNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578704, "uuid": "afb4fdfb-6fa7-4ab7-bbb6-757722b77a19", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578704, "uuid": "fd631d67-3272-4129-8cbd-e1bf229a1d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578704, "uuid": "c8f98da6-1be5-4459-9d3c-71ba3583d924", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8c0caa-3c13-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776618983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776618983, "uuid": "c96b1d43-fb46-4b44-a51e-92f5a3e22f9b", "comment": "Malware payload (SalatStealer)", "value": "02f817b22a1edb971480f16b1865b224", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776618983, "uuid": "c0acbe1f-75cf-4849-82cd-e60455a5c5bb", "comment": "Malware payload (SalatStealer)", "value": "038a99d3086d0964144291275da99621314c2de5c6628af6708afe3af8992572", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776618983, "uuid": "0ad69344-68c3-4fa6-8af8-927e436130a6", "comment": "Malware payload (SalatStealer)", "value": "f76fbce151777e457fd112fa378f793d250e4c15", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776618983, "uuid": "bdc56b10-1992-46d8-908f-aa6d6c3b3337", "comment": "Malware payload (SalatStealer)", "value": "9b0b793c4847357b93cfa337323a22113cf3e142abb05a2a775822a2a743e845e3889d36171386ee6c1d5712926bf3ac", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776618983, "uuid": "acbec8a1-2857-4aba-a45a-a25247340b73", "value": "T1A726332164908FB1C5BB06BC99ADA7689BFC29004F50DCCF0BC855AE4F6EBC48574E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776618983, "uuid": "3042b80d-d589-4331-9eb2-b47685741f6e", "value": "f0c576aaad9d0dcd5f77cb6d6d48f220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776618983, "uuid": "2bd785ad-3e5b-4ef9-8790-eddf5436c718", "value": "98304:PxrlrnJWPP69rodlK2cYAhaxZZIG0POn9wOQHU:PBlTJiy5oJdxjIG07HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776618983, "uuid": "e93ae61f-f284-46ac-a412-fe5942510e5d", "value": 4694528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776618983, "uuid": "c9cdc7ab-1fed-41a2-97e8-10f3e0cabb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776618983, "uuid": "29f150f4-0847-42d2-882c-a720d25125b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614a00b2-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776642558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642558, "uuid": "267f4831-f59b-49b6-8d13-c7921401c736", "comment": "Malware payload (Mirai)", "value": "f9e9ba06be1044694fb1e008555c2e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642558, "uuid": "1a466cd4-6558-4c0c-a261-18c75ef70e3c", "comment": "Malware payload (Mirai)", "value": "04dd3df607bd617892452913243acbfb725a6ad07c42f3bf43e69da19751944e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642558, "uuid": "851eb078-b1c9-4d04-a770-a99942517bef", "comment": "Malware payload (Mirai)", "value": "c3ef5e5e68c17166e25ab187fa764fa087ae08d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642558, "uuid": "4a37f45b-e749-4851-9cea-95f9d334f746", "comment": "Malware payload (Mirai)", "value": "565e2010573cba20ef08e53671bcc96879d73b71bb1cc982b1ac36fef25e1f0affe4d61bf5552edce4004a9b38a153e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642558, "uuid": "3af3af86-e744-47c3-8907-c40f307eabcb", "value": "T1A8247072985CC587C52262BD60EEDF7ADD7E72CB2608CE017CD118399AD5FDB2A06D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642558, "uuid": "9ba4f597-ce5d-480c-a4b9-390266a35fa5", "value": "6144:dc96t3nBxtFPRix6N1tL99ow8a4MHK07IeChHfm3a6oHa1+qTH7sZ:dc96t3nV+rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642558, "uuid": "5acea286-3833-4e4a-aea2-55f729d62b57", "value": 215148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642558, "uuid": "9fe31a4d-ca63-4f0c-9510-67c5ab02115c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642558, "uuid": "284bc69d-4da6-484f-a5bc-da0fa6a89a87", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda00cd8-3bcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776588167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776588167, "uuid": "c411f7e6-0b2c-48fa-80ec-7fb1697f994e", "comment": "Malware payload", "value": "659eb0b0580f6474341a081989ab5de7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776588167, "uuid": "21e5cc63-202e-4729-9c65-edb11fa73c01", "comment": "Malware payload", "value": "05ec568eaf3289c7c1f2190e6f3b6b887966010d7089eca5abc44f5c942a048f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776588167, "uuid": "f497b218-9e4b-48aa-8c61-b838ac57e8a2", "comment": "Malware payload", "value": "6ff13d833954c7b8979b61df8421494fa8f4349f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776588167, "uuid": "063f8114-759b-4a4e-afec-32597c3ff250", "comment": "Malware payload", "value": "851384acc9821eabcd091b162e01d87117d06da885b91717fd84b39ca986ef92a91eb074db2adfa3bab3a9b045efbbac", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776588167, "uuid": "6a378832-b188-4bda-b939-1d591faaf0a8", "value": "T1D1976BC3E8E35A94C4EAC3719166425BBB627C0D1B3823DB16A0BF202F367D0A677755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776588167, "uuid": "1008ba0f-fce8-46ef-ac3f-e4017c950018", "value": "196608:/8bz8wHwSjDnlXcPkCQdq2U4CMo9ElF1O2oCKRS43YMYN8wEKUV065p:/8bzPwYDlXZCQd/pbHXnKRSntEKIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776588167, "uuid": "7c99e048-a209-4c63-8bc4-389e500b9ab1", "value": 42134280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776588167, "uuid": "6eb8a4ae-8b6a-401c-b011-133646f8062f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776588167, "uuid": "9f78bf7c-b7c0-4d22-8edd-e6b8c3eee885", "value": "macho-payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae97d572-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598879, "uuid": "90c6531a-15ce-48cd-9aea-55ac0a2684de", "comment": "Malware payload (Mirai)", "value": "1af8e07a396a54560bff81adcfd646bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598879, "uuid": "1983d0d8-fcbc-48b3-bfa0-db2c2fc38ad6", "comment": "Malware payload (Mirai)", "value": "0675ca71db315237e815ef3f7f6aa02254b6ca8211f7743b85d80c968b5a52b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598879, "uuid": "e89521c5-45dc-41fd-860c-33f09cd66407", "comment": "Malware payload (Mirai)", "value": "a24030d6b231a5429da092df8f97acd7dcae009d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598879, "uuid": "dfc50d4b-1a0e-4a71-af32-ba46fdd568be", "comment": "Malware payload (Mirai)", "value": "8f595f785701a51c405f2758905d47011af0101e8b3fd569d63d4bb249c1d133d7de2533e3ca12dd2de96bb3c83fb268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598879, "uuid": "7853ded4-2223-438b-b3d4-de72d2493e7e", "value": "T10F230271490E8EB114303C76DF95979376E01AB1C5677013D6290B3C6F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598879, "uuid": "a7a037e8-9c74-402b-b920-0ad743a06be6", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3EQ9q3UELbUXfi6nVMQHI4vcGpvz:DECFd+A6YHAxEZLRQZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598879, "uuid": "2426a7ab-422c-4739-9be4-4fabd38c49de", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598879, "uuid": "f530ffd8-b828-44b0-9d86-cc1fa27a5967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598879, "uuid": "f9fb2417-a82e-43c7-bb40-5c7dba25f330", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00588b21-3bd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776590856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590856, "uuid": "1ab75cf6-c53b-46a6-80da-fd9992c78268", "comment": "Malware payload (Phorpiex)", "value": "a437588684620a52e2f978355a581b3f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590856, "uuid": "dc40f3a9-4738-49aa-ab14-434996a01242", "comment": "Malware payload (Phorpiex)", "value": "0693d1659ff12cecfcc8ac404bec27c0eb9e2251c15a2049dc5e91268bf72e41", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590856, "uuid": "e0168c63-5a55-4b57-9237-fe1c8fe7b2f8", "comment": "Malware payload (Phorpiex)", "value": "9c106028b4e7b237527ddcc7778df2eea5c1b533", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590856, "uuid": "ff1768b4-e192-4717-b802-d92fb0135b1c", "comment": "Malware payload (Phorpiex)", "value": "4dd7db354f9d5d39b07be042c32a2ef3da46534cd3f7ecfe3f69a54c95166c23ca44c5dec927b391853e7c32c9bb22fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590856, "uuid": "749d3ee9-2d41-4bac-919f-ed18022612b1", "value": "T177823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590856, "uuid": "d922efce-a364-4e6c-aaad-b0826dad2010", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590856, "uuid": "adaf1585-b130-4107-bd76-a08738a8b056", "value": "384:QI78VGQic1Kwvw077u9NHu/gBhav8U9cg:BAE0769Zha0U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776590856, "uuid": "5aadd96f-7b77-40f6-a3e9-0d01d9a372c7", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776590856, "uuid": "d7da8c4d-cfe0-46a6-9aa8-0eecbd4d7792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590856, "uuid": "fd9f5e88-c2b7-4bc3-b6fe-aa346c56e15e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbf669d-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624431, "uuid": "f476e363-7cb1-47b3-aec5-e7580f88368b", "comment": "Malware payload (WeedHack)", "value": "e94d3ca1caa9c0844eebdf09c3d79e53", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624431, "uuid": "ba08ba44-2124-4c5c-9631-f78d37e9b979", "comment": "Malware payload (WeedHack)", "value": "06bb94ec71a121a92accda5f916db7d2f57262a3e75ded1421ab5e8e86d6d382", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624431, "uuid": "f824a810-e762-45e8-8224-131a204a64d6", "comment": "Malware payload (WeedHack)", "value": "827b370a703ec559e922805b22a32371d0892c05", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624431, "uuid": "a49dd7fa-d247-4fbb-975a-daa72a559e70", "comment": "Malware payload (WeedHack)", "value": "584d02c0673dbf3af6113838dd2f1a408407efa7742e9eb7337b2fcef11c1699cee912c6162a1aa8d021dc55e9d4647e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624431, "uuid": "7a646a09-3185-45c9-b0b4-073bd2c98cfd", "value": "T1ECE4B787F1208AC7F44FEABE04904310ADB0E471460BF2552B6E895E2FE79C89F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624431, "uuid": "c45ad7d1-db0e-43ba-90bc-8830ff224a49", "value": "6144:RMwMJT7UvC3qKEuVFFo9Fk+DaQLwyavUUhhk1eMX5Uh/W94gpr2TpIRPjhMoB9:rEnoHzuRy/YkoG/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624431, "uuid": "4447ee8e-578a-4824-9857-7cce713e4f70", "value": 692562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624431, "uuid": "287ef9ce-c0aa-4a6d-adbb-f839ed823441", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624431, "uuid": "23d0b299-295b-4308-b571-2c2cc96dcfe5", "value": "krypton-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379561d0-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624449, "uuid": "7def60e7-52df-4025-acab-5702328c31ff", "comment": "Malware payload", "value": "642040079d6cac4c117487e846b623ad", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624449, "uuid": "561fea1a-3552-48d4-93ac-dd77389d5b75", "comment": "Malware payload", "value": "093e660dae6f6d108f3dc291ee4edb3e4d722dcafce3fa3a07eeca3114035c2e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624449, "uuid": "eb26ae73-9e0c-456d-9d2c-c8d5a76142e1", "comment": "Malware payload", "value": "148a240b6c1584f0bfd10ea53ac1c1cfe9b10b26", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624449, "uuid": "86d9d6a1-3478-4678-999f-c4c97999189b", "comment": "Malware payload", "value": "b4cc440f0e1b63b164e36849af14b9a0ee41822e2892a44d720845081c3a5013bcf63e253f4bab5815c9f33c580b3b9e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624449, "uuid": "ef76b5d2-1562-4bc0-83ca-92dc2b3c3ee9", "value": "T11CB4239EC7A01D71FA6AC7718CC0570F526953C490F8A50956B02FE3146C2BBDEAE5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624449, "uuid": "27c6f969-1f8c-426c-a2db-d7df11e25f37", "value": "12288:fVJoAkXQmGeJx4WeKOgA5C6gnxddcDoH46D9PnRHfGgdJlZVWHxoDXxo803:fKQmZJIUZ6YPcDoHJD9PnRfGAZgoXxoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624449, "uuid": "e9cce3f2-7aed-41fa-a742-2bfe8159e19b", "value": 527516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624449, "uuid": "ca09f885-a9e2-4c87-a60b-d63786595c26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624449, "uuid": "1dca0494-7ea8-427a-9619-8ad74bf270f2", "value": "Money_Display_1.21-1.21.11-1.2.8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92990469-3c17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776620736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620736, "uuid": "192d8ebf-d7a6-49fb-9e78-919158664b93", "comment": "Malware payload (Mirai)", "value": "0205b7b02a7b4102d3ead16d035a2b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620736, "uuid": "4eee3df9-b52d-4b2c-bd78-50f8e5653a66", "comment": "Malware payload (Mirai)", "value": "0a826860bdd3c551c7b5318dbf3b5bb1da80570a6de044cb1d6814e063591791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620736, "uuid": "56d4ee29-3226-4fb6-a816-d338babc0888", "comment": "Malware payload (Mirai)", "value": "c3702142c6ea916e660057d0addf47a68ee92891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620736, "uuid": "a92f17c2-dc09-4b75-b5b7-6af88def2e32", "comment": "Malware payload (Mirai)", "value": "fd6373493b4ebad7227a215bb95ee6fd9d10c5c5a94ac537a0e5905ab9cf8f7b2728a1accf8d1a3f06f3aa2b357a2719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620736, "uuid": "29b7ea84-979d-4e39-bfa9-d3e0cdb0bc46", "value": "T10D04C81A9F610FBBDC6FDD3302A90A0635CD955722A43B3A3674D624F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620736, "uuid": "8c37f541-6b28-4c84-a853-a7760151dccc", "value": "3072:lf/xX8Fqn7MkUbk3hobMBEaIXLIgar80Rt3HSU1:5/5n7MkUb2SMH+LIgar8Gt3HSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776620736, "uuid": "bc2b6007-4b9c-402a-9e87-a42fd9aeb3a8", "value": 177432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776620736, "uuid": "6eb60622-ec74-446b-9205-92b2ea8688aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620736, "uuid": "3128b608-7226-47db-88e0-eeda29058bc2", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bae8e2e-3c40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776638119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638119, "uuid": "6553540c-edb8-4326-ae36-31ba0e1b7a37", "comment": "Malware payload", "value": "d0d27bafb3b02fb9b3cd02d47bdfab23", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638119, "uuid": "fdc3d72d-1eca-4d9b-9ab2-621dbd7a2dda", "comment": "Malware payload", "value": "0acf9c98ac5274e2b6a2f55069cf25d117d1b8c17dfc3c6151160bd44475740b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638119, "uuid": "c8549ccc-8fd6-4da8-8b5d-004b901fa32e", "comment": "Malware payload", "value": "7d25c023f51ca9dd2feb87f9e1e2f157f66e211e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638119, "uuid": "56206db0-3800-4a6e-9ba3-30f3881101f0", "comment": "Malware payload", "value": "3a18d867385f7b55cf3a44bd43f2000e7eb7165dfc56830d8293107a529281cf488003828e744b70494ea8d4a567f259", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638119, "uuid": "5fa30c06-0526-438d-8d53-e5de95302563", "value": "T198A57C16BCD018B7D06AA3378DB662A27B70F8194B3233D32E51AA782F767D05E75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638119, "uuid": "a1120c5c-8f17-4384-a88e-cd8ed123758e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638119, "uuid": "3d5e7176-ef1d-4b42-b266-f1b372669d60", "value": "24576:08XYno57iSbBChggWMGebq4hjDjT3TdKgFyxUsqF3IK0ah/9Gizstyxys:08Xj57tChgg5xD7dLFOgBIK0ah/oKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776638119, "uuid": "5f4a2472-5434-4b95-9189-b3b6fa6f9767", "value": 2128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776638119, "uuid": "07c1a7ad-f550-42ea-9dd1-dee97e35b5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638119, "uuid": "96443798-fc65-4e11-8bd9-2a502235aa32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd163bf-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578609, "uuid": "55247aec-177e-42f4-8f6b-372ff0e3e3b9", "comment": "Malware payload (Mirai)", "value": "6e5e03d668f934f2e88fbedd00a31dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578609, "uuid": "7dbbe895-effc-4aba-bc38-e22ca185a233", "comment": "Malware payload (Mirai)", "value": "0b16876e365c657d6cbf5661b867a6751391b3e07a1b05aba1c38c778d071ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578609, "uuid": "3a701f19-f509-4af0-b13f-44f3a6220008", "comment": "Malware payload (Mirai)", "value": "0e3a1850613c6795ef32e83ad5fbc7593e645dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578609, "uuid": "8d1a9ec8-61e3-440c-a9a7-0fb7ce59201e", "comment": "Malware payload (Mirai)", "value": "768c56668c8404803222b486a5c93a6298a1ac3c18ca68341ad651967a89770e39b558b93d64de12a0405362c39707ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578609, "uuid": "7eb133ee-cd32-4116-b44e-595b964efa84", "value": "T18AE33A07B5C184FDC8D9C1B48BAAF53AE936F45D1138B26B2BC4AA171E9DE305F2D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578609, "uuid": "59332dcd-34f8-425d-99aa-86e42cbee9e5", "value": "3072:ADKPkibws4eOk6u3m+MCkLr/KkS0Se23pPSBOVVNE:ADKPkibws4eOk6uG+VZbNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578609, "uuid": "3c576cd9-94b7-4550-bf14-7564873d4788", "value": 146056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578609, "uuid": "759a0754-0de7-4e8c-905c-b55c99a683b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578609, "uuid": "8ff1489d-78be-4df2-bca2-1d52ea76cccf", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59876bc7-3b8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776562229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776562229, "uuid": "845e2cb9-0a7e-40cc-85bf-4f9c9957faf4", "comment": "Malware payload", "value": "b4850c467c89dec98df15e48d3962964", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776562229, "uuid": "2d839178-514d-4c3b-ada5-13384d419648", "comment": "Malware payload", "value": "0b8ceaf49262c601d294a44fc0162fa3823b6e0e6762ff0899a6d054e0979b31", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776562229, "uuid": "291eb398-c265-4e93-816d-3b05ace420ae", "comment": "Malware payload", "value": "b5ae1d1451526b4c3a713b064bfe9c4c6402d00d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776562229, "uuid": "36954e50-71eb-4785-aef6-2c7d3862f40e", "comment": "Malware payload", "value": "48163f6220baf3c68f5436ba80e41ce2c462a1bc5c75b5c82ab8b46e1394b034f57e0ac25b36f977975bf2a0664b3bc1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776562229, "uuid": "21753b25-e510-47eb-b0dc-37e6ae8415a7", "value": "T19A52C6697906CA1811F36731EE97A04DFE1B20BB87751540BDAD87C02F72816E6ECF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776562229, "uuid": "80c29e8f-dfbd-4f37-87f5-2ac4800ac9fd", "value": "192:0aXWvOlKwZDlF/1qxXW5Ahen0qXW+1Fla/tgI+9Kt8QFR+tJz8QTuqVnWoT6/IlS:hlF/1z/aaJ7+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776562229, "uuid": "6413708f-a3b6-4c76-9462-070e1275d00c", "value": 13557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776562229, "uuid": "77b927b5-cbe4-4351-b1d4-4bd0011b7460", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776562229, "uuid": "627abdc5-10b8-4ec4-a902-98c940ead933", "value": "code.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e19f2c-3bd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776591026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591026, "uuid": "763dfc03-eeea-4e93-b839-7061d4aa6b01", "comment": "Malware payload (Phorpiex)", "value": "1690fb52a06e7081ab0fef73ffd4da1b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591026, "uuid": "008fef47-898f-467f-949d-b87bfe21521a", "comment": "Malware payload (Phorpiex)", "value": "0bc6aad1faad13f94a2bba6a927a648fc49327ac224d0abe51530f91eb2d1a1c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591026, "uuid": "cccd253a-962a-42bf-b09a-421d0e8250dc", "comment": "Malware payload (Phorpiex)", "value": "af293e8818619c21ae19c724270d2d1e261a3851", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591026, "uuid": "bbf3b380-f3bf-4a20-9a51-3ac98ce033d3", "comment": "Malware payload (Phorpiex)", "value": "3a7cc1c5a127c49a48c6c08effc7582d7eade0889069207ea050e050beb0943499aaa3d38e4dccbb6b02a6f2e1459250", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591026, "uuid": "59b1051c-fc5e-407e-89c4-e6cf7a479cfa", "value": "T128824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591026, "uuid": "3e18516a-8569-40b0-b9eb-f2b37128d565", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591026, "uuid": "1e00859f-063b-4d49-ba87-de6053a6a09c", "value": "384:eI78VGQic1Kwvw077u9NHu/gBhav8U9cJ:jAE0769Zha0Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776591026, "uuid": "6172274c-4725-429d-b8c3-cd064f51ea4f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776591026, "uuid": "ba55854f-a6b6-4314-8c96-b6b2b8ee9c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591026, "uuid": "1d1db167-bbbf-41e9-ac29-3fca6aba06dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fdc56a-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631134, "uuid": "e78270ee-c91f-475f-ba5b-676e9dec3bda", "comment": "Malware payload (Mirai)", "value": "1edf1360896c7359b538c55a653ea4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631134, "uuid": "25ba3296-17cb-4041-9118-44bdb112cf19", "comment": "Malware payload (Mirai)", "value": "0cc324c2efeb80fe1028971b5769b3aae61955c4d67f51235f0167c40ecefd5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631134, "uuid": "76915768-0ba2-458b-9744-7e6d6d61c134", "comment": "Malware payload (Mirai)", "value": "ce6ea91bf39c6778a17ce83d9f99c12b24e36264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631134, "uuid": "02a77a12-e473-4937-be66-f0bed6831951", "comment": "Malware payload (Mirai)", "value": "62861ed9e02b6810076556cc74d033dd6c287cd8e33f3ae576c46c224a704c0486d039ebee01cb3d3da1db47528d21a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631134, "uuid": "33642bf9-64e2-41bf-9515-72f1bcf5d907", "value": "T12434F7076B958EF7C89BCE3306F6860120CEF4572564772A7378DA5CBA0A64F49D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631134, "uuid": "c9b32759-e55c-40a2-a8cc-7f5225ff86ca", "value": "6144:XpwxGmVxx4YmTz/CZaC5e+1mQ+NC6/DndnVLV9cMA:XRexxszp+1mQ+NC6/DndnVLV9cMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631134, "uuid": "a3a9e01d-5115-4b08-bb03-06c739a4219d", "value": 241481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631134, "uuid": "65500f97-fb92-44f2-ab89-45de718946fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631134, "uuid": "9a610490-8110-49af-99c0-99616783ab49", "value": "mynode.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb6ccda-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642555, "uuid": "3a46bbc5-336b-4f9b-a2d0-800475da5fa8", "comment": "Malware payload", "value": "d48b657bb5dd809e74671326f7760bf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642555, "uuid": "5b8a8b46-7ce7-4d7c-b79a-5002053f58c4", "comment": "Malware payload", "value": "0d757978802c6877b9f302dbcb734cf6c440aef5926a6085a145e114ee98cf63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642555, "uuid": "c6f4436c-2d7a-4c12-be1a-f62f09297097", "comment": "Malware payload", "value": "93fab1b6e27d51ac974995a8206da9d732ca9d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642555, "uuid": "d72108a0-6d2d-43c0-b233-4c1caa4afd12", "comment": "Malware payload", "value": "83f1e8a5e1f531b242293f8a626b99637c116f101b5dadf0a3dbc05322d47ba4238f50b178c565527db11f5f25103728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642555, "uuid": "02342b29-fef7-4522-ba14-6f61cb7ef280", "value": "T14E430274DF5021E58B652E7DF5041402D3A529A098FF6CFA5AE4FB08F6930A1E2BF493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642555, "uuid": "95a6b5ad-95c4-4841-b5e2-b36262287732", "value": "1536:K2nx3WCFQV4AZyYpLIDEEUcBQtrz4bNczHOTsIR1PIO:XnZW4PAXdcBQVoNkUR1PIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642555, "uuid": "58501d3d-5877-42f9-a9ce-55f906f6c439", "value": 58588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642555, "uuid": "9fc1bdcc-5f43-449a-949a-6957ae017228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642555, "uuid": "7ef0998c-a4f4-44a1-bbab-708ca20cbd16", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b88e7a-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776642560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642560, "uuid": "b3c9d3e5-1d85-49d7-b52e-3451f89c2b9c", "comment": "Malware payload (Mirai)", "value": "206b3646593d0565637929dc4f82f97e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642560, "uuid": "909dabf6-f293-4e8a-ab4c-16000f8ba516", "comment": "Malware payload (Mirai)", "value": "105f6f43c438a8d0a75203baecb47062c70b3451be8a402ad7799049eb2c55cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642560, "uuid": "bc328adc-5a5a-41f5-ad73-dd6c1463662b", "comment": "Malware payload (Mirai)", "value": "927fe892c36418f33fee6443c2bcd34d2afabafe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642560, "uuid": "6bf7c542-6778-4ada-88e3-835439e06109", "comment": "Malware payload (Mirai)", "value": "a501956193c71a2887a3a5d217431762b28cff6cb2ed2c0504da6996657c99d260ec9047d7d0d81606deb6b9c83aa379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642560, "uuid": "2f803921-12a1-4f07-aa75-ee78cd60547d", "value": "T1903302AB94D7C3E8D9339D3776BD058041AEEC19D1095B2F008369A37D32A9238729F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642560, "uuid": "e42f59e7-c3e6-40f5-b315-c94d4759e397", "value": "1536:NnqcvJ0ugth89Sa/AyjgbtOrOWI4VQ8vk1E7ZW6GPmaW:NhWugtO9VqOrOWw1+dgrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642560, "uuid": "cff8db34-f070-4a51-ab36-ee668e4831b5", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642560, "uuid": "a4a8a5c8-fce2-44c8-9bf5-2cc890443c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642560, "uuid": "be6efda7-9567-41e7-b136-7dd584e5bc78", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1ffb69-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598875, "uuid": "6f42c7c9-9951-451b-a8a6-c380d4559612", "comment": "Malware payload (Mirai)", "value": "15467c025989df48416e86d852350f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598875, "uuid": "d5d37435-f44e-4bfc-a1cf-b41685b2b1bd", "comment": "Malware payload (Mirai)", "value": "1067416d88581304e7fe8f37da558798026d622d346bd8810b8118d275e90f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598875, "uuid": "3e4ab9d8-5fe1-43a7-8e8c-bb6fa256d9c1", "comment": "Malware payload (Mirai)", "value": "fc8e0dc18a7bf97565314aa332576c1c9bde9d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598875, "uuid": "7fe4c295-0add-421c-b5ca-bd2a734ad80d", "comment": "Malware payload (Mirai)", "value": "6a344cbe5f7d2eab7d7e23ab04ee1e62d02d8ee8f87b0b752bd8345ab66d6646c1b0b926cbda016791ae94b8827b8c47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598875, "uuid": "5cf3c56c-2966-425a-a3ae-6e991e0ae433", "value": "T12A53860A7E21CFBCFBAC863547B74E309658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598875, "uuid": "8389300d-b69a-4b91-af40-9a51ae37a973", "value": "1536:uRRNZTbDuTm/O25BVZdLNCSZqBaCK9xIqgQAez:+RNZHDOyzFNCbjK9xIq3Ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598875, "uuid": "eb7360c9-18e3-4045-936b-f11a428e5761", "value": 64028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598875, "uuid": "b9d4d491-78e6-4a84-b354-82482cef9058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598875, "uuid": "558df40b-3bd5-4425-8448-e9ecacbcefde", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd96de1-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607253, "uuid": "73d9a2d3-0495-476c-8a2e-537faa0ef328", "comment": "Malware payload (WeedHack)", "value": "f4f8b5ec3460fcbae1fb885b4000d855", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607253, "uuid": "3bd8467d-a543-4c0b-a83c-cb755f31153c", "comment": "Malware payload (WeedHack)", "value": "1090a55646c2ab280b56cd01165b7c12294eb6452643bc420647c7294d1cfab8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607253, "uuid": "5d141ede-5f7b-44d7-9ffd-01079011d992", "comment": "Malware payload (WeedHack)", "value": "4eac5bdddbd276e49b1991b33c52bdd436ea6f4e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607253, "uuid": "8590e473-8993-48ac-8bfa-98bfd0488d53", "comment": "Malware payload (WeedHack)", "value": "047df20535f304cb463c01152c9df0f6c86b41bbaaa2a15a5c25ceacd33bd01d8329886b0dc6a90d25c6134c0521e60f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607253, "uuid": "6e2528c4-12a8-4ef7-b2d6-5f1516a7e3d2", "value": "T10CB2C032B454C530C68B3EF5F446A7B5BE290384AA8A2E3B5894F623010FE5C6F36364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607253, "uuid": "5f2cd820-8e53-47a8-8e4d-8c78bdabe103", "value": "384:ie3w9gntlFss9xcTz0IE57dflJ9pBaHn5MQueIZfKcuyJFxW/2MuW+dT:iQ9n5zSAIE57RL9pBunGXeIsctfvWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607253, "uuid": "f766b1a8-391c-4105-b6fb-75e92286c967", "value": 25686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607253, "uuid": "96e2a066-a5af-4cea-8691-c60dcfa791ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607253, "uuid": "9a8a38bb-b426-4e62-a4b5-0bac20a5ae5b", "value": "Bedrock_bypass_1.21.11-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1c70c6-3c4b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776642876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642876, "uuid": "aa7a6165-9e5f-4872-bd11-369e78209ce1", "comment": "Malware payload (Mirai)", "value": "14d105341e1036c1df700965c247fca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642876, "uuid": "c8d530c3-9f57-4170-bad7-95a7258db9f4", "comment": "Malware payload (Mirai)", "value": "12beb3771da4789f865c242118545b0e6e3493022eeb600c481ec203715f6084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642876, "uuid": "01e1dd0d-dd63-4d21-ab9c-edd4b86fb4f2", "comment": "Malware payload (Mirai)", "value": "dab050994ce623668202df6528e2603c4f111e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642876, "uuid": "75cecb73-bbf9-471b-8420-6fe5636ef4e6", "comment": "Malware payload (Mirai)", "value": "5630f533709dab8692dbddff4471dea813523ff0c9cd919ca06b21459d1b747824242c6ec170420e9ac53b8e2518aee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642876, "uuid": "68d915c9-08e2-42fc-a504-795990645537", "value": "T1A782E61763BAAE97C0E0B7B700D307A2E29E9F956550832F7E054C8E5E693641C7E7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642876, "uuid": "80caf3e7-a053-4324-897d-edd3a51bb9ae", "value": "384:RAgE+MigQ9KozEiIoieu7DB1haZpg0sNzx6Ap:RAgE+MigQ9KE3Ioq7haZpg0ezx60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642876, "uuid": "6590d1dd-da23-4659-b57f-7531140a4ddc", "value": 18592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642876, "uuid": "fe5ecfad-46e9-456c-a690-9d0f06b2102d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642876, "uuid": "26329072-e0e8-4ff5-befd-4359b1845a45", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644b23a9-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578568, "uuid": "b686b3a7-9092-4624-a587-f7fe9fb65ba5", "comment": "Malware payload (Mirai)", "value": "b95e1b285eba0d86d9166535debee375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578568, "uuid": "6e0b40d1-31e9-4895-b8bb-d595a0575b09", "comment": "Malware payload (Mirai)", "value": "12cd82618ba56caea4e194d29581386542cd858f1c018504a01a8a1ed3bcac51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578568, "uuid": "410e8445-47da-4b8b-8c3c-e7f1f5fe8540", "comment": "Malware payload (Mirai)", "value": "5c57179c659d56afc984a943502f441a40ed1ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578568, "uuid": "47906c33-f795-4835-8a4a-6ffdbfe3f38b", "comment": "Malware payload (Mirai)", "value": "2988f0c9a0b249ff936c8ac0a1bd4eeff5fe974c7d10ef77ec95246200fc2b68ccc30984a29acc2409353eabe13c8114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578568, "uuid": "2de7a511-f006-4e37-b061-a216b7a6ba24", "value": "T10FA3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578568, "uuid": "bf0ab5ca-c635-441f-8b39-d48f1f5e1fa2", "value": "1536:LvGefaZSdtwa4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSd859zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578568, "uuid": "f5909984-5ffc-423e-ba97-b7ba6c017079", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578568, "uuid": "4ac48f4e-96e8-4321-8d53-b4744b8c6458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578568, "uuid": "d22138d5-a9c8-4b58-9702-d0bf3d1f5b61", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be2e875-3bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595277, "uuid": "fae7be82-a03b-4535-999c-bb595185d73e", "comment": "Malware payload (Mirai)", "value": "36a39924126311815e668da61a183d2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595277, "uuid": "9927a249-6a09-48c6-a78e-4624d0d4eca6", "comment": "Malware payload (Mirai)", "value": "1331641da9e8f87325cd3ae440ed38b97472879a5f3ea5c2ec697639d248551a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595277, "uuid": "d68b99af-dfff-45fe-8a39-29235f62bb7b", "comment": "Malware payload (Mirai)", "value": "55c6c9d7d2f3f313b178071935f3b9e5564737db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595277, "uuid": "199c3167-695c-4ee1-8df2-a4d2eb44cb18", "comment": "Malware payload (Mirai)", "value": "8a84bd6c29850206d1c0fc3df8e968d8a3c488fa2ac2c6a84ac9172492140f74e20f8b305edd5f1062f26a6844bdf99e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595277, "uuid": "8d3f1152-11bd-4d2a-969d-1dbdbff37d8a", "value": "T188531AA7F800E9BDFC19E7378457050AB131F6A606520B337367B82BED761A5046BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595277, "uuid": "e2d298cb-3e67-42a1-b20e-2f1ec124f996", "value": "1536:51dcM+bE7Vp833Py6+caFpEKsEJ8rX+1VOB6nrhNHJFL:5EM+6gy6+BFRJ8b+1VO6HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595277, "uuid": "2397d2ab-0ab7-4e51-8417-fa4d8d5b77e5", "value": 61548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595277, "uuid": "434b363e-638c-4027-9da0-57e5b1c68a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595277, "uuid": "ee94423a-90ec-449d-8bda-a7464a0bf0c6", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d90b824-3c25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776626768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626768, "uuid": "1f04be7d-d054-4cf5-b2e1-1c7798c96819", "comment": "Malware payload", "value": "8eaad388ee9973c062ac1b4d5e50cd7b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626768, "uuid": "eefe3c4e-54ea-49c0-8284-ae1fc66d280c", "comment": "Malware payload", "value": "1495969071446509364a922b070d2a3a3fcf4fd785ca893b454e821ea44b4372", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626768, "uuid": "402a25c7-6944-46b3-8374-a325eaf42ac7", "comment": "Malware payload", "value": "bf6318872eb37d70e92479c160a99a337ed83425", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626768, "uuid": "b6682b04-e757-4a7d-81d1-842ee78c07dc", "comment": "Malware payload", "value": "6e69024df6f5f99e19d8a85ea425e7cb0201c130abdb5d2bb7c32d937e02ca53a422855aa21e3cc2e983f08220d7a906", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626768, "uuid": "71643d95-a192-4649-900c-f3a1608b4973", "value": "T12D141393910E0C24D61B8731469D13F3CF3E0EA48A141D5F14D5A62FAE51ADCFBECAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626768, "uuid": "cb421cf0-2095-4e8d-8da8-bf5613b1ba80", "value": "3072:jZI+FKbYMvL0Nb+m2Dvmx4MJcGPgLNKHZUzv9uJNTr3ZggKlxBw1rLB1Tn7:jPcYiL0Ym26x71oBK6zvcRbLB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626768, "uuid": "62a6ed28-1636-4287-bd9c-aea135a64fb7", "value": 198188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626768, "uuid": "aa6b1a55-002a-48db-ba9c-22177928324b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626768, "uuid": "399650a3-5497-4233-8ede-0665e00f3281", "value": "fps_booster_1.21x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b1dc6d-3bdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595607, "uuid": "2e9cb67e-f32d-41ae-8533-17fb0bcb1dd4", "comment": "Malware payload (Mirai)", "value": "91a3f0257c0d2f23cccf519be740a5f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595607, "uuid": "4ece89e5-8d60-4cf4-a143-49526e55d627", "comment": "Malware payload (Mirai)", "value": "1732bed0f562480c7a711308e6561e72b17ed78d0d9b631c08ca161df838d47f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595607, "uuid": "11e0dce5-ab9c-48f1-a979-ff1ed0de530a", "comment": "Malware payload (Mirai)", "value": "fa2ceadb3911ea273eae5128a66915cd437456ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595607, "uuid": "2f20d5b0-aa7f-4b92-9b6e-291d53c9e3f3", "comment": "Malware payload (Mirai)", "value": "519888c7321de02b89b7b6cd4d19891654be56b2bc9b404005a2d485c86f85682e8dd15b44f138fc6dc055be6758bc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595607, "uuid": "0a2560a7-a345-4f72-a292-fbc96f34bd8e", "value": "T1A8D32A56E7408B03C4D22779BADB42553323AB54E7E723069928BFF43F837AA4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595607, "uuid": "5478b865-87da-4182-973e-d38360e49810", "value": "3072:BofZvBgAMSJHcCDa/La7nb+yx/j0InM/9czn/sQJB:Bo1eAMSJHcz/LaWY/j0IM/9czn/nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595607, "uuid": "56df14d2-6c5a-48f0-a9dd-c951505093fb", "value": 136062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595607, "uuid": "8c08efa6-27ba-4203-b830-b67ae713631e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595607, "uuid": "247313bd-604b-4c87-ba2b-7c64aa3dfc49", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec91150-3b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776565969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565969, "uuid": "7a4e7584-e6b9-4bcd-a09c-976aa47323a4", "comment": "Malware payload", "value": "7fbd45269af50bd0b7893a02fb27b953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565969, "uuid": "f424caea-53b4-45ae-8b22-89ed7b2c878a", "comment": "Malware payload", "value": "176a624edb2a258fa663313b21e82734186b63be253dcf4d625aef427a388a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565969, "uuid": "fea6457c-3ef0-4776-8721-17095db695d7", "comment": "Malware payload", "value": "f9926a07a8fbf2fb0da90eba54c94acd61a3072b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565969, "uuid": "5a5e5602-e090-4d10-b0cf-deb1dcbbb55c", "comment": "Malware payload", "value": "5a3fbdd1c7b8db5c88d8b036cc7d215451c5c7108232eb6db4eeade574b09b19f15d91a00cadac644701d64d08f8268f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565969, "uuid": "6eaa1a75-52e7-4fdd-9025-bacb6a09ccd3", "value": "T1996331E57AD55C86EA74A37C22E9D131363CFAD08A534B07D52026321F13FD13EE968A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565969, "uuid": "5280bdf7-8b1e-4008-9b65-38848b759fce", "value": "96eda8242177dc601e0af82a932a7616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565969, "uuid": "da5e394b-3485-49d5-88e5-2eb2389d7ca0", "value": "768:65j38vr9UQAZvOYh8ek2C3Vt21xVzp8pDbQN5zqWhB:65jseQAN8ek2kBbQN5zjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776565969, "uuid": "279ba79a-9020-4cb3-ba1e-0af294f162a2", "value": 69977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776565969, "uuid": "8210debf-13a3-4980-8510-4a5ad85ac553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565969, "uuid": "d3ed4570-d3c3-4520-b6f2-00d19323ec8b", "value": "tsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db8c58d-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776642579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642579, "uuid": "1a2af059-55fb-46fc-8d6d-6a3ef8441d84", "comment": "Malware payload (Mirai)", "value": "15db6e485265e0120c30134f1448bdeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642579, "uuid": "d3b2ec6f-88e6-4edc-9b34-1e1517aa8847", "comment": "Malware payload (Mirai)", "value": "1a1317c01db768789731f80c7c253cc06f0f7a81222d368e4332bf78b2fbe7a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642579, "uuid": "e3b19b41-ae33-4f4e-8fa2-53498c4d097c", "comment": "Malware payload (Mirai)", "value": "b70b258d4ff7734bbbc150892b6458d985524085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642579, "uuid": "89164437-ea54-443f-892f-019d92591e74", "comment": "Malware payload (Mirai)", "value": "289b2eeb0d703f1e4ec791f49e8224c0e11b6304eb828f686107868a7d164160167374c335be106a14f2672e1a01b5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642579, "uuid": "8b70af1b-27a7-4ed6-9087-762d805e10b5", "value": "T114D36C17B5C0C0FDC8EAD2B44BEAE226EA33B8291135B21E27C46E275E5DF215F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642579, "uuid": "42e413a5-5b38-439c-b2d8-dfb1a37d23cc", "value": "3072:JVwQn16b+b112f1EgP6gcUPYYPiLZT9oajRZEE:3gDrhIrEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642579, "uuid": "a2da68c8-e113-4109-bc31-45389a6b769f", "value": 139208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642579, "uuid": "a299e113-3f4b-4149-ba9b-4000c8ae85cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642579, "uuid": "30b67395-0d1d-48ca-8244-1f4eb709fe49", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4787b2d3-3bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595270, "uuid": "f387a168-afde-4c33-a696-4a01f9ce4b87", "comment": "Malware payload (Mirai)", "value": "6250630e092b61b50c00744aec4950dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595270, "uuid": "dcb1e231-3066-4edd-aa3e-4e98eb977e6c", "comment": "Malware payload (Mirai)", "value": "1a878d78a64deab4c96f22f28f3dd7424d337916dc540df86d71d3bd7fc3fcf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595270, "uuid": "48e85373-f873-4657-a940-85c39fb25a87", "comment": "Malware payload (Mirai)", "value": "a37f064f3e09317d685da8f550b448a83df264e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595270, "uuid": "2d7d3c1f-572c-4ee2-8eb9-27219d8cb303", "comment": "Malware payload (Mirai)", "value": "5c46f60539e66ed47484d5eebef47e6bcf256623b144298e01267a32efb87712cd8028ff512be59dd8d734d0abdd518b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595270, "uuid": "f265f1b0-abf5-4670-9b10-e07cbf83cf98", "value": "T13AB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595270, "uuid": "9157f618-783a-413e-a6b6-1bc0ec80ed1c", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg11/LWy:c9sSyzz36YaWWgg11q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595270, "uuid": "b4674728-5306-4089-889d-85d0ee5b544f", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595270, "uuid": "c20bf2f8-d10b-4c35-a9ce-d30834b241d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595270, "uuid": "32fcc51a-e3d2-4581-bd23-bf45858f895d", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1047b11-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578374, "uuid": "a5e29b70-8a01-4ed8-be1e-eab1c1e137cf", "comment": "Malware payload (Mirai)", "value": "9b43380d5530af77113ae94cbec5def5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578374, "uuid": "27c57711-9452-4c84-b953-a23efbefb043", "comment": "Malware payload (Mirai)", "value": "1acad9cead7315de7ccdcfbef56d115d15968b7c05702889a71b1ed32e0068d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578374, "uuid": "8d347a2e-2388-4038-b9eb-04a13b2c32cd", "comment": "Malware payload (Mirai)", "value": "a5cf6c6ea0b8078da96e362aa2e7a72d39bc50ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578374, "uuid": "a46b6bed-27f4-4b6f-afb1-35e10446c08e", "comment": "Malware payload (Mirai)", "value": "75116bed24b2be9f822a4d3f06d5c7a338c1f6e5cdd8544e85d61c68cb6f74b8b903c390ac36a7cffa016874f13fc8c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578374, "uuid": "9f7f4200-cb80-43a8-81dd-164d26d1c470", "value": "T13BA3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578374, "uuid": "cf96b3c7-a342-4947-99f1-aab77b31c219", "value": "1536:yk8NZJjWAadPCcve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBadazhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578374, "uuid": "a2318bab-5261-480d-a966-0d5eaf7758ab", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578374, "uuid": "d8271b0e-2458-4f68-a9a2-d10578721e04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578374, "uuid": "0a14c197-5b65-4d4e-a246-d151891742cb", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91d5a94-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635377, "uuid": "4414d070-ec9c-4f16-8af3-15b4535d3cfc", "comment": "Malware payload (WeedHack)", "value": "df0aecc50b67de8ccb43b739e2d243d3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635377, "uuid": "5fb1ac73-738f-4f63-a7bb-9763d5c1dc53", "comment": "Malware payload (WeedHack)", "value": "1ae22b1d20837db500163e32d33cdd738e7fad4852e2f815a91c582b15bf2281", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635377, "uuid": "62ff714f-b98d-4012-b29f-acb107f9a43e", "comment": "Malware payload (WeedHack)", "value": "4f31835750e7f97f8356b17de482a19789b2107b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635377, "uuid": "d6133bc8-5a93-47d9-b384-213a8d605a1a", "comment": "Malware payload (WeedHack)", "value": "35a70bd52369db283545980ec00d25254b1717566144709de8c83a3f393dd2e82cf3ca250d02cdb6f325db21fff64911", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635377, "uuid": "0a9683f2-d3b5-4cd3-a25a-a5f44d09f9b3", "value": "T1BBC2C068BAA45124FC4B41F681D7FE71F89F1AE410DB375620E4AC164BABC8D4F447A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635377, "uuid": "bd2ee1f0-f301-4c40-948f-d4465cd450f9", "value": "384:33w9gntrcimWkrc4UNgqoAMdVKWsdBpuF6w1xfk+RxjyFS0v9S7yyBBdu+DnDtv9:H9n9cBWkrc4UaJuGFfzc+Pjys0dMLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635377, "uuid": "3e7f5e2f-a1e5-4d4f-9fcc-ce19a9eb13ab", "value": 25723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635377, "uuid": "6001a296-9375-45f8-bd6e-142139901267", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635377, "uuid": "21106c9d-85f1-4886-a07e-67afba475094", "value": "claudeproject0.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb6c2d2-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578424, "uuid": "1f6f88d5-0fd1-4b6c-9d52-8b5976a241b2", "comment": "Malware payload (Mirai)", "value": "cb6a59f984c3837ff1664704ca2e22db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578424, "uuid": "8effe368-439d-44b3-a5ad-1c3bdc6dc9b4", "comment": "Malware payload (Mirai)", "value": "1ca57b3e1df5e012ba97a8a75ec2dc6c3ff62c43dd597e57b1168335ca1a9c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578424, "uuid": "a2f7da8a-0e6d-467f-9fd5-7e17f44ade77", "comment": "Malware payload (Mirai)", "value": "1fd555c86b3650be4eddc88e62e87f18569d6928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578424, "uuid": "c752c472-d90c-4172-a3a0-591eee3eb2da", "comment": "Malware payload (Mirai)", "value": "5e0e9d95208c634ae141b2a2e8b2e98c0692e3b30fff0ca178f16c237979558d93eb8c51a4154d305b10c997348239ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578424, "uuid": "3f407338-f4f2-4ab3-889f-92c9d70418e2", "value": "T19303E13C4A0904F4D97AC17BE2ED47A0B136075D1541CE562260F6A7EA0E8EC78E6BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578424, "uuid": "2cd91dde-384e-42b0-80a0-27e3849db5dc", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P59BihJgGlzDpbuR1Jb:q9xJZZNKNFjBfRUM1izVJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578424, "uuid": "e5cc671a-abdb-47f4-a576-7a6bf24e7af4", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578424, "uuid": "1e30a9e6-1422-4257-9e7d-2d931b6a014c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578424, "uuid": "a8db1aec-d1ac-40fd-88e7-d6fa1b581ce3", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b446d9a-3b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776560621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560621, "uuid": "e935718a-8741-444c-a030-352ad827f3ed", "comment": "Malware payload", "value": "8cce0603a8353d675fada381d6bdb3a1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560621, "uuid": "96970697-ab6b-4954-80e8-c4882c6a2982", "comment": "Malware payload", "value": "1e46bd4826386f3a8acf5dcbd14da06def25f23e2a9649156c6830544922dd44", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560621, "uuid": "7d2d2097-268f-414d-9871-129738ca5269", "comment": "Malware payload", "value": "dd1ca64a0f02377e9dbcf1700bc4ba2d07459394", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560621, "uuid": "2cc23f57-1140-4bec-b496-d331d76d949d", "comment": "Malware payload", "value": "381233f31f016b89f7cdf80c90053af67d4569f0ea9e75c014d78230df974a293d9105bfd0c0308524a53b427dd3ff87", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560621, "uuid": "8384b78d-df41-4fd4-9509-f35dc421adb8", "value": "T12982902A3907CA1911F3A322B947B04DFE0320AB87652640F9DD86C51F71959D6EEFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560621, "uuid": "e637ff1f-0bac-42bc-afec-fff4de687012", "value": "384:YEClF/yKBuE7EUENinrJEmEHEeYEyJ746E+7T1e9:rZoIvWraVkMy0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776560621, "uuid": "7612635a-eab4-4c4b-a6da-8791ec58e31e", "value": 17875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776560621, "uuid": "5655d553-0692-4aac-929d-9fe674118d6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560621, "uuid": "0890199a-3b88-4e4b-bf22-b8af015957c7", "value": "file01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66efaec-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598919, "uuid": "0fb829d1-507f-48f3-b8e5-7fb129c37b2e", "comment": "Malware payload (Mirai)", "value": "04c0b5de172192d14bc41053d71dcbff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598919, "uuid": "0a3420ba-f2a3-40ec-9543-26b8beaeb8f4", "comment": "Malware payload (Mirai)", "value": "1e93a1b045d266e2f6ef682e3a3adaa6f1bad57374cb0bc6f7f3217bb97bf379", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598919, "uuid": "8413f8e4-b781-4a97-b73e-e171368f87e4", "comment": "Malware payload (Mirai)", "value": "8a69c0f83d58e66f26d0f455f9655dc200cdbe84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598919, "uuid": "4584f20a-2833-482b-a389-4525e6467afb", "comment": "Malware payload (Mirai)", "value": "702fa751d6af42ce3f1bf9fe3e705ecba43c58cd09a676fe89f3f8fb98e9ce917b2b24fb8a1ecf52ffd2694c8113805d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598919, "uuid": "4373b915-63b9-4f05-9b0a-eb8f7e62b492", "value": "T15CA2D1BFE8D64997DDAAE43B011D00CA50BB5C5413A783C23FA535B389778E8F836680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598919, "uuid": "83dc39ba-1bff-4047-a001-83ae8a930ed2", "value": "384:MccDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/rW7MM+v1RpH:NMkKJFH39CBVQey7qsZoMTC7EpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598919, "uuid": "87c6a288-4a92-4be5-9835-e0c24c4b34c9", "value": 22448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598919, "uuid": "b1b176de-10b6-448c-8322-e5ad2e698fc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598919, "uuid": "f278429f-4339-4080-b4ba-323c681457e0", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc9ab9d-3bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776574426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574426, "uuid": "f04c9b10-0357-4664-8141-7561ccb272c7", "comment": "Malware payload (Mirai)", "value": "de967d1c76068cc8a06edb56ac3c4331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574426, "uuid": "f757b58f-8ccd-4757-ba97-3c250dfdf1a6", "comment": "Malware payload (Mirai)", "value": "1f2553a51260340b846fcef1afc358c2207cf69d22f85e166e36e8d8ac630b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574426, "uuid": "cc675805-6157-4a2c-ac86-badd01bb0cc0", "comment": "Malware payload (Mirai)", "value": "bced8b631b4c3a26fd7bfbd1a99398097154e63f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574426, "uuid": "a9b2005b-a847-4a51-a93b-d3598547c737", "comment": "Malware payload (Mirai)", "value": "104326dab699218f8f0b56f14319cf7ed96b65aea9268327dd821312f02438e1036b2409305e074beef421059933b89d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574426, "uuid": "1286a382-6f91-4246-9170-a5de0d6b035c", "value": "T1D054C661D54CC983C163167DA1EE9FAAAB3B73DA2786DE017C9466702AC2FDB1D07C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574426, "uuid": "adc8687d-b98d-408d-98b0-74d353f4fea7", "value": "6144:HYXyjzP+r+awON7QiAuAITp7dPieGM/9Jm7wMVkgQ4:HLPPs+awON7QaZfn/nm75VkgQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776574426, "uuid": "382df445-8ff1-4ce1-a758-542cdb206750", "value": 291616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776574426, "uuid": "b0f3f109-4dc8-4919-b573-7b611e57aa09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574426, "uuid": "569f7e9a-b6ec-43f1-af68-9083a90b5717", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bba8857-3be0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776596888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596888, "uuid": "d7376caa-aced-4020-b208-51c4952d0cd2", "comment": "Malware payload", "value": "4bcc0e24d73933adab9c782e73d0c433", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596888, "uuid": "686184e6-072f-4b4e-aefa-441913954f14", "comment": "Malware payload", "value": "2076b25f660103dcc55c9b47b89b7a3fa6a0e5a2210a7479d64f6f5872580bee", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596888, "uuid": "38d9f4d5-d057-4e98-b062-95aec679f508", "comment": "Malware payload", "value": "24823e5d80b1ab5e74e195c1e647392977a6511a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596888, "uuid": "34e8f9a5-400e-4ac7-aa3a-541a1f100d74", "comment": "Malware payload", "value": "a9d210ce1e2797ed6c170d9f8ba95f13df2879c09b0f13794ea2bd09136044dcc123feeb240e66fe1ba5b57acb5f8d12", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596888, "uuid": "a0c2dcf7-6d54-48ba-959b-789bd6f2284b", "value": "T16BD300DB1B9D8CFC868BA518812FDC47D5AB4527059DC5607ADDED883F22F2235AE8C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596888, "uuid": "ce5bcf52-4c21-466b-b429-b0f09dd1fe4f", "value": "768:to8z/Al0DOrVXDZ2afn2+Es0NcX/nbSWHmO/h/D5mfIctXdPO8Vx5eCipGLMcNJI:zlye49PBHp6UYKwLVOl5muJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776596888, "uuid": "8a1aef9b-f10f-4052-b8d4-cc9f2fe3b437", "value": 132593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776596888, "uuid": "ea0e7c94-4a2f-4279-828f-2de657840873", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596888, "uuid": "8d7fded3-5e0d-4ea2-b21b-3555b54889d2", "value": "Notes_Backup_v9.6.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec11ba3-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624515, "uuid": "13a775a6-4362-4e24-a417-8010c39f59fb", "comment": "Malware payload", "value": "a5b2a71f445164a73055af88d3831cf1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624515, "uuid": "2550cb9f-38de-46eb-a2aa-d63562dbf7c6", "comment": "Malware payload", "value": "2127fbfb9d1642c634a5c4e348cdc5e86b12df2a9ffb0b49f1b5c292284db882", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624515, "uuid": "fa2de0c5-e655-4ce5-9096-0f1b18159f30", "comment": "Malware payload", "value": "064d0295910c9b879945b3239a6346ef764c7be3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624515, "uuid": "c61f0837-9517-4a88-a7ef-d06970c79e37", "comment": "Malware payload", "value": "9d6acf49d551cb544768c6169a617f5da5d8c67249ef7214b053ab22c642d1da507ed06c6eebe45835c6e55ddb887041", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624515, "uuid": "8a292fb1-6c71-4865-bef0-896b06aee365", "value": "T1B5B4232149804E26D81128F679EE6982A7D70695E949EC1DABFE1F9F337F1308F064F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624515, "uuid": "50b1b414-3e92-45d5-8fbe-db2363361e66", "value": "12288:f/xsiF+ckrIQO6gcNEJF1NwfxGX/t0Zx4tj7HsZFRU:3GcqngcNmwkt0/4tYFRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624515, "uuid": "b4a1aad0-8bd9-42c1-b043-06f48c645bbb", "value": 496926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624515, "uuid": "6c0d96fe-7d28-47b6-a1d3-15f43a93b3e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624515, "uuid": "2d291120-d7a7-4ada-a72e-a148eef0a112", "value": "WhiteBlackStashSchematic.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c10b33-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578676, "uuid": "8ef5af8b-b867-4c30-b659-5a8a92f4ee77", "comment": "Malware payload (Mirai)", "value": "49ad51859bd700cce75e70eb5617e580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578676, "uuid": "ab44baf5-f184-4069-9ee3-e5df3188637b", "comment": "Malware payload (Mirai)", "value": "223f9ec114cd1d0ba13c961546a4337caa719c45bda369c8cd3cff43e9cb9978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578676, "uuid": "90252620-1f65-401b-bba4-0c8e8c338edd", "comment": "Malware payload (Mirai)", "value": "88f4f0860e2704bbfe346cb7f1f608a6881095a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578676, "uuid": "106f63db-c202-4334-81cc-7fc4a7d69a18", "comment": "Malware payload (Mirai)", "value": "fd3dc0c7962de66387e423d4a22fb64037fd6a2eb15d0092ea382d93a456c22f115fbedb00113a81eea5197998c5b7b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578676, "uuid": "3b563684-e57d-4d93-a88b-fc2b1a7d3eba", "value": "T194733985F987C6F2C407483042ABFB3FCB32D8A511A19B4DDF569F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578676, "uuid": "6b875e7a-6354-4935-90c9-f49d9fff40db", "value": "1536:8A9Uqtm/qzBpeKm2XpQmj7qWSICRzBbkivom3aJ2idLNn:8A9U7KBcKm2Xp3jnrCRzBbVvfidLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578676, "uuid": "15da97d4-78d4-4633-8a29-6e1017562861", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578676, "uuid": "6c3032f8-30fe-449d-a1c9-436c882c751c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578676, "uuid": "8c10f22f-06b6-4157-a5e5-92155d2601c1", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d655565-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578637, "uuid": "9fe0590b-bcec-4561-9ead-549d549d8cfa", "comment": "Malware payload (Mirai)", "value": "e5d87d51e122351bd722faff46489c3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578637, "uuid": "d03ed096-12e2-48b4-9d16-f8a5f07bd203", "comment": "Malware payload (Mirai)", "value": "23ee58a9eefabf309e242b69dccb1d76435ae1e9e689b72ce8b18e0e9309f59a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578637, "uuid": "9078b082-ff10-4adb-a956-02dd09914b2c", "comment": "Malware payload (Mirai)", "value": "306c485d5fa8d620d0bbf5b739e7d4b72729992c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578637, "uuid": "04e5162c-b482-4e1c-9a09-b6f914d12240", "comment": "Malware payload (Mirai)", "value": "62a2fcf0fa81fe409569c87b6fd0bd3b4e0ce2165b76b3746f3850fbfadc92210acf916f3db74a7b4cbc7d426e990e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578637, "uuid": "afbc3195-0e54-498e-9f2e-c06b619eebd7", "value": "T17B04C616AF650EFBDCABDD3706E9070539CC941B22A43B353674D528F54B90B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578637, "uuid": "8950ea31-1f7e-41f0-abf2-d77f7c429532", "value": "1536:j7gUtnpni/FWwJNOw2++BN4WuFw7g06j+jG6dFg9ExIZ7dWylon5/TSn2D/5RLSM:vgUtA/MvLyWu7WFtI1e5/w2HkOC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578637, "uuid": "0d54cad7-3a72-468b-bf9d-0665821f4d5c", "value": 186028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578637, "uuid": "dd501d7e-9668-4899-af1f-9d78415a6181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578637, "uuid": "92d56e19-1872-4863-9553-55195827deda", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4e5c3a-3b93-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776563952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563952, "uuid": "d387cbe1-c957-4ab3-9ff2-0ac4e880da6e", "comment": "Malware payload (WeedHack)", "value": "2dd3c1f95366d255929a66307c393b9e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563952, "uuid": "c6200e4f-8bb7-4eec-913b-ac5b7478de7a", "comment": "Malware payload (WeedHack)", "value": "2469b2b04b412f9a729f9c3359316a1b703c7478f0aa291968fcbfe48ce976b3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563952, "uuid": "a0d1ae86-4943-44e0-9dfb-c127856ed43e", "comment": "Malware payload (WeedHack)", "value": "3ed55b1ce44c29ea5d3e082712f2c82eadf232a2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563952, "uuid": "4d163dd4-37bd-46f2-940a-a6fa22cfe654", "comment": "Malware payload (WeedHack)", "value": "325fd8c2aa1f235fee1fff6f6e05578cd18c5e0aaa9e24b5e1fc4e32edb633a6ed05a8af9174c50eed0d1d1ae12502c5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563952, "uuid": "7a673efa-a240-43ab-a654-2f310b04529d", "value": "T1DC03E16BB45B8C01F615EA733B1268C5175D0BE393EA228E2D72AC936C5C1FE56057C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563952, "uuid": "297ce404-4577-4707-affd-dca461d3ced4", "value": "768:ynU6BhzSq/rcS2DC8ZE6Ny9WqNd+/DrHt9XURp3UaKPrgbeBE:MU6Tz1/6tZECyR+//XxaAnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776563952, "uuid": "36a6f10e-3431-430e-aa8a-482e738682d9", "value": 40512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776563952, "uuid": "96d6a323-240b-4e01-9f8f-4586cc17dc75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563952, "uuid": "321ecafd-206f-442c-89ee-fb4396c1d8dc", "value": "KryptonPlus-windows-x86-smacks837.temp.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e124d33-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635358, "uuid": "99cd4123-7c32-4016-acac-92a8df3eb987", "comment": "Malware payload (WeedHack)", "value": "b1d0e2cb190671a498f25d3a632dc0c2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635358, "uuid": "beda43f3-96a5-4023-9c96-70eee94ff861", "comment": "Malware payload (WeedHack)", "value": "25b809623f3c6cb8cafd61f4dc6e92b8154f041002dc40c2792d4b6ca16f2978", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635358, "uuid": "76ff39cb-3376-498f-91c4-62dc1592e675", "comment": "Malware payload (WeedHack)", "value": "f6f4b2e376c45fa4cb72ab513633854c12287cf9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635358, "uuid": "6cdd2c04-700b-4ba7-a894-45313cf03e4c", "comment": "Malware payload (WeedHack)", "value": "33918507dbe1b6f5629fa071fbcd4f07e757de43e62a8bfb889ec16e81adc8ffdbe6d1e0f6e93b1171b00d3842e50be9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635358, "uuid": "4d3ec7f4-88d2-414d-bb40-4f4d1b41d03d", "value": "T109253366671B1394E88F072854796A0B9338DA77F461163076AB838EA735DC7021CBEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635358, "uuid": "caa7876c-cfc9-46c5-a755-33008f762bef", "value": "24576:ec0pWj8KwPBiM0iJt4KUhu66KBdkUiAm7aQuUz5:+pWP6iM0UtzEuY4CBUz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635358, "uuid": "d63c4fe4-57ec-4727-ba87-98afe441b475", "value": 1039852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635358, "uuid": "1692b9e9-3ca9-4442-b23c-1d8b21cc4736", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635358, "uuid": "c9fb761b-24b7-4d58-b4c5-436f1914351e", "value": "3118f886280940f486d57620b09572cb.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea839828-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578363, "uuid": "8759759a-ff7c-44e0-994b-dda24d39ac3d", "comment": "Malware payload (Mirai)", "value": "b7db6f2c8e69f3fadac6791ee949c9d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578363, "uuid": "70df22ac-b59a-49c1-8fb7-f01e969f004f", "comment": "Malware payload (Mirai)", "value": "2658ec8fde3c4d30cfba133473b4d3c5b56e0a04309224922cff3d3607ff9bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578363, "uuid": "abb1810b-4676-4440-bec8-698c5572f4e6", "comment": "Malware payload (Mirai)", "value": "85ca154a78cd87380084cf55a92faa6d71440c90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578363, "uuid": "aff1e2ba-8440-4e00-b2d9-f616d5b3988d", "comment": "Malware payload (Mirai)", "value": "4fa403e13884d0903d5d30c573aa98be47b804f01efadc1f36e3ed5be96a9126c06b3db4f21dae5284ac1b2a8b569a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578363, "uuid": "4e621401-980b-4e58-ac0c-6ea7bd904374", "value": "T155E2E1602147B871DEB1C83D9DBC8AC574B287B8C6ABB3E62D1415A933DD40C8E7954B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578363, "uuid": "b24096c9-d30a-4829-8a60-64009465de2d", "value": "768:peBsVPxhgkswU/uz5uJyLb6fLwfAlu37UJX2s3Uozo:peGVPxGrwU/uz5uJy30oAo3Itbzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578363, "uuid": "ecc8ab75-c3f2-448e-8bef-5c3e2e3ee426", "value": 33872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578363, "uuid": "f84a9cf0-d214-45b9-b51b-98e144edb78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578363, "uuid": "55ff32e2-f4fe-4693-8b29-f778f3649914", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94344faf-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607424, "uuid": "e0fcb12f-16d4-4c2a-a803-fe6446d26765", "comment": "Malware payload (WeedHack)", "value": "f7c16ca9af15591312a8bc06b2132cab", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607424, "uuid": "17350e87-bdac-4336-8403-0d4f70011fbf", "comment": "Malware payload (WeedHack)", "value": "26f5c3433509ed805beb79f2b77f69761bd36ff37d406420bc3101671e0dddf2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607424, "uuid": "4759e01a-3e15-4d00-a097-ceaf5a9eb47a", "comment": "Malware payload (WeedHack)", "value": "c593155ef5b2e8be5b88d7c37ad9afc01fff0acd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607424, "uuid": "aa1e8e71-7f2d-490c-adc2-3ee54ce3e9cb", "comment": "Malware payload (WeedHack)", "value": "3db5b1dc7130a75ac70734d326ec375b6d66ed4f7622a12ea03fbcf415e066071197502f0f329af120da86b2c8cc50bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607424, "uuid": "5f6598f6-6bdf-4b2c-b80a-84812b666e95", "value": "T178C2AE2B6D9F3CB4F63619769E8A655B6F0E4B0832C6405401EE23E71D0CC8C5E86FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607424, "uuid": "e4b97a03-2745-4377-b92b-92593ba41ef8", "value": "384:90/S2FXzNamYr6lUViIdgInumQhW9s0J0PLsDER5Kz/Op67pxZ1TS137xiUgPrNY:9v2FXFtImIu5W3J0PLRw9b1TS1WPrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607424, "uuid": "ed4afcef-7ebb-4d20-aee5-30be7f149bb0", "value": 27618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607424, "uuid": "31d3c4f6-c9d3-4095-a481-4ff8b50e4652", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607424, "uuid": "7e6c7390-729b-473a-941f-f05979aa2818", "value": "QurgiusWeapons.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843e5225-3c18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776621142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621142, "uuid": "e275b047-a5ac-42a3-9bc8-eb56badd3e32", "comment": "Malware payload (Mirai)", "value": "0f1f8f3ee0c2c58a52f7f86dba0cb7a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621142, "uuid": "8b6bd796-99b4-4c33-b9f0-4a1c99f9d143", "comment": "Malware payload (Mirai)", "value": "276238b972704f2ef5427c7cfa4dc70488360cdea14c11e1ce0f1cbe4dd3ba99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621142, "uuid": "787d5229-8225-4ff4-b216-24fad004bf55", "comment": "Malware payload (Mirai)", "value": "8b6153795cf7770df59249509e1f2612b5ba3fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621142, "uuid": "3492ee8c-7ced-4934-835d-23b8b579ad87", "comment": "Malware payload (Mirai)", "value": "a366e584b8169d06d73acb626b0f8fbe15fa72e927a8c453bd60483e06c77eb36fc3c239787fa1f68af1677ba5a0f1a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621142, "uuid": "09005e99-e2e1-409a-80e1-dd65f0df3b63", "value": "T1F6C30549ED416B11D5D636FEFE4F028973530B6CE3FE7201AA245B2123CAA6B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621142, "uuid": "2d7d91bc-a5fb-447c-93cb-a5dd4cd907b2", "value": "3072:ifCCYBf3+Yfc6XjRak2lJdO3YAuM6xPrAx6bbnPbbE:+JeWYfnTRak2XdO3YAuddAcb7PbbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776621142, "uuid": "16467bc4-1924-4d45-93af-a8a84a16a80e", "value": 118260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776621142, "uuid": "73355b7d-7064-4c84-979e-479038628ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621142, "uuid": "dca8c735-564e-442e-b10a-c150c7b440df", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d58347-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578567, "uuid": "76776dcd-d4d2-4aba-8ef1-3b12567b7e2d", "comment": "Malware payload (Mirai)", "value": "b711099cbecb4b9e45dd8d2556a835aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578567, "uuid": "ae1d8c02-1ca6-4ef4-a6bb-4d8a47b7781f", "comment": "Malware payload (Mirai)", "value": "27aa65743e6ba3d9b25375722c22f6273e2bf14048e4128bfdd06f572b72541c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578567, "uuid": "b8f2b3f7-62e7-4fc3-8030-93dc24a052e0", "comment": "Malware payload (Mirai)", "value": "1468fb58a538d2575647f08ef6edf3904b88d75a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578567, "uuid": "1aade192-64bd-4dae-a780-5ab750c77612", "comment": "Malware payload (Mirai)", "value": "3064d71f23f315eb863d523e5e51852b88233c4b5a5eb0e4285cb9e4fafe2b6648f61ab16f7e76046933fe66b0773f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578567, "uuid": "8c0f0795-a165-4083-a6a4-a117038d1c05", "value": "T1FB936CC5A743D4F5E85701B55137E332A733E03A602EEA57C3699E26ECA1950DB0B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578567, "uuid": "303ac910-993b-42f1-a0ef-e54f539ab094", "value": "1536:7apQddvjjh+C3blBFRC0orLldtPzU/8fnqmy5r40YINSN1FN4iGnC:2pQjvjt+C3blTRhorLlvPASngr3VkNcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578567, "uuid": "761b73fc-54a0-4cfe-9366-cdefd712e4a6", "value": 97548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578567, "uuid": "f0394612-3e3b-4292-a25d-ff244c661aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578567, "uuid": "82153313-3cf0-4f95-8d7c-fd502ab57ff2", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a080facf-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607445, "uuid": "a9a11b50-b141-4831-b002-f4ef967b04e9", "comment": "Malware payload (WeedHack)", "value": "d3ce33c3c969d7639f1384a30cddb71a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607445, "uuid": "72abbcf6-74d8-4b0b-bac9-2469317db4e5", "comment": "Malware payload (WeedHack)", "value": "28501d948ef29d3c87d39fd8a557137a4a0739ccefe45e67e23ac1dc2660b9b7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607445, "uuid": "7dda39d5-cc2a-4883-a493-3dbfef316449", "comment": "Malware payload (WeedHack)", "value": "66ab76ac740165cbf43b02c89f2f084df8651247", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607445, "uuid": "ae680eef-2119-4dec-9e8e-19640e11ed48", "comment": "Malware payload (WeedHack)", "value": "c744acf82d57c4ddbfb6afaf46d6338613d791926f2d888101f8c79734c4f8752911d5b4cffef89a9b8d15e05118fbf5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607445, "uuid": "0ebaa794-a508-4b99-8d45-88c970572fab", "value": "T133F4335641C8102BCEDE9834E7CFE7EF6868A4DF4A409C7B47EF9213B1256473608A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607445, "uuid": "ae41e8bb-4436-4235-bfb4-e0ffec201db3", "value": "12288:5GwVDb9XnRBO7Rz24nk+wW7cTt9MQRbHxSXnH3ycSlBqmkfEyyMPAaXMFsI:d5A5k+wVZHxajSlBqbVyMtasI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607445, "uuid": "cdbd3b40-b33d-4f1b-8f24-11b0a3129a3c", "value": 783589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607445, "uuid": "ab5f6dd5-c6d1-4b49-9e5f-04e86bf12d5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607445, "uuid": "06879f7c-2d92-47e9-8a41-ba46584a746a", "value": "VapeV4-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f215eed-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624381, "uuid": "ce0fb39d-8d05-4c0b-b788-c817eaeec3c9", "comment": "Malware payload (WeedHack)", "value": "e631a578ab2c4f19630a2a98de5afa77", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624381, "uuid": "e7a55dd3-d2f3-416a-8815-f8020bcee51c", "comment": "Malware payload (WeedHack)", "value": "2855b2be5cdbadbdc13592cdf6b758c3149b464b82a08596880525895869de0c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624381, "uuid": "db1e1dc9-ea1c-4399-ade3-1d07d67e589e", "comment": "Malware payload (WeedHack)", "value": "37d3e32d30d08d0a016daaca92336d1f4bfe3f9a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624381, "uuid": "755947a1-1970-4c19-9db8-f7638461a781", "comment": "Malware payload (WeedHack)", "value": "8b2e6998b7f5846b9ba2ba33aeb1058f827bde2a3c672e650a677924c31935840a0e3412a983aad4cd275da095e45e87", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624381, "uuid": "adc420ca-0c25-465e-bdcf-c7f58b520eca", "value": "T1989533D429C86FD7C6E51EEEC0CF25A5AED0470E2C33B83111169EAF0199CF27A1B589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624381, "uuid": "e41d0a2f-2991-4652-8bab-5679e74cc852", "value": "49152:TdMAnAIVzqp6UEmr+hbIZrjHJUM1FQRHfN93kQRHaPf/+d:jnddUEZIxpN7QRlqkHan/+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624381, "uuid": "e33949fa-6492-4d5f-b382-7b07b6d7a235", "value": 2043665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624381, "uuid": "3b2b69d6-6670-4fa5-887c-219f64471549", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624381, "uuid": "abe83beb-dc5c-4fc5-bae0-d81308ef4974", "value": "bybass-esp.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454fa14b-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578516, "uuid": "67835ec0-7c61-4f3e-9cd6-641e6fbc8e89", "comment": "Malware payload (Mirai)", "value": "33ced1eb404a931b09f50e47e9a4f64a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578516, "uuid": "39567016-1aac-4d1e-92d1-13bc389bd8c3", "comment": "Malware payload (Mirai)", "value": "2a64626a521e1cae3c256e567a3f5d42989cf4d6f4ed0222b0a52e3972f0eba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578516, "uuid": "2f93271f-d207-40a1-a9d5-db224fe68399", "comment": "Malware payload (Mirai)", "value": "7e097db02c6badecfaa8ab188506d496fdb4c4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578516, "uuid": "14d5a850-ff57-42f8-83f9-b5d610105721", "comment": "Malware payload (Mirai)", "value": "a0e1cbb0d0bca75aaf10cc00c1838dc7c66dce7a62c4fee7d5f190339501e1961edfc9161020fdf70dc2c573f7edaba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578516, "uuid": "9e48e2ff-b141-40f5-965c-8701b8e2daa4", "value": "T1D6030217E066A8C5D9A480F6E5A781413B525FE4F4FA72933350CAF49C3A8DB78B8E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578516, "uuid": "83a732e2-e77d-42c8-90c9-53b3b63a2ecb", "value": "768:fWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5mIi9q3UELyS:fWXasPGxplekBgTP654QwGkILB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578516, "uuid": "faef3bfc-a880-489e-b141-1fa38b95a23d", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578516, "uuid": "fe78775c-a12f-4653-b3ab-ac1a88bb9800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578516, "uuid": "4c51f6c9-603b-4ecc-b10e-c358dd471280", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a53c154-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578605, "uuid": "64c6505b-2f45-47bf-9441-c2a667180908", "comment": "Malware payload (Mirai)", "value": "01713698d7810e31331bee458b24e333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578605, "uuid": "981b3efa-ca84-40fe-8cfa-4db7c2211d94", "comment": "Malware payload (Mirai)", "value": "2c8b5697eae5d4a643b74c4ae2c554c9d16f5243aa47e8638108718a4be93a6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578605, "uuid": "afbcc135-476d-4763-9ff4-fc3a71f7850e", "comment": "Malware payload (Mirai)", "value": "3ecf782dfcbbb4f3d21842e9a4553bc03cc2619d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578605, "uuid": "115b898e-a2c1-4886-8c1c-2edd1045319e", "comment": "Malware payload (Mirai)", "value": "d053c5fc29e477f944307ccd00703ce323d08267a8d0cd99e6254c57947c681e29bb885fcb61f8df255e205c10459fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578605, "uuid": "e4abd2a2-c87f-4fdf-b096-0964c2e86aae", "value": "T1F9F2E169218DA476C2F49CB3D97046F11D3B00B6D4E933A15FF98288E145612A87BFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578605, "uuid": "c3dde913-e14a-4af3-9c0a-8ac9c6dc4c98", "value": "768:prFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GqvMRsFeWs3Uozj:p/eRSnQjMgVuP7qtqxgtACRs47zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578605, "uuid": "23daa4d9-c4ca-4d9a-bed5-8fc034a16fd8", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578605, "uuid": "c68a3e83-e4c8-403c-977c-e50534d524ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578605, "uuid": "7db510c8-4556-42b6-8208-ae1f9d31ae27", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e5c059-3bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776587211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587211, "uuid": "073968f0-09ec-406b-bcc3-314ebf54dc37", "comment": "Malware payload (AgentTesla)", "value": "0816edddbe7999a4e4ff024db296c178", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCheat", "colour": "#688F9E", "exportable": true, "hide_tag": false }, { "name": "grabber", "colour": "#C20177", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587211, "uuid": "5431ad66-4062-4aed-af80-5cc6c5b31cd5", "comment": "Malware payload (AgentTesla)", "value": "2caae88b894455be6fd124fb2bff81452c7f5249d3afda7daa5567740300b88a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCheat", "colour": "#688F9E", "exportable": true, "hide_tag": false }, { "name": "grabber", "colour": "#C20177", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587211, "uuid": "be4f6822-88e3-446f-a5c3-7748dd37780d", "comment": "Malware payload (AgentTesla)", "value": "8471d5c34ea1b5bd4ed42eeaa78e2c229fd789ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCheat", "colour": "#688F9E", "exportable": true, "hide_tag": false }, { "name": "grabber", "colour": "#C20177", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587211, "uuid": "1b6e1c66-8039-4366-95f1-8e54cf4cdd8d", "comment": "Malware payload (AgentTesla)", "value": "219465cb0692db48a92758ca83e1e6f350102e46263ac8f860880cd58ad537c1428ede3e89304e98ab30b46617ef02f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCheat", "colour": "#688F9E", "exportable": true, "hide_tag": false }, { "name": "grabber", "colour": "#C20177", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587211, "uuid": "059c5f37-3e0a-446f-b8c8-1863828c5137", "value": "T10B2601A87091F8F3F7E149FA8E70A2F5627A7D57EB8170B8D98D9314893632CDD21412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587211, "uuid": "3656bb2c-cf7a-43d7-8187-96cd43a14d58", "value": "98304:hvnSHTSuLM0VBAalzhWebvpH2t3hL0046V8lM:hQ2uLhVBxrctxL00klM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776587211, "uuid": "d2dd4e79-4b23-4731-a1b8-efc727645f09", "value": 4568096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776587211, "uuid": "d509bded-7a59-45f5-aa9f-a1cb04b1d8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587211, "uuid": "ba17b337-ac52-426f-a361-755c5c76dcce", "value": "Imperium.exe.infected", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef765c8-3bea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776601295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601295, "uuid": "5396f6a7-50ac-4084-89d8-b152e5b7f4a5", "comment": "Malware payload (Mirai)", "value": "25dd5d143bf400c469477d331ccb6eab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601295, "uuid": "8b824ee3-75a8-45b6-bbd1-8128ba936090", "comment": "Malware payload (Mirai)", "value": "2d8e362fc9ec5e45d11b7275e53f91bfd79a258f5d89df780cddc650dbdf1fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601295, "uuid": "f9c0baaa-9181-4aa0-a49a-1bc582b3b27a", "comment": "Malware payload (Mirai)", "value": "12ac4e06d7689b13d88b282479f885d93603ae03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601295, "uuid": "e39245e7-44ca-4010-abbc-45831d3463d4", "comment": "Malware payload (Mirai)", "value": "587bffa88e23f891045dd9ab98f1572f68e6e06cdf6148e1698014c3623a6c0214a5ebf36dcf75593c734d9f40a96f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601295, "uuid": "4b3ce30f-990b-4429-8a1c-e6033f40c919", "value": "T111E25945BAA3D5F6F88600B05877E7B29A7AE63D1074DB4BD728D636AC43701D20738E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601295, "uuid": "33d1be15-307d-4f58-8b4b-2e683f788c1d", "value": "384:f3yStNtRbhaEOLaeOzb8Tc5RsGhu7Dl/1mUL9l697cdgEZVJ5C0DrgbhxKwLxhTF:KStBbhatSvR4FPL/morR5CA0bhxBLxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776601295, "uuid": "fbddd7aa-76ce-409a-960b-2b84faa49bfa", "value": 33952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776601295, "uuid": "b40053bb-b67b-4936-924e-48914c96055c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601295, "uuid": "f8106608-1597-41f6-87e5-6b2d058a0e7d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef132af3-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586961, "uuid": "fa3cc4ed-b162-4474-9700-ac6ccde21a54", "comment": "Malware payload (Mirai)", "value": "f5719a75788f2fb2513fef4fb913629d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586961, "uuid": "fc5773f0-da0f-4263-82a7-3b4be9ce4af3", "comment": "Malware payload (Mirai)", "value": "2e34352198846a8c25bbdc189cd60957196c5063574a64df93ee27c5d6c01240", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586961, "uuid": "b67910c9-ab38-4622-9f4f-3fe401a9d681", "comment": "Malware payload (Mirai)", "value": "3b1ee4293b1188e9fd57abe4f573fbe910434c1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586961, "uuid": "13b03da4-0e8b-40df-bb28-c0b5099339c5", "comment": "Malware payload (Mirai)", "value": "591ce5b42a98947bc09751292593ad7805b49426f10db0d295c14305ebfc6a822c2b6d95c614cd157c92ea640c5339fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586961, "uuid": "04359bb2-c4ab-454d-8d67-f0d34e57be38", "value": "T11E513300F31D0963DAD33AB6637307808BA6EE134730230AE61EE6DCDE755A15D5DA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586961, "uuid": "12b4b9b3-c58f-4ca4-883b-087b703fb689", "value": "48:rgZVbXGAIIbz29Kovy5pl/UUUGlx0uknVBJoeP:iRX9bz29KoKX/cJhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586961, "uuid": "da18158f-0605-4a2c-bf3b-093541e8f5e7", "value": 2518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586961, "uuid": "6914eef0-ed6f-4b43-8098-91694927765d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586961, "uuid": "c3afae6e-6f35-4256-a195-9a3fee421f26", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a971ea4e-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598870, "uuid": "bf8e375b-4480-4a67-90c8-dabc693e35c7", "comment": "Malware payload (Mirai)", "value": "139dacb074bc7e6af371192a5a7f2d2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598870, "uuid": "8f972c4f-6c4f-4bf8-87a7-92ec9e0918b9", "comment": "Malware payload (Mirai)", "value": "2f9c3c7eb49474da5c92db62d39c487a0e1320925bcbf0517fd73e8922aa1909", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598870, "uuid": "8b51ae41-2905-4ab1-899e-988174135304", "comment": "Malware payload (Mirai)", "value": "9312e66d286594c4fdfb14deacd79cc2ab1f261f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598870, "uuid": "6fc1b7e4-02de-4e52-b781-7e0e6380273c", "comment": "Malware payload (Mirai)", "value": "907ca09290f320234e3cb9df96d5055df036930516e8e19a41aa707c6b586ac419e2f57be62d5a7f5a31bb050c8d8ba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598870, "uuid": "99a753a3-8d92-4e0d-828c-9464c38c0ccf", "value": "T128B2D0CD61543084CA8D7C7C178D4A664FACA1D0BAED9B25E350CDD8B3BDA8B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598870, "uuid": "d3485089-e3dd-40ec-8a4c-61f48a4a2344", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpxpZqSWvE:4QlS07FUXqIYSXQKquRqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598870, "uuid": "026675f1-d3a0-4324-8901-3a2ba7aa69f8", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598870, "uuid": "cf7d44e0-f861-4975-90fa-2a887d08efe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598870, "uuid": "9d35f216-d12b-4d17-a3f7-20a818c6942b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04343fa7-3bd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776590862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590862, "uuid": "4a3cf375-b2f6-401c-b435-b4fa13b0c030", "comment": "Malware payload (Phorpiex)", "value": "2598d0d556987883486bbe0462fbdc28", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590862, "uuid": "7514ed71-bdb1-434c-9863-4148efd40d35", "comment": "Malware payload (Phorpiex)", "value": "30c1114e05874981661292fcca63241571eb0186175fcddc61cbc99fd3e52d7b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590862, "uuid": "28b29ad6-3945-4ec9-af4b-ba36d14b5fd3", "comment": "Malware payload (Phorpiex)", "value": "26137b3553124413fe0f645e456e442fe01431e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776590862, "uuid": "3a972ae3-8603-4fc8-9dda-0c354bec5d54", "comment": "Malware payload (Phorpiex)", "value": "75d533b75ed8d2cb0b594eb1d8ddde7a3eddc48cb54667f0f8085d7418d227fed04ef88ad10e141327411d5633ef3721", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590862, "uuid": "5c409c8b-dc23-4f65-9c9a-21ac345677a7", "value": "T12C823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590862, "uuid": "a087ae9b-f183-4d7d-87b8-310080443a74", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590862, "uuid": "746a70d8-22e8-4718-b260-1fc7854f399a", "value": "384:8I78VGQic1Kwvw077u9NHu/gBhav8U9c5:tAE0769Zha0Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776590862, "uuid": "2d748b25-5a89-4dc3-a91a-59df1c0db5ee", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776590862, "uuid": "623cc7c2-6ce6-4f62-b534-33aae3dbf00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776590862, "uuid": "8f541e18-2b01-4114-96f9-440fcf2f412b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3b46c0-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607413, "uuid": "3833ff02-39e2-4315-b193-987684329cd2", "comment": "Malware payload (WeedHack)", "value": "c270b8099e3ca4db3ea234e09cc14ef7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607413, "uuid": "4cd458fc-23d1-4651-bff9-ccc04e8f7958", "comment": "Malware payload (WeedHack)", "value": "32c060cdfc9aafc3b81a2321d9eb0f2aa9092a40dfa291e8843cd1edf327396d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607413, "uuid": "cce94f27-9e41-4390-8977-1df1e89f60d5", "comment": "Malware payload (WeedHack)", "value": "7c9e89775e441ade352ddd310ca57e16d89c62cf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607413, "uuid": "221c099d-13a1-4891-a120-00a8805ef76e", "comment": "Malware payload (WeedHack)", "value": "4e57d776b3826bb7a94189f585a2b19be677173b49190306efb5c79be33e6f51d98cae142fbe5845ad7cf150f5a60a2f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607413, "uuid": "bb3eb725-e9ea-4792-89a8-c40dce653806", "value": "T1B3961207B2BE4B35EC0FD9F3D455963359AD3092E04770AA60B82AC16DB3CF8539EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607413, "uuid": "8efe24bd-d54d-4782-a085-16c705ab3cf6", "value": "196608:/MCyqfO4QChHgQtamoTHJK4GWWUgXItGY4XGgO:/jf5QChHOmEHk4/aYVgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607413, "uuid": "54c27894-ac02-4c37-84c6-3c26626f035b", "value": 9175712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607413, "uuid": "0859d984-ab89-4ebb-be4f-0f68647005e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607413, "uuid": "cf7121d9-fe98-473c-9658-db09d6012291", "value": "pulse.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd2fec9-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635383, "uuid": "59592266-0207-4c83-bea2-4240e5bb0457", "comment": "Malware payload (WeedHack)", "value": "625878ff897d3c92ad7691c8dbe44483", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635383, "uuid": "b5cb4816-d89e-49c9-baa0-6bfda1902e35", "comment": "Malware payload (WeedHack)", "value": "32d3bc8b1cbb2ef90369e6eb5759adb27dcfebd1a98f58b3fba435e393f5d845", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635383, "uuid": "010f1950-9a36-4e38-9965-1db8433f6762", "comment": "Malware payload (WeedHack)", "value": "cbeb0e4941cf8c57ad9fd4a81d3925c2c0052753", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635383, "uuid": "ca874112-72b6-47a8-aca8-06c713c88c6a", "comment": "Malware payload (WeedHack)", "value": "5a7f1b81ad3fd853ec1a112512ec44b92877c926d2a915927fc70af675b8c0267ff2878d45ea92cfb669116e56ec4cd8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635383, "uuid": "c1f9d418-e35d-46db-a507-eb485855b447", "value": "T19B3423B717E16968CE5B94A6D23212B3613C64396E9E304F5238368F4F1E05CEE6D707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635383, "uuid": "a97966ce-9b3d-418c-99a6-66a349674c8a", "value": "6144:0OesiU6lu5VMWviipB2DSiXZ0GKyq0Z+aWvAOyc:0OCijN8GipKb0Z+rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635383, "uuid": "fca0a443-1fb4-4e1d-ae69-b3e2cdb11838", "value": 230627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635383, "uuid": "150dcf01-6f8f-49bc-acac-d1dd9007fb98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635383, "uuid": "2327ce63-61d8-46c2-9328-a5f8d3a04e78", "value": "Create-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba9ae31-3c45-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776640267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640267, "uuid": "d1b10a87-2980-4f68-915b-6bf6d6c31da2", "comment": "Malware payload (Mirai)", "value": "f6be3d0f7cb7fd6c3b8d925ddf9eb52a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640267, "uuid": "5d07e5ca-d23f-48ca-857a-655faa4405c2", "comment": "Malware payload (Mirai)", "value": "33ef494adc7227eed23a04de8d7fd0ca64ea486602f36d235aa58ec1698f96a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640267, "uuid": "d8cf98a4-5857-44f5-9be2-aa0355133329", "comment": "Malware payload (Mirai)", "value": "cbe421b9b7d53ff8b40d4f27188e61f7a574b708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640267, "uuid": "a7a1ca00-2bce-4c46-9b61-868900ebb153", "comment": "Malware payload (Mirai)", "value": "e13f008f641b60d9b59a3aa0d1df455d7c0e7c1d9b718cfb1a7ec5866f9c429cbdd303900fa7aeb94dff195c680712d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640267, "uuid": "9deb03ed-51cd-4d5b-8baf-d0f434743963", "value": "T11DD31946F9819F12D5C151BAFE0E128E73131B7CE2DE7212AD246B74778B8BB0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640267, "uuid": "2ddf9e27-5e91-4073-bb83-a622aa64d1cd", "value": "3072:x7jnLfpMQO5n/rt/ad0DWIyM3uc2leTrPcTJdOjMgPaJ:JLGh5zt/ad0qIyQ2orPmdOjMpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776640267, "uuid": "b848c2ff-45ae-4caf-a187-29a86fba0bc5", "value": 142324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776640267, "uuid": "acef1bdb-08cc-43af-8417-03528c420016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640267, "uuid": "ff9b5202-9238-4c88-ac33-b3d3ee6c4d79", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9438977-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598897, "uuid": "d551ebb1-57e0-4177-96fb-7488319cd30b", "comment": "Malware payload (Mirai)", "value": "5e11addca3b947b8f92253d75cdf2463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598897, "uuid": "e20cf015-586c-4ec2-8e97-ede3d9d317b6", "comment": "Malware payload (Mirai)", "value": "368432b257c5c5c4bc14d567e68215db21c996fd9c62d2d51fb4b99607c36bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598897, "uuid": "bea2ea6e-e9f9-4f21-acfc-f2775d8057e4", "comment": "Malware payload (Mirai)", "value": "6300aba039995dc65f1ee3714dd34c1f5606c285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598897, "uuid": "c5639372-998f-44c9-9a41-7186937cd894", "comment": "Malware payload (Mirai)", "value": "45be4afb7208a3f852937520940a58e41602d4371c3b3947fb929f8c93bdc3582561f5d6f063f53bb3badbbf637fdbfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598897, "uuid": "bb2379d6-7bf2-442f-937e-1510e732064a", "value": "T1B6C2D0E07726FA31C4206C3DE52A4C8A3A51167C91FF353664268C36CFC165B67E84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598897, "uuid": "7f31f803-dc2d-4c29-b906-7d3626d929e5", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrd9q3UELuw:PKy4qfqoeJdXWgwLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598897, "uuid": "b782a546-6422-423c-960f-790cfb4fe9b8", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598897, "uuid": "1fbfc249-51ab-468f-974e-541c699d597f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598897, "uuid": "ba8f8841-85a8-4c9c-9bdf-4eec25a2675c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509776c7-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607311, "uuid": "6f0326b8-7b77-4711-9e8d-22634696c9cd", "comment": "Malware payload (WeedHack)", "value": "bc48105da9f4bc88ad1b291170dd514f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607311, "uuid": "734fe5cf-c9c5-40aa-9c00-48c524966ce9", "comment": "Malware payload (WeedHack)", "value": "37299f9dd8ca89ce00971e378667346c9f46354f96a01f8a223c4aafd37af5d7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607311, "uuid": "dd70e646-8ce3-4d80-897d-3bc14c7ffa1d", "comment": "Malware payload (WeedHack)", "value": "a4251c491e94236143e16262e6ab5d66cf83e79b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607311, "uuid": "77882ace-d8f3-4652-acbe-4495f62d75b6", "comment": "Malware payload (WeedHack)", "value": "cc83b981a423eab3e767e0e9987fbdee3527d80eb6ccf2eb3d022fc240c97a669d867c49cf3d4ed502427970ea043ff1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607311, "uuid": "404dc816-7bea-40c7-8fe3-fe5592b64d3e", "value": "T199A423134A145E71D57F2819971EB6CBDF4BB686CC43B433EA01AA5FF643AA6D00C90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607311, "uuid": "1e12e5f9-5b92-4f31-9057-ae0bc18095b8", "value": "12288:3XiaZzvnEZq0gHw1butyalM54KuOl9wRt2L7i8:niaak0xGytDl9wP2L7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607311, "uuid": "5a9eae14-bccb-4f88-8389-8f63f2e39240", "value": 466185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607311, "uuid": "2acde222-235d-43a3-90ba-1fcca7d8f499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607311, "uuid": "96105113-cd14-4954-9689-53b9200a02f8", "value": "Dupemod-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa316aca-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578390, "uuid": "f8e8833d-4684-4d60-afb8-6df8245f8ef0", "comment": "Malware payload (Mirai)", "value": "b2dcef454b10bd4835a30b9dd3f66d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578390, "uuid": "39db6816-67c9-42bf-8959-cd33ee62c045", "comment": "Malware payload (Mirai)", "value": "376104146a8be9473b5f459e9db4a6f53cda2ef190177658e51f319ac3984210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578390, "uuid": "4f4e3d59-c709-4a6e-8c0f-d61f15e0227f", "comment": "Malware payload (Mirai)", "value": "9d14279b88d162c30ae35ac96ce2fc1cb4be3738", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578390, "uuid": "6218e799-25ca-4e70-bd87-4e60833f605a", "comment": "Malware payload (Mirai)", "value": "5dcdf1ef7ddbdf3f7774e097e3adf6eccaeb7ccef01e42aadd103015b0309eef32103e321921161c99eb2c0b72caf794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578390, "uuid": "a19ad460-0117-4260-9926-6dd3b908a59f", "value": "T1F143F135920B2DD1E8342066F1252863F6D61FBFC0E8153B271A77A8B7CA12E0D785CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578390, "uuid": "352b23c8-5d9a-4629-b038-6ed37ca570d6", "value": "1536:lbQeUzP+5ke8999pRDP2oQcz6Luy6tlV1nLG:yeUqvSmLd6tlHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578390, "uuid": "a417abf7-6692-42d4-9299-689760dda6a0", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578390, "uuid": "589deeba-07c0-4fad-b4b2-7eb77903d286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578390, "uuid": "6a8c27cc-bf6e-413d-a91f-f09d7a2c6d39", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6697be6a-3b93-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776563969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563969, "uuid": "bc77d8de-c43c-4f2a-bb7e-f976a2878ebd", "comment": "Malware payload (WeedHack)", "value": "7e0a18a8fc42fb1d7d3ceeffc23ed889", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563969, "uuid": "5ae815f9-4ba0-4400-9c7d-632eec99d2c1", "comment": "Malware payload (WeedHack)", "value": "37d8575e1d68e395dfa6b6e414597513b6ce052388632b517228e1108a2faf1c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563969, "uuid": "7dbaf780-00e8-40e7-b6fb-25031b3ff4f0", "comment": "Malware payload (WeedHack)", "value": "0d9afcf168aa4a3d3e6e6eff501f4f13f06d574f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563969, "uuid": "6dda7404-b627-4b23-88a0-358893a47540", "comment": "Malware payload (WeedHack)", "value": "bfd274eaa175475ec003609a8f170604f72b766c58ce04e3be3c99548b9c114f04afdafaf8fa32c01dd3bba0e8ebc409", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563969, "uuid": "32c8f3ed-13ae-4f90-80de-8302f0f5e079", "value": "T1BF26F125D61D0039FC53EB33C042B5B139BFEE91928BB0E739B9054E482AA95C77BB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563969, "uuid": "f200baa7-9c11-415c-96b5-88c31db989bf", "value": "98304:8yGD1p2SKrPsurIJOXvZnYQzwGHlShJIYSgDkDm3xSH:8yGxp2tsCI4XJYZWlShXSwkDm3UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776563969, "uuid": "ae2fdf9a-39ad-42df-bbf7-5390a2e198f0", "value": 4679057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776563969, "uuid": "0ef72901-ef2c-4ee2-a799-86bb2e4413fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563969, "uuid": "2e696b31-206b-41e2-9901-fb6139ce2246", "value": "Zenoa_Client-1.21.8-69.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb8604a-3bb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776579174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579174, "uuid": "c864db2a-cea6-4482-a523-26d3c693c592", "comment": "Malware payload (Mirai)", "value": "b741c5240b006c88a2dad046106e0aa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579174, "uuid": "6fd0d24e-3fc4-4d8c-81cb-5c9e40a79744", "comment": "Malware payload (Mirai)", "value": "39bb6fe8eae962ae2c24a9ee3d2bd35447c8b8ba3aadbe24b3c1cc337460d7a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579174, "uuid": "4f012dd2-c0a6-4af1-9b65-b77307c49dbf", "comment": "Malware payload (Mirai)", "value": "d0290841e7122f3d00f0c7db0e0bc7444a0c1dab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579174, "uuid": "283061ba-a09a-4be5-822c-2be7cf94fc50", "comment": "Malware payload (Mirai)", "value": "ff2c571b6c5404dbe064bb7774f169db8ea720a54c825d3af2c4e85940979833dbd670d5db16bb51d3163a026ecd96ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579174, "uuid": "7ef1e9d4-c7e9-4e54-ae1e-b15acc007aa4", "value": "T139140F21B4CCD9C7C426627CA1EDAF7ACD3EF2DA2705DD037ED465314AC9E9A290AC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579174, "uuid": "cd230144-37a8-44c4-a27b-babe6bb7618d", "value": "3072:qSlz8oYUSPOfQqHGxl/TBL865sJg+2XrhnwTzedNA+IiKZ:Bz8P1OfV2/TK65sOuzA0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776579174, "uuid": "c55e6fe8-56eb-49d2-ba4e-caab70de59c5", "value": 198088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776579174, "uuid": "fb5ccd95-9f9e-4b5d-826b-62a97be3eb51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579174, "uuid": "cd9b152f-8347-40f4-b45d-326f5d23afb4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d75f35-3b93-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776563946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563946, "uuid": "1f17c14e-fd41-4641-a578-b338bec72a9e", "comment": "Malware payload (WeedHack)", "value": "e1c21bd0c8c0a86648ee8508909928f1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563946, "uuid": "1ad472ad-7cc7-4d26-a56e-02d625e8e882", "comment": "Malware payload (WeedHack)", "value": "3a5ad4626fb52bf26337249939601d68f3840ab9ed6f754adcefc54d7295cf84", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563946, "uuid": "f8fad746-26e2-4735-80b5-d83e6db6cb5a", "comment": "Malware payload (WeedHack)", "value": "ff876a88069c62852ded580095ab86a6c42a226a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563946, "uuid": "d72b16e5-062b-4feb-bc26-7d749bf0f68e", "comment": "Malware payload (WeedHack)", "value": "5610bc181fa14fc2b6d8e757c875acae1bbee36234d6f3c1c762e3c32ab25995c2037e8c7fe2ddcef59de10d5d677c7d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563946, "uuid": "57ca6335-a468-4030-bae6-1d880a7e8c4d", "value": "T17135F173E63E056AD95F89F660086D223C788EE2D40BA09F27B8C65605E3C9E5F443DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563946, "uuid": "7f0439dc-d05c-407b-9215-d159be47dbbf", "value": "24576:j1nEuXzcE34yXs4KlQ55/9R/BJoKawtf/i8yPYYO99A8IEGinuWE0J:hnEuXzcE34iMunPbonwxijP/UCE5uWEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776563946, "uuid": "99cd46fb-ee88-4c4c-bfc3-e644c466ccfd", "value": 1145750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776563946, "uuid": "f97c39af-e62c-4d4d-a4b7-5f9ddd13babb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563946, "uuid": "f66da8d1-62eb-4696-9176-86ebbe97bf55", "value": "Glazed-1.21.4-n-16.12.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f5dc33-3c40-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776638432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638432, "uuid": "c1af0171-f5e9-4b44-96c5-9e495d4615c8", "comment": "Malware payload (Mirai)", "value": "670fef6f63fc7e8852730aacb9e92238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638432, "uuid": "c62bb836-7d1d-4288-8172-94856ce5c2d2", "comment": "Malware payload (Mirai)", "value": "3b2dd06d13f1730ae577296a749d26eba90afd572913552c0dcebb4db879d000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638432, "uuid": "38744293-c4ab-4156-beb5-ea0757b375ff", "comment": "Malware payload (Mirai)", "value": "91f88af1a55e9a9609dfeb6455d848f183fbd6c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638432, "uuid": "e572d42f-6994-44dd-9f98-856de5a20ed0", "comment": "Malware payload (Mirai)", "value": "38de8379f2a148700eea0718457199c68529f156897dbf0526aa2ab38c6cfaa1ea34a29db4367ca15d554b1237a86029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638432, "uuid": "05c33694-6ec2-4ca0-8c7c-244bc5ed0710", "value": "T151D30945FC509F17CAD266BBFF4E428D7B2A0758E2EE720399255F24378B8570E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638432, "uuid": "dc62d11b-3e3f-43e2-a49a-0dd85941d102", "value": "1536:d3/or8J0y6FbNhnl1L9tdivVwfdmTIG6NhbxZOzIDHO6AoxzlrbwywUYz3MduBzc:d328Z6FbNhnLtiNw8sGobJDxdx25Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776638432, "uuid": "12f6100d-42c0-4204-b45e-73119c7a4e59", "value": 133688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776638432, "uuid": "53df9ae8-fca7-4983-ad5d-75e47e28f6da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638432, "uuid": "9af01620-7c65-4c58-888a-77df17144b85", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e75042-3c38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776635051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635051, "uuid": "7e6c8c30-e9b7-4451-89bc-fc971869b05b", "comment": "Malware payload (Mirai)", "value": "1b55863a98ec873227090e50a6746192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635051, "uuid": "fcfdabb2-7d65-4e8c-8e4d-b6df57e4182b", "comment": "Malware payload (Mirai)", "value": "3b5fed474c7ca7daf87d755878652eff49f3758e2787552346f48789ad6a6681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635051, "uuid": "7d66fc64-20d1-482f-87f6-85296dbda000", "comment": "Malware payload (Mirai)", "value": "47236880a93a5f2b6d2724a29db00d7936d173c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635051, "uuid": "429a1152-34bd-4a81-b8b7-b614b9eda9fa", "comment": "Malware payload (Mirai)", "value": "51b400ee3c2d8c910dc48c01b8bd82126ea44b74ece9b277f45c273dea630e7d5a174ab2b0079ad631b69c147839b629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635051, "uuid": "7c92969f-3ef3-44cf-a9fd-aedfec9c23a6", "value": "T16A530210B26AC767E690CCB6E1968AC255120CFCDDB650907930DF4F06A73AF36B859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635051, "uuid": "e8548887-119b-47f3-81aa-f947dabcf36a", "value": "1536:AaBl+sX2qxqxAKMwsNjgu6vMtC6S46Dff0TLNtcv64rP:AHSqNZsmvMtC6XY4LLcv6UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635051, "uuid": "d7d23a36-9f39-421c-895d-4546c570c395", "value": 61852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635051, "uuid": "e8538a4d-1068-4eb6-bc12-1c68da99b3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635051, "uuid": "950d0c8c-e1ed-4bc1-8317-0eeb5cdaa40d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cffb81d-3c1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776623760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623760, "uuid": "c375904e-f455-4561-a425-7a732369adba", "comment": "Malware payload (Mirai)", "value": "5e4061bcd49f36c9217d75e9ff9d461a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623760, "uuid": "c6351d0f-e1e4-4d2e-bf6f-72b867d70b92", "comment": "Malware payload (Mirai)", "value": "3bebb59e8f7976cf6c37bf78ed2d7228518ab75fbedeef162f1e8a057b669e28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623760, "uuid": "6a1a17f0-46bb-4a68-9827-ae945758ca35", "comment": "Malware payload (Mirai)", "value": "57db9af3b6116649021d1d84d8822b56450176cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623760, "uuid": "c7794c2e-b6ce-49d3-b16d-81624f72779e", "comment": "Malware payload (Mirai)", "value": "86bb7bcc9aa3fae951e29c8d43aabe7f812b67941c387dcb4161a66a0936e00c6919b8056a5831816d113d2d9e052f9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623760, "uuid": "7471de00-271f-4a7a-81ea-5fa88691b60b", "value": "T121B34A63CC256F18D625E5B8B1B08F792B63A96095871FBE1577C2788083DCEF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623760, "uuid": "b18767fa-530a-49d9-9259-b4386b80f1ef", "value": "1536:sLUh82jwPOnECeKVNPq73O5TsQyesMfWywpkQdroOqbb5:9SrmnEkVEWTszYfWdpXrbqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776623760, "uuid": "9f914ac2-16e7-48eb-b9d4-89e159f1f053", "value": 117368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776623760, "uuid": "ba4cdf27-e492-48d7-b035-0861cb5def39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623760, "uuid": "445333e7-bc59-42cb-b65b-25700ab8ee80", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fc5500-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578597, "uuid": "705a14a8-d9b5-4d4c-a1a5-e98b15916acf", "comment": "Malware payload (Mirai)", "value": "c5089ed1315554ad69f3ae4aeb70a3f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578597, "uuid": "aa846ae3-78cf-46b9-aa57-fc53322c8501", "comment": "Malware payload (Mirai)", "value": "3dccc7f4365b5de6157be8add07b0b1e8a96f9976f66cf68b82242f0dee135a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578597, "uuid": "de7f7c15-a6ba-4444-b02c-5554ffd6aa15", "comment": "Malware payload (Mirai)", "value": "51594e9df9c7704b660bc53e4a648866bd69a26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578597, "uuid": "ae34a8d9-2614-41b9-a407-a5fbe784b1cd", "comment": "Malware payload (Mirai)", "value": "c7405152464bee0478cbd9ae3d6a304a44efda5998b8eaab328b4e3e6322cc24df373068b878a21e2860518a827dc424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578597, "uuid": "829fa950-a459-4dbc-8124-7a5902329ddc", "value": "T155B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578597, "uuid": "f946aadf-3d26-46c6-80e1-5939d274b691", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDG/LWW:8YSZ3e8ZE3MYlphDgDGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578597, "uuid": "b98ec6cd-aeb8-408b-b821-97bc05f058d3", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578597, "uuid": "5b4f9cfd-3a68-4957-9efe-264bf20906c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578597, "uuid": "439fb1f6-07ba-4239-9f03-d7d9fcdc1fcd", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abad91a2-3c1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776622496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622496, "uuid": "37ef7edc-1697-4f89-a5a0-f36b11158da2", "comment": "Malware payload", "value": "1b8cdd0b62d21592e28b49c372daffeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622496, "uuid": "6c5833e0-aea8-429c-bbd4-0d70fd36b01a", "comment": "Malware payload", "value": "3f049dd0ef4d209cce7ac081c093d51bcf2c5c3e515d8c124c63b31c8310e1d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622496, "uuid": "4f3b3b49-7b91-4241-b9b3-86b71b0577ca", "comment": "Malware payload", "value": "dcd4cd3c3c5ad2c2752d5cb887ed7452826a79fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622496, "uuid": "e2d1ff78-48f3-4952-9ef3-ca8dc653fc72", "comment": "Malware payload", "value": "2f40a108054c85601260d04730554491ef3b5db3b1014187de11d3b0d842589bf5f981bccf1dea7252b6496dcc0f3026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622496, "uuid": "966a81f4-6af9-4718-a5a8-1180fc4d22e4", "value": "T172D4E042F7581B9CD5ABE63AC916137FE77138865A04A72B23B54B673F235302B2D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622496, "uuid": "f2b40390-32c5-4740-ad3d-7d256a99c5b5", "value": "2ff469e8a85333f8e6ac6f93c3cf6824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622496, "uuid": "3ad55c59-7375-41f0-b65b-1e8266487ba3", "value": "12288:CnvxpiuMtxbz3SxVSE1t7+/ZpZ3l7KYnG2Tp8cGs+s4B1MyV7:CvPjMtZ+SE1t7EZpJl7TUcGs+s4vMyV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776622496, "uuid": "f1cd0642-3162-40bc-9e6b-f0b126f17c05", "value": 648432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776622496, "uuid": "edc93cf8-c961-4c72-a57f-95243db343c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622496, "uuid": "5d7f28bf-d871-4b1a-84f5-8afb383662c8", "value": "photo20260419.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6983ab-3bb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776577377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577377, "uuid": "c4967601-285c-4301-a6a3-98e64aee993a", "comment": "Malware payload", "value": "8175fcfad3564d406d2d15fa79d88f88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577377, "uuid": "51e72ba1-d229-47e3-865f-e03f1a2eee1c", "comment": "Malware payload", "value": "3f45bc0e22d7ee5b146fa1b3de65f4ff9967d2a5c59b2770a620c3e66a0792ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577377, "uuid": "6b5c782f-5e12-4d71-95aa-659fcae98cbf", "comment": "Malware payload", "value": "9455d9a99988c27b7428164f24101df5162e7a85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577377, "uuid": "e9daea72-462b-4c51-a393-b78f0b0ad400", "comment": "Malware payload", "value": "b95e530cd3e512bcc13fa7670b5d662492466b612350b6217625b2724b741af56a78f0f89e358cd39cc092ca17d75683", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577377, "uuid": "9c818307-aafa-49d9-b40f-7537540beb5b", "value": "T1BA137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577377, "uuid": "8b63113e-c852-4ece-b788-f7b1e91532f3", "value": "768:blXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bvlxscy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776577377, "uuid": "15ddaef4-58dd-479b-aa24-f54fd53febb7", "value": 45519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776577377, "uuid": "d62b01a5-f74e-4a41-9991-37dec2c3192d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577377, "uuid": "6feca4b4-610d-408d-b054-40f99fde64e9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1de779-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635407, "uuid": "7db96586-d250-482f-95a1-7a57b387c7da", "comment": "Malware payload (WeedHack)", "value": "c82d5469ea6294316b7058b65884913f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635407, "uuid": "a39a7dca-63ed-4bf1-86dd-7e1dc2513334", "comment": "Malware payload (WeedHack)", "value": "3f98502b2f11aa1ad76b7c48fc44177db4f39215695816cabb3789f6a6db18cc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635407, "uuid": "6f5f15b7-468b-4c07-b084-055654dc06f0", "comment": "Malware payload (WeedHack)", "value": "631a8381b0c2f1a097f3ae1d258886f50318adad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635407, "uuid": "03e1b0db-7bc8-4423-9124-e1117348285f", "comment": "Malware payload (WeedHack)", "value": "cebb092933f5927c9e0d91f35fe075ecadca9e3b0f25b5bc4845b8d2c6fa664c53e77e3f38735935fbe09b40b67a22e7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635407, "uuid": "b808bc0a-e084-46c6-8b87-9c92ea955f7a", "value": "T1E543E193110C026EF527FA39E426B917041E0BE8E12FB17E18F1657346EF8EEA5547A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635407, "uuid": "a8be7383-92a5-48de-be5b-4897da7c6615", "value": "768:rsrhqIhXn7NNfFhVGIRn2XtdfKkLqUZM5JFlXTeF+0VxO12oEQ9M4yZWcfh:YFhX5GO2XtVLuXFVR0s9EQ9MTZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635407, "uuid": "ba03aac7-5c64-46f5-9f48-4ddd861741d7", "value": 56725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635407, "uuid": "4ce6fe45-be9a-4e4a-90a5-479626fc064b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635407, "uuid": "bb37ec00-6520-4e73-ba67-7ae6c9148503", "value": "G1axCrystalOptimizer-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50c62db-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578381, "uuid": "9dacddb9-d479-4a1b-9406-34305d1c6327", "comment": "Malware payload (Mirai)", "value": "e5da382259a1eb45dec1ab6442b6135b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578381, "uuid": "da22edd5-b16e-445a-b497-4914fe46373a", "comment": "Malware payload (Mirai)", "value": "40575f81270265766cd3a62ed926190e8ffb5b205f4a7d943dd199ce5ba962d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578381, "uuid": "aa61141f-09c3-4105-8020-686aa3faef74", "comment": "Malware payload (Mirai)", "value": "95d835477dbbb5c5abd0ee501e9f9ba05235d410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578381, "uuid": "b19f194a-d2d7-4a85-ba8d-a8665a5d05b1", "comment": "Malware payload (Mirai)", "value": "f658d85da12510f4333b3884e1633ab8280ce2351eaca6732ffb44779b4c7b1f9fd27dfd524740be2b7602fb85376194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578381, "uuid": "b716c20f-3426-4191-9078-1a7963541883", "value": "T150045C06B1C598FEC4DAC2704B9BE136E972F4180134B6AF57D4EF622F5EE205B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578381, "uuid": "78643fed-9174-43a5-99e2-4de77b4a7911", "value": "3072:MGm73n44EdcUvfgZpRYkj3FdQiO80eyhCVMrorxEq0a7Fnj:Mb3n4PstdXe+MSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578381, "uuid": "6f85a92a-0180-4aa5-a87d-635b34b4568b", "value": 175688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578381, "uuid": "5d8a6456-7ca1-456c-bf49-f0acfd7e9435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578381, "uuid": "bf358490-a43d-4100-ad83-d0efcee7cc36", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54522502-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624497, "uuid": "649e4331-d20b-4c87-bb98-94257e662fe7", "comment": "Malware payload", "value": "49fde51abbd7d216a66b011a7e3e5fe8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624497, "uuid": "524e5400-db74-4f5b-a3c9-4722c468a459", "comment": "Malware payload", "value": "41f05097e0ca53a83ccbce5e2d293324084e9434611d0d81fbb6e600d4967d95", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624497, "uuid": "a4cc20b2-68c3-4512-940c-bcd64236ad18", "comment": "Malware payload", "value": "76c166af26f2ecb58fb085fc550d20ae06376e53", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624497, "uuid": "682c78be-acd5-4acd-aa3e-9bad916b66b8", "comment": "Malware payload", "value": "e469c73933024b06d9e5db9333216c90b6203a18de5ab3f736c338ffacc9c533eeeced1db99ba500d47cd41185cc4be2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624497, "uuid": "8dab67f1-0874-4f2b-9687-df3f0fc669f4", "value": "T10775E122609E3A34EE2367B0C14094472D3BA9C5DADB70567879094EBCB37C5877E3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624497, "uuid": "524d9484-1f1f-4745-a3dc-55c77b0be821", "value": "24576:OIv0BqjSqaVNUa7O2qLrYrqGfm9VoxocgH/xO6mEyPff2Z6rupzCGJo:Oqv0UixrqGYr/fA6mLPDu84o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624497, "uuid": "b791de5b-2f35-486c-9a2f-1367d87dd858", "value": 1565539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624497, "uuid": "4463b71b-6a6f-4741-9990-d4001cbc7ed1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624497, "uuid": "f2a72a72-6666-4617-9d45-df4544a645e8", "value": "snowflake-jdbc-4.0.1-tests.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55ecf48-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578382, "uuid": "ad282af7-295a-47fd-b810-fef953d31c1d", "comment": "Malware payload (Mirai)", "value": "62adfa87a6262aaf0ed44edcca105438", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578382, "uuid": "9d625bf8-1bcf-4d0b-8665-3f781d23e732", "comment": "Malware payload (Mirai)", "value": "44a740381928a588bb083a41ac64c5f1f2cbd5e73b5282276609a7f51363319e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578382, "uuid": "1bbe37e8-cd4d-4d1e-8a23-6bb83c069b0c", "comment": "Malware payload (Mirai)", "value": "a848269fa49614eab37393cf2dabe3e9027d0561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578382, "uuid": "febf986d-7adb-4d8d-851e-055cc0f42827", "comment": "Malware payload (Mirai)", "value": "ea84df129a7856272531fc08bccda83766d691a36efef24cade4d23ac00244e20817c2893bd0abf7091d9d2c7bacbd76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578382, "uuid": "86d1a718-1820-46d9-b935-6f634f98e372", "value": "T13B535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578382, "uuid": "5fe266ab-9e5a-4856-b52e-af0bc3b11f9e", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6UQUP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bHP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578382, "uuid": "de125832-0845-4935-b8b3-bb2b75cb45d9", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578382, "uuid": "9786afa0-2105-4bd4-80d9-6cffe8cf6d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578382, "uuid": "d288d640-bbd7-430e-9c48-31caa345b9c6", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9663c1c-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578335, "uuid": "2b00f48e-f6b3-44fd-8d44-553892a30fe0", "comment": "Malware payload (Mirai)", "value": "22550fb931d5d72dc28418086338956a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578335, "uuid": "c60ae1ed-fa64-4ade-901d-859f18a8b444", "comment": "Malware payload (Mirai)", "value": "44ff0ff2e896fcb26f192c3fc2cb3a1d7f528e733d1b44889b80812661487002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578335, "uuid": "88c5200f-94af-439d-af25-4a87a6416c33", "comment": "Malware payload (Mirai)", "value": "12a55efcb7bf3aafa93d12be07eae0d78fff608b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578335, "uuid": "22ef2f76-14f8-4092-8798-c5b0db0a5cc7", "comment": "Malware payload (Mirai)", "value": "6be8560b0f23dd5b7cb01ccda2d3186b2497c6a9f87d5f0f58d7baa954f1d1d1e42d6fc56881145b9b2c61f30050c468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578335, "uuid": "10348f82-d0f8-4613-a8bb-0f32e6dc663f", "value": "T1CEF2F1792421C38EE439C1BD4D3583B43E8A0F2A5543CDAFB95868E39D4FA6D3307681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578335, "uuid": "27f10226-3815-4202-9cd8-0b5d99e81858", "value": "768:9NYKyukZoTMKe5RQEztOzSDNDsEJyQ2fvAhSwU8JTJgGlzDpbuR1J9:3YdWleXvsMsEJyZTwljVJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578335, "uuid": "a05ac2e8-0076-4772-aef1-77915b347754", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578335, "uuid": "04d4129b-81aa-43ac-b120-ccd570313ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578335, "uuid": "ec5b9902-389a-481b-8653-4196197a32ed", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e8b9b8-3c0b-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1776615665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615665, "uuid": "2b95b76d-b42f-4ce3-a1b8-bef962799f40", "comment": "Malware payload (UmbralStealer)", "value": "be7266996f62afbc703f7c4b68ec0812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615665, "uuid": "43c59798-b0fc-4598-84cc-4aa4ec7cbc8c", "comment": "Malware payload (UmbralStealer)", "value": "464ebddcf6537f91aa32ee7521262538d94a68790f679567e1798d3e5b529866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615665, "uuid": "00aab4fc-60d0-4966-916f-2173e74ecd0a", "comment": "Malware payload (UmbralStealer)", "value": "f7a069b09ae5a7c49cf3f03806e521b5598c6880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615665, "uuid": "6ff1962c-0c33-485a-8af4-7aa03d59280f", "comment": "Malware payload (UmbralStealer)", "value": "3d38299f2cbf2c7ecb8cf7ca81538b57236d9a20bbc45d98cbe3274313ba399f4e8bfb61fb5c3ab4351041f614cd1fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615665, "uuid": "8b2424f6-b7d8-4dc5-be6d-cb220cd17095", "value": "T136B4396513688A22E25F8BBD5171C57F8773AE07E82AF34D18C8BCF73932781A805957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615665, "uuid": "41d978da-de68-4645-8497-552b4e542fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615665, "uuid": "27fc7a9b-0fdf-4918-8c44-1a2454ac18ec", "value": "6144:mDcjcgHgo3CSGwXDyoDhyiDcNdQGIxFYX+x6IE8e3Op88s:TjcgHSSfX2JbOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776615665, "uuid": "3b9e07ae-05b3-49a6-a303-934383c53a28", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776615665, "uuid": "bdd8329c-4ca6-46d0-b697-220ef2695673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615665, "uuid": "6c022d2e-0b5b-443b-b8e3-6c192ff871db", "value": "Grabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9585b2f5-3c07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776613869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613869, "uuid": "832fd870-3aa7-44d6-9755-5a82232b4a4c", "comment": "Malware payload", "value": "248117b0ef8c7fad9a149881f1a27f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Trojan_Win32_Wacatac_B", "colour": "#731A22", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613869, "uuid": "9e59e54b-6980-4078-9119-2cf10197b994", "comment": "Malware payload", "value": "49808e7a33aae40be712f7ba8b3667d1e54cbbe01631ece4a02addb2a6c74441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Trojan_Win32_Wacatac_B", "colour": "#731A22", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613869, "uuid": "6ac4bc5b-422e-4919-bb6a-b586a9206b1d", "comment": "Malware payload", "value": "32c83632388d21f24abaa46a94ffea4c100902cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Trojan_Win32_Wacatac_B", "colour": "#731A22", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613869, "uuid": "2d98748a-7ff2-4425-8f11-96c18499ab92", "comment": "Malware payload", "value": "ab3ab733ddcd9456d14c5c848975deaf6b47e05de2ff52429fff9a9629884a9749855eed93f48e43b2aafa8b2eeafa61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Trojan_Win32_Wacatac_B", "colour": "#731A22", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613869, "uuid": "8ff9efda-4669-49bd-aa6e-e9a88ff5df86", "value": "T1F6C73374E53753BFC2A3DE312690F706AD51ACA39923A60A3F3B21C69BF19416DC11E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613869, "uuid": "3d405216-0389-4f7c-bb33-8277720c16ab", "value": "492a5d3560401c2811de048088bf91d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613869, "uuid": "3e3e8dd5-fe4e-48f3-82d6-d8a75f95d9e1", "value": "1572864:JExuxpSSN7dsetWLctSlJJmyi/VI/PyANJWXeM4:JiuDV4etWL6S3JridItJYeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776613869, "uuid": "d19bf890-ef5a-4cdc-9ef3-e9f4fc63844f", "value": 55976159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776613869, "uuid": "61ce132b-6990-443e-ad70-9c217af66f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613869, "uuid": "33e52f9b-38f1-4872-82f0-2a7170571af6", "value": "DJMAXToolbox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a637f5fa-3c2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776630648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630648, "uuid": "84f93cd9-4a1c-4b0d-8ee0-b5868a3f81aa", "comment": "Malware payload", "value": "a746ba56096a56b3a78ed5c2c7c840db", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630648, "uuid": "0c4a6e64-2ee9-420c-ad0d-a93eac3b1c5a", "comment": "Malware payload", "value": "4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630648, "uuid": "a92bbe2d-33d4-4167-9bd0-887caf940ee5", "comment": "Malware payload", "value": "5383c7a51d94c4c5d1abf86b434b542f4d3d58c6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630648, "uuid": "ca84c308-34b3-4d4c-a101-0ac8b83f00de", "comment": "Malware payload", "value": "b311edee568d9ebfd7625f424acd90112f3470497040f3e60ee6e731801db529a6cd2170ac981368bbad90d9fc5bc735", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630648, "uuid": "85a47e7b-a469-42f9-8e5e-b5d1eff02c5a", "value": "T160B2A52239149D7BD091F360AC9B5801B7A6A1C760427FC0B6DF70A463779CA973CADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630648, "uuid": "014b25bd-ae75-4ccf-919d-c3a64690667a", "value": "384:GrDYO/DMdq9Lh2zPEg1r8j/vBHQIiSgjGir+FZj0y4B0JgHczXl+9QNNoHvyHWmh:GIyj/3tFwaadA1AxbtEDdzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776630648, "uuid": "0bac76e7-8432-486e-b080-e2ca93409563", "value": 25393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776630648, "uuid": "fae66b4f-efb4-4359-ae43-5fcb7d862842", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630648, "uuid": "392bdb68-9e14-4882-ba1b-c28143eeb668", "value": "File security.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06462762-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624366, "uuid": "348e0da0-3bb2-46fe-b8b8-9f1abf2868e6", "comment": "Malware payload (WeedHack)", "value": "07c0a624ac593543c273176cc37b83a6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624366, "uuid": "7801aa39-b8d8-4e81-8c95-be75280169d8", "comment": "Malware payload (WeedHack)", "value": "4a8d1743f3dbdbc8477ade84fa81e70fc576b7b913e100fa5b3995b9b6283388", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624366, "uuid": "ef512a58-c4b9-41f1-97cf-ddee2bce26b5", "comment": "Malware payload (WeedHack)", "value": "88f03ff6b60ae60fddfac513451bf0f93e454683", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624366, "uuid": "37bd88a1-eca8-4369-aaa1-fc78edd3638b", "comment": "Malware payload (WeedHack)", "value": "aa8952c6dead43c06fdda80a4baba141495e59bab02db738413ce7a76f09b32057bd0265b38395da10372e3a6c511d9a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624366, "uuid": "c03712d8-bddb-4045-ba08-eeaa09285c47", "value": "T1BCC2CFEBD495D42ADC8B993C5D4F3864D12F5788504A606E64EE39030B41FFAF28F366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624366, "uuid": "4dd29386-adb2-4891-89bb-29011bdf956f", "value": "384:V3w9gntEPKYCS+mlj4uT5eWbHmAjROOl0e2HLzOia+XyvYHv3s7i6H8QoXG:19n8KU/l44bGQ32rzY+MYHv3s7ib0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624366, "uuid": "f2a9f29c-ef5a-40fd-a601-94988c4a0e0d", "value": 25828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624366, "uuid": "bf70e63f-43f0-4d5c-94a0-34271a3ba08a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624366, "uuid": "7a55ac47-068e-434a-857b-3ed191d96fcf", "value": "4e_client_undetected-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b919f1d4-3c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776619512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619512, "uuid": "5a987103-14f8-4423-b48a-834532abc19a", "comment": "Malware payload", "value": "f5153ae5ab17fa8b436e9665a3be3448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619512, "uuid": "68369c43-7802-4c5b-b646-7c7f04f51c37", "comment": "Malware payload", "value": "4ad5c94364e05c363bd8f03cc35acf6166c9a496503859344a4418f2ae845caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619512, "uuid": "ba207b98-a3ee-4ff4-bfdd-5744f066811a", "comment": "Malware payload", "value": "b924238eb226c2eb1daeeb0d248b22a82a48e923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619512, "uuid": "df07d4ca-622f-4b59-a875-1dfeb305f2f1", "comment": "Malware payload", "value": "cb235926000a1382bd89057a1eca1afdf53596a8440b225007f6f41fdfc0fd485d4196ed7004d061ddf633b2ec95aa35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619512, "uuid": "a0bf33a4-9dae-4b14-9104-bfb2370940f3", "value": "T10335ADCDD0CEC338E070FE355DA992B99A7A44A7F0C0246E98B747042A87BDBC5C5697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619512, "uuid": "cba5cddc-e497-4fe4-9302-c2d9c4ca3570", "value": "14f8e4dca31086cd0498de53fcba2af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619512, "uuid": "9f7bb566-0d40-441f-b66a-b99e4c995dec", "value": "24576:5zxH7KBBR4pu+DX7EIvAskQdAMPbzvBW3sNytg:5lH7IjiuCQ7sLrPbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776619512, "uuid": "d0c5d56a-3697-48f6-9266-5039aebb66e5", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776619512, "uuid": "865a4073-6609-4d62-b9ce-7bb5be4a3cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619512, "uuid": "73538add-6d25-4aeb-b34f-5825deb56509", "value": "\u7ef4\u6301CK1.0.vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e0c0d6-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578574, "uuid": "e3a19e26-a813-46c0-9e4c-1f7ef0b42bff", "comment": "Malware payload (Mirai)", "value": "a3a391406af549cf35a536e3ad47093d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578574, "uuid": "6b90b418-a3db-4dd4-9607-18447205af3e", "comment": "Malware payload (Mirai)", "value": "4cacf488d8064f5b94d025496149509f63f402a6ed6a10cb6a339bc710bcc48f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578574, "uuid": "773d0c60-9575-4050-ad0a-6f4842f26d5f", "comment": "Malware payload (Mirai)", "value": "3554ff9bad1dea4cb4798eca7e72035cd167cd4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578574, "uuid": "e2aa50a5-ac29-46d0-9e2f-3b8197f6e78e", "comment": "Malware payload (Mirai)", "value": "b22e8d6c7d09d50a06dc7b796045e37db172171ca6cd4d71dcecb7a5c12157406ce1e035c56b735f2bba133956a06f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578574, "uuid": "eebcf189-3f57-48ca-8c3b-053d0a892f83", "value": "T103C36C73C8296F98D655D1B4B071CF781B63961181871FBE5AA7C2B58083D8CFA0A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578574, "uuid": "ba10dad4-7d8d-400b-a684-59d610397f7e", "value": "1536:ybX/MtH3tyYjyBjTy4yC74KaTRLIWwswIRaqyW4HqAvhgiLSG5Ah6:yLktHgBq4y+/alwswiyWMq8rs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578574, "uuid": "f9dc7563-97ef-4dd5-b466-1a379ab055e7", "value": 125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578574, "uuid": "00840e29-73c6-421f-874e-5ef608aee878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578574, "uuid": "55661e3c-3908-4393-a328-41eba493e9e9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb73ae96-3b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776560756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560756, "uuid": "54b414e8-c341-44a2-8861-d066443167b3", "comment": "Malware payload", "value": "bc86216e1f463f012d6dc5bdeb651135", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560756, "uuid": "77e058be-30eb-4d6c-bc19-6b0ed386c9f8", "comment": "Malware payload", "value": "4f4fc00706cf3aa91f4309109f020c4dc287810a936e05c29b789018d2c76153", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560756, "uuid": "c089fd10-d2a7-493a-ac0e-19db31958d4c", "comment": "Malware payload", "value": "196c4211bc0435f6cd544d013c8d68ba91b7544f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560756, "uuid": "8966bee2-f374-4eed-87d2-a1eb985152b8", "comment": "Malware payload", "value": "4405787e39aeb32cfd2455c06da0a907ab40fbab4f158537868671ed044e55ffb01c253d5e158bd2c926209cab0ecb80", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560756, "uuid": "5e80442a-7e11-4cdd-be84-9d1c45567a91", "value": "T1FE82902A3907CA1911F3A322B947B04DFE0320AB87652640F9DD86C51F71959E6EEFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560756, "uuid": "d7ff48c3-ddbf-47a4-a637-a375d7288d20", "value": "384:WEClF/yKBuE7EUENinrJEmEHEeYEyJ746E+7T1e9:lZoIvWraVkMy0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776560756, "uuid": "53fcddb4-6e43-43d8-b3a3-cd8ee398da40", "value": 17875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776560756, "uuid": "d48e990d-6ac6-41d3-8e9d-01e940e776eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560756, "uuid": "52895f3d-fe2b-4466-909c-637253dfb0c2", "value": "run.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef8e108-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578559, "uuid": "4c0aa4e7-2cd7-4ebc-ba20-fe501208148f", "comment": "Malware payload (Mirai)", "value": "e6949ba3a3eb78ae7216e2cd398752d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578559, "uuid": "f4e28824-de89-48c6-9c38-1b6503a42537", "comment": "Malware payload (Mirai)", "value": "4f865acdca641c98cec956aeaeeea7a0071c420b13ef2515a0dfa3716328b21e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578559, "uuid": "a47ae3ea-b93f-4d74-a58d-7fded918de58", "comment": "Malware payload (Mirai)", "value": "5d87c3252a368680862c253ceb2dc9abd1f93fd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578559, "uuid": "b9f2734e-e6ad-4c84-88fe-cfe3b1c54b0b", "comment": "Malware payload (Mirai)", "value": "a5b9fbed47692224b20a33cf8a0fa983b266397556d31b42dc8bf7dd3e0be34fa9278a2960ebfa7f80191b2e5d9bc8fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578559, "uuid": "8ef9fc51-7684-4cf3-87b7-a5a5b5cfb6bd", "value": "T1F7831895B8818B12C5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578559, "uuid": "ae70fe4f-cc6c-483c-9ccf-85203d7027cb", "value": "1536:ijna/CzPC7fG7PnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Qm+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578559, "uuid": "9bb15330-4b7c-4a5e-936a-9b71b21eccd3", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578559, "uuid": "ab6c2a8c-6b0d-4185-87b1-14df4b534249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578559, "uuid": "e8adbe5c-30d9-452a-8aa1-ce4601210dda", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9724a03-3b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776561101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561101, "uuid": "aa877467-1fc8-4b47-b142-d06afe9aff72", "comment": "Malware payload", "value": "613963572304f8199f7bf03ea8081bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561101, "uuid": "4dfacf4a-0d77-494c-a07b-34bfb700bdaa", "comment": "Malware payload", "value": "4fbda2f669b74c3cfd4af9e9621295cc812cd1417c44b39c50e4bb7d55e38f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561101, "uuid": "e227dd59-113a-4d2c-8511-025bc49c8cd1", "comment": "Malware payload", "value": "1b3cc20660f7334f92912462b497c789ba730dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561101, "uuid": "518f4c1c-4bb7-490c-ac10-98c565c64d43", "comment": "Malware payload", "value": "9c05031aa3d31b79aeaa2a8fb0599e3da73592614644f437b03ed42d6ec6cb14b144dc42adaaec071aed6cf3086d26b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561101, "uuid": "f2fed090-3516-4db1-89df-aaab0501b98b", "value": "T118D6081AE6B640D0E6FAC53586A2B123FD717895C734A7EF96454B460F23BF0AE39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561101, "uuid": "dfb945fe-4e1a-4736-8cbe-1193ed6ec6c3", "value": "588352617d6c4ee04f92e84769acf35b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561101, "uuid": "b6010666-f496-45af-873e-1a46486a2942", "value": "49152:FXVwASOoGtlqyo8Qb8JurnLwCXMPzcPkZx5dlR0bFXrv4AnjLCO74EjH72XJJAcU:r7JULU5WBXKEjH7YJO5gGx3MohD+3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776561101, "uuid": "b4cb0387-8563-4d2a-92e1-f840ac8e6112", "value": 13515264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776561101, "uuid": "eab724c1-ce56-416a-911e-1618fa233eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561101, "uuid": "7f784c92-5322-4438-8370-cc4c34f56ec3", "value": "i9di0r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d0223-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642535, "uuid": "3a710dc5-3c44-43fa-814a-8f7d068056c4", "comment": "Malware payload", "value": "fd2f4021e0210c8ac5068cfd5235fe1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642535, "uuid": "773e8bf9-2a95-422e-a439-f0f9c1782c28", "comment": "Malware payload", "value": "520cf78e2a38df00d68ddf326f9c16331fa37af7bf081da22af7c20f07e828a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642535, "uuid": "7a2675af-9658-4fe8-b5cc-f543fd92d1f2", "comment": "Malware payload", "value": "47521082626d979903f63c639fb13664e2ebbf42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642535, "uuid": "c2a8be6a-6082-4163-9195-fe056d8a38a8", "comment": "Malware payload", "value": "2d8a100c51fb1528beaa79935f6e5e823d6a1dd84ce1221b0f15e4c08b64b7acb1fc31011ee7970cfb0ae5cb91acfda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642535, "uuid": "be82b07f-21bc-4900-8567-9b358606d8b7", "value": "T12C53024AA4032A13D9D16D38D6BF98A29C6A4FB0CBFEBC15D4F05A44ABE25435348F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642535, "uuid": "3fd5439d-a81c-4ede-bcf0-e9d2464db70a", "value": "768:V6crQpXSxLkH3J/4ieDDwFd948nFHahqVQO7jcISOnHFeH6E1SkL4aTpky36B0Eg:XrFlkOfvM4IFHagU76Kr4EH3uSZHqY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642535, "uuid": "235d7ab4-25a1-4a6b-927e-734eee880af6", "value": 64448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642535, "uuid": "38899d88-bc50-4148-9517-f1f415ae3a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642535, "uuid": "062c92a0-6a5b-4f87-8d18-26fb2547cab8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd5e1c6-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598904, "uuid": "35174419-554d-4e65-873a-2e0a43cd3ed6", "comment": "Malware payload (Mirai)", "value": "9aaaa6388db936704e40e1884631a657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598904, "uuid": "6cea8069-08e7-418e-a622-b086b89310ee", "comment": "Malware payload (Mirai)", "value": "525b581c56077ab9950714aebca0035d9ba428a0cfa1204dfc6a1798f3e684d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598904, "uuid": "04ae9465-91d5-4cf5-9ff8-a4a5e1813420", "comment": "Malware payload (Mirai)", "value": "526a6a65ac41e4d9bc03c81088a258337e3be724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598904, "uuid": "254980fe-7841-40e5-82fb-8d990c5f6c04", "comment": "Malware payload (Mirai)", "value": "6a68bb08741b539793b9845fb0adc465eb196daf10002f40c2f0cf8cedd2e3f091cc4db3e071cccabc7bcaff1f8d7d4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598904, "uuid": "6038fd47-c67f-435b-8d64-9aee8bc504fc", "value": "T1CE138EA2C06DAFD8C1488674B8284F781B53E445C7536FF99AE985A68047EECF60C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598904, "uuid": "82d9fb61-ce74-4ff3-b90b-12d547e9c5cc", "value": "768:NanapGwtbGbh/EEZYePDznRVrgrq7OhGdv/qzCvoBJbCb:Na4Gwtq6ECrq0Gp/qzLLbCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598904, "uuid": "e5ab7762-9028-40db-a6a6-05184f5ddf8b", "value": 44348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598904, "uuid": "b6ea3d29-65a8-45c2-99af-7480f7bcf4ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598904, "uuid": "7f15ed77-3b51-4f16-8fe9-88a5fa511ccc", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d2c933-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607300, "uuid": "c71a344f-31a6-44d7-a9c2-33763d558b1f", "comment": "Malware payload (WeedHack)", "value": "56c67077ec99e66f51f2b858bfbb808b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607300, "uuid": "f9908464-9414-49a9-a054-e6368910601e", "comment": "Malware payload (WeedHack)", "value": "53768e63d624da074e1f58c71729a84ee07450481c9e8870d77fa2571ad7243a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607300, "uuid": "6a74e505-bd3c-4c33-bda3-353abf3c86dd", "comment": "Malware payload (WeedHack)", "value": "2d47e57e0165889300646ac010b8de7579b72c6a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607300, "uuid": "b556e401-c8a4-4d79-9984-6f1efb09dd31", "comment": "Malware payload (WeedHack)", "value": "9f3f2ac67f62f2c0873592fdccbf6905f2db4d7136d8068eaf3292bbdfcd4f66975ace4593969df13ec2ea8f7b84989b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607300, "uuid": "b5d06551-57a4-4306-8945-5628a57025bc", "value": "T11B960B13D50A5573F427FB3F805192A061B2FE36860BF1D33B7D185DACA67C18A7A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607300, "uuid": "b267d29c-8462-49ee-838f-32d8c215b284", "value": "49152:O0oWoi2d3aT4VN8vOoaT/QSmGcXyXB6Ql36TybGbCCWaMyP4mzIw063rGox/134:poW32dKOxmGjxh3RIWzoGM/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607300, "uuid": "04f341be-b07c-4996-bfa7-4557b11aad01", "value": 9273160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607300, "uuid": "71ee0784-4d53-45fc-9764-9ec15305bbc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607300, "uuid": "99f1aad6-f209-4d4f-99fa-0369c753a647", "value": "dupe-utils-1.21-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2fde77-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598954, "uuid": "3da78231-ae3b-4ec8-b3a2-188e00ff5401", "comment": "Malware payload (Mirai)", "value": "0a1d97330d1741ac06d5ff4a4e4c7b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598954, "uuid": "ddf0e061-7fe3-438e-93e7-48412c087b74", "comment": "Malware payload (Mirai)", "value": "53b845df2dfd0334c118efae9f620d40aaf3b5f4ae77e631eed52c01b3bfe393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598954, "uuid": "b58a881b-d62b-4ae3-bd06-0a45446f6c3f", "comment": "Malware payload (Mirai)", "value": "a891f12ec05c450a35267f9342fe3575ad2a56af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598954, "uuid": "6408c44e-026a-45a7-b318-074a564a63ff", "comment": "Malware payload (Mirai)", "value": "4a4930635ce100731f1a55b45277cc02be308fac9aaa729ab64c3947fdc4ea1b86fe9ad896205032525495f00d4b523e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598954, "uuid": "00451521-cc63-4ebe-9325-d56b590f3530", "value": "T1C1431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598954, "uuid": "cb1d9f0f-4034-463b-959e-9a5a6607ed31", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598954, "uuid": "453bdf66-464a-4e10-945d-eefc3a88e741", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598954, "uuid": "c589ecde-08dd-4b8d-afda-8ecc0ecd5bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598954, "uuid": "c3b74dea-07ab-49c3-9547-f80634531880", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd14636-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598961, "uuid": "884a0e4e-c48b-4103-a607-6cdad46455d8", "comment": "Malware payload (Mirai)", "value": "a2bc50acbf853499d55c4d938676c259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598961, "uuid": "ee1233dd-e132-459f-81ce-d1eb40dcc71c", "comment": "Malware payload (Mirai)", "value": "549670ca93271697f76ac2ee736b6a21d517deecc72776d6129071b9f1a99af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598961, "uuid": "51e2a5b5-ff74-4154-b6da-327c87218a7c", "comment": "Malware payload (Mirai)", "value": "278a79ffd8609e73c94c509887254f1cee2b5c30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598961, "uuid": "401c3f45-7656-4509-975e-505b0cda40e2", "comment": "Malware payload (Mirai)", "value": "97c521f697bf4cd6c7f79acf91a06d820085d3ee108a5f98cd74b6b8c9fd2afdc3af8b1a6b0d782ca0d20a1d4582a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598961, "uuid": "506e1c90-5cab-4f49-88a8-dab546b391df", "value": "T156230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598961, "uuid": "288f6ac5-1bf4-42da-a594-c72402daaee8", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THz:5DmKF7Gxyk8cqoHAmWurAufsG50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598961, "uuid": "8d3fae36-0bc4-44ac-aa98-1866c02b2df7", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598961, "uuid": "8c849d48-dad0-43d9-9061-fc5d16ee2287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598961, "uuid": "3be55116-3f6c-4c14-9322-726ab7c72fed", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450899c9-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624472, "uuid": "ff2fdaa7-d2ca-470e-a6ca-57ed1fe5299a", "comment": "Malware payload", "value": "1e3397ed26ed73741cdc884ff99fd751", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624472, "uuid": "4a7d95e0-4139-4a0d-b5bf-310bdec3322a", "comment": "Malware payload", "value": "5820f1666911c85243ca8646d996320055603a3e53ffbdf0ee5bc9a71061f11b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624472, "uuid": "23f0a314-c233-4cd6-b195-5900b4a1fc44", "comment": "Malware payload", "value": "c910107394ecb2e3c6bf53702440c812472e89f5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624472, "uuid": "295797f8-27b3-47ad-9ed0-bec11c78e8ef", "comment": "Malware payload", "value": "3daf4b3fa7113e1c2b619095e54da27ea04bc532e607003c01de791e342de98f271d6a369eaf7d55963db85c025be93b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624472, "uuid": "5c475fef-0d89-406b-b7c4-e8fdbae2b3d5", "value": "T19B84E0B362FC063BDD2B92B3F114D9561CEC17E291C7661664AC46CA5C837E2938933E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624472, "uuid": "01546c1b-87fb-4527-815d-66efae649e9a", "value": "6144:Kdg4yisOlhfxQwLD3SsahlPdft7oe4cXZvz1bZhEtQzDMBZkOP5UC:6OSl7QeDW/5h9HXnnUQzDMBX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624472, "uuid": "cf8dc883-7b76-412e-adcb-2a1db12a3c6d", "value": 384067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624472, "uuid": "64f816cc-4849-4cad-a028-5be0dfa722dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624472, "uuid": "5719c186-09ff-4498-81c1-2458659835db", "value": "Quantrum-Clientcracked1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c67f253-3bcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776587923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587923, "uuid": "3f2a42c5-b679-4b9e-8e8b-314f2155869f", "comment": "Malware payload", "value": "f969cb5a3ef84c5b3ecc1e2a6f8975af", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587923, "uuid": "0f1d71b0-9ab0-4c20-8959-89e5fd2a8a24", "comment": "Malware payload", "value": "592812b68df1efc605a8d0c6b51e9083e90d4460e1ab65ce7be7a1c8719b80a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587923, "uuid": "810e8b01-ac6d-49c0-bb73-f6eaca644316", "comment": "Malware payload", "value": "933ea749f35fc01d0531834ae09a2b65bc9343af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587923, "uuid": "d579d364-7095-4aa1-b1f7-a2c1a257804b", "comment": "Malware payload", "value": "832cfa50ea506ab4e53b63049cf57703ef2bf44c22e55fd71f5d4f967ff2c9a2aae641a06fcd14a7735d68594867c266", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587923, "uuid": "2edc99ab-5488-42ac-933f-60a5d8642652", "value": "T1C137F002F2F901E8E5BBC178C6635517E7B27855172097EF16648AA92F33BE06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587923, "uuid": "df038a97-beaf-433d-836c-0cd9a7574577", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587923, "uuid": "9c90844b-0107-4bce-8af8-dfd589ff0c81", "value": "393216:rdrz7whrLIk6GC7YTUNM4LGCEqJS/j+Pin786h1VxU7W+dxe:hg/N6GC73fLGClAiPin7f9U7W+do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776587923, "uuid": "3c1dbfde-b714-4a2f-9d87-835024f654ac", "value": 24424180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776587923, "uuid": "f0d45369-2155-45f4-9aed-5b417d1904fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587923, "uuid": "b21e9867-d9e2-4ae9-820a-c3e36e970140", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89689fe1-3c1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776622439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622439, "uuid": "1c34a984-98bb-42d2-ac0f-630791cb883f", "comment": "Malware payload", "value": "bcf707269f018cbe3e8532242ce8feb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622439, "uuid": "95e37836-6981-4382-a8d3-00f45af4594d", "comment": "Malware payload", "value": "5a0bfe4a04c65370ab29d3d1dd461a32abbb6fd7e1a233da7fad503b44521c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622439, "uuid": "db6a0cca-df0c-4bfe-b0c9-c9685be20cd3", "comment": "Malware payload", "value": "ce9f5427aea22e3bdfa7e32c29938d0a11b7a2a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622439, "uuid": "a05e0101-58da-469e-be9f-2d836cc1c7ab", "comment": "Malware payload", "value": "a023e01d0abb4be333bf9095ea10b6574d32d11437da74b2ef9d2232f5c950026f032b72565f1e255b774d05ae1cfa01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622439, "uuid": "75a5850f-756b-44b0-a84c-03f3fe62415b", "value": "T1F1045BA8BA0F6C41F1C2D3F9DE4C87E17E1735E3C77689B1781212EDCAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622439, "uuid": "f30884ea-49be-4a81-af4d-e1870aabf3b2", "value": "3072:TlPmnrnMzjlIImTyKGakNoGs7N/OdCVpv4MMkMPoq:TlPmnrMzZIImTTG9oN7N2qv43LPoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776622439, "uuid": "1a44a622-9d85-4c92-ae8d-1dc808aab799", "value": 186352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776622439, "uuid": "153a4832-fc4e-4a92-9235-37c55372b0a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622439, "uuid": "7e676e51-5c8e-4a04-87d4-2c5f933c4ac8", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a76a68c-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624507, "uuid": "bf018df9-254a-409a-b17c-68842715f207", "comment": "Malware payload (WeedHack)", "value": "96585174d34b206ce1fc61dcdcc51c46", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624507, "uuid": "f265542b-21bb-48d7-a22f-6982c0612603", "comment": "Malware payload (WeedHack)", "value": "5b2d6095f2d26881273bffb4b9e1f80e214fa66a38c94cfd51a37bce7549d404", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624507, "uuid": "e90f92e4-1254-4747-9187-bc6a9d1269b6", "comment": "Malware payload (WeedHack)", "value": "26d95f57a426d8314a79b3f7954fb9150f7b65d0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624507, "uuid": "f70fa2ae-2661-40f9-a402-a5abd1b908b5", "comment": "Malware payload (WeedHack)", "value": "9d6a7e67279158183dd647612b8e6b50ffa538866c26e83c964d03a02795980a4f4563681384a3307a5d95b5568a6566", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624507, "uuid": "dccf980e-a07e-4057-9959-73552f570d0f", "value": "T12166225EE97E07A1D937E17FD1021F22BD5C82CCE186B05625F806E6089FB8A4F1879D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624507, "uuid": "11572c9c-c142-4825-80ea-a92ebd87cec5", "value": "196608:poo2dWRcKXC/WCD8l/wuWcJ/PqPzHjRNnPrc0Qzj:poo3RcKXC/lwl/Zg99Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624507, "uuid": "6a3f3410-1e44-4b8f-bfd9-db78691e8581", "value": 6994717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624507, "uuid": "a5faa6a4-73e6-433b-a196-146b0ff3f3c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624507, "uuid": "4fc4c78c-596a-4969-977a-00ddd3da2dd5", "value": "ThunderHack_NextGen-0.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb92f92-3ba4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776571259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776571259, "uuid": "11de3ebc-010f-4fde-b273-a84c3b3e7efe", "comment": "Malware payload", "value": "3e0af71640891607322a255169459d0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776571259, "uuid": "6ebacbc5-e932-4251-baf2-fdf2f4183b43", "comment": "Malware payload", "value": "5c05646f0bbe588ecfefddcb405467257ada960950179dfbf1e997f9d3739033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776571259, "uuid": "58b214b7-c8b7-4dbe-aec9-3ed7b86a79c6", "comment": "Malware payload", "value": "aa55b6ce514e62d7bbf9802d4773238cd43d0de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776571259, "uuid": "07b194a1-5c3d-432b-9557-2dfd0925d51d", "comment": "Malware payload", "value": "ddcb9dd8f62e8e5e435c2b15ed9596c8d0cec2b5d42a5d9365f7996a045980d6708306fe89bb47163a60350ed5609d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776571259, "uuid": "fba8cb73-6937-4b55-b7ab-65a1692775ab", "value": "T13F57CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776571259, "uuid": "1de67a71-c6cd-442f-801a-28fd35ceacef", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQs:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776571259, "uuid": "dfb62a46-2555-4363-a9ba-df9188a5304f", "value": 29065216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776571259, "uuid": "387c4b3f-3d89-42d8-8802-f8d812048c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776571259, "uuid": "06e83c86-6b49-43ed-a032-2370bb8c9305", "value": "5c05646f0bbe588ecfefddcb405467257ada960950179dfbf1e997f9d3739033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5eb162-3ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776573055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776573055, "uuid": "fdc56b64-c12e-4b19-a504-9d58c1c67a1f", "comment": "Malware payload", "value": "ba8410d169d9ec22ee3f750b3de045e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776573055, "uuid": "69c95454-ea3f-493f-83bd-31dd9ea9bcc5", "comment": "Malware payload", "value": "5d6e2d1f138dac8523650b4bfb54905a4b2209c6298bb3384fcd232324801525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776573055, "uuid": "aca80062-c93d-4c1a-bae5-19aa573317da", "comment": "Malware payload", "value": "38aa40f20c02368a776dc4b70ad5532db6b60c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776573055, "uuid": "5c13b3c1-b317-4668-8b78-10efa669bcfe", "comment": "Malware payload", "value": "34075715bef9ea1f70cdd060cfe11f66a7fce4b9e8e36b7972d657e7777ec03b47b2449827e43dceb2b2da9c02178da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776573055, "uuid": "ccc40fe2-081f-4404-9509-7140dc99347c", "value": "T14EE69C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776573055, "uuid": "8ec2086e-cd83-4164-b8da-88ceacf5afdc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776573055, "uuid": "8525594f-50a5-4ce8-b6c0-d2ca1b2250e4", "value": 14548992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776573055, "uuid": "eb4f7704-393e-4444-a205-22fdb7834bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776573055, "uuid": "b778403a-402f-4259-89ca-1c64a53de5db", "value": "5d6e2d1f138dac8523650b4bfb54905a4b2209c6298bb3384fcd232324801525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3b3c72-3bb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776576996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576996, "uuid": "bc8fd5c7-3516-449e-b7a2-9d40f9fb991b", "comment": "Malware payload", "value": "75e6f11b0be542fb2c9a6e24c578df30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576996, "uuid": "0d804fbe-46f7-4c1a-a862-8d236bfe5faa", "comment": "Malware payload", "value": "5fe3070afd7cd502addf3c3e689f98c21b61a531e7eeba2b5b35f159dd64ce3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576996, "uuid": "17637061-d8e0-43d4-a5c3-bf8f171debe3", "comment": "Malware payload", "value": "a1abcadae969a318b4dca3072e69c74ae588580e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576996, "uuid": "37cdebd9-d700-42f0-9f90-49a12a2d9a3a", "comment": "Malware payload", "value": "611713867b83347f93f3d743695fa1e58ec50b42410dcbc941a0955ca74f556da87219a4c054756ab90807ec82a92611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576996, "uuid": "583d8b2c-7ec9-429b-b3a7-3634a3b5a3fb", "value": "T130266A31328AC46BD07616F01E2CA9BA961DAE360B7144E772DC7D6E67784C31632F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576996, "uuid": "9dbf03b6-b101-4ab8-b1ca-4188047eab22", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576996, "uuid": "f03b5cf5-86c9-406b-b8ee-8ac7e1d8fee8", "value": "98304:FQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJyXSnLmFpXAg:FQN5tgqSsl/oL+Tqv146w9DbFXSnLm7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776576996, "uuid": "303919c3-34f2-4545-9708-db9954fdeb76", "value": 4686220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776576996, "uuid": "0d4d8dac-cf90-4dae-a382-3870fed7f7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576996, "uuid": "dfb22f31-8d28-4d00-bc8f-0a330e998cba", "value": "After Inc. Revival.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ab0fd-3bac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776574894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574894, "uuid": "669c0b11-4068-4c32-9998-e102657b245b", "comment": "Malware payload", "value": "4860c76d0e98b8f15e2a6b40b323f079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574894, "uuid": "113afd26-6312-4726-b323-ad1908551db6", "comment": "Malware payload", "value": "60a9b2405264e6720a94d5b12348e9e7038ae6a4dc566b6c53ac2c3c02de74ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574894, "uuid": "493bd5f2-236d-4156-902d-e80da6f02a78", "comment": "Malware payload", "value": "20a165c1eb816ff4ad7d55d49e70a41c1198ead8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574894, "uuid": "48804182-81d8-42bc-9ccc-5b1c43d4fbd4", "comment": "Malware payload", "value": "dc6ded3011fd16d950cfaef9466f45cffb8f3807df5f6ede434407dcac2fa5ba4414012e24ab7bff5aa2f1fe25c084f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574894, "uuid": "59a5d4c3-0f70-4947-8871-7d120cdb5b13", "value": "T1A9866C73945624D8E1ADC974D5141212BEB8388B573863CBBBC476F51BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574894, "uuid": "c444cf32-8ee7-4c2e-a829-311a41b61df7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQs:cqYUQuVDt0TZEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776574894, "uuid": "9979d48c-7feb-4ec0-84e3-e691c7f269df", "value": 8126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776574894, "uuid": "05e98fc0-8b6c-4a01-aa9d-144a4b1811e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574894, "uuid": "dfde64ea-01bd-4713-a385-09973c322d8b", "value": "60a9b2405264e6720a94d5b12348e9e7038ae6a4dc566b6c53ac2c3c02de74ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4c2423-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578345, "uuid": "ad0adb7f-a254-46a1-8612-c59f151404ee", "comment": "Malware payload (Mirai)", "value": "0126d82d0593a7fce13bafa78fa5b08c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578345, "uuid": "b5a7d74b-0410-4fd1-a459-42c95a15b236", "comment": "Malware payload (Mirai)", "value": "60d7685a5e6621f5e034c41df9cab63b59b71dfa7e4d33cfaad48ae635bcecf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578345, "uuid": "31537319-0fb9-43cb-9e75-70c8d0234482", "comment": "Malware payload (Mirai)", "value": "cbb776777020f137f0fe1f2d820e1970db79f9d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578345, "uuid": "66780222-7bb9-40ed-affc-80c1722c2242", "comment": "Malware payload (Mirai)", "value": "c45f84e43b2ae4ebacc4361f631e9cf655806ce187716fdb381d6228771b24e111899abf9daf84061c5526aa52c8dd54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578345, "uuid": "b8bd7815-c99a-4b20-be62-c2eae6e4d005", "value": "T1A7735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578345, "uuid": "05eaa842-7b38-4853-9e19-75372dd2039d", "value": "1536:jP+SbCGR18pspTH1yDQ2tXXUN95s0xwlWptCMR8/pW:zf4yV8pENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578345, "uuid": "c9cf39c6-2831-43ff-a8a5-a5934e639d4f", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578345, "uuid": "2530ba34-31b2-42ba-a178-be2fd0836cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578345, "uuid": "d24f79ec-c17d-4c9e-a373-35cad1c35101", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2802872-3c28-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776628064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776628064, "uuid": "e89788b7-ff26-4105-84cb-4f714e6daa47", "comment": "Malware payload (SalatStealer)", "value": "562f8fd0c85bc02f36909ce78f5f59f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776628064, "uuid": "50d5c7a8-eadc-4318-a24b-548959a20a57", "comment": "Malware payload (SalatStealer)", "value": "61aa79fd39a47238d1a8597501eee0e8bad49a86aa93eba77c90ffd5891ef41b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776628064, "uuid": "497dec68-1472-4ba3-8a4d-eded62ab836f", "comment": "Malware payload (SalatStealer)", "value": "6996f39a0936a3af5feba2865cf58bc69424098a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776628064, "uuid": "db30688d-f624-477c-86f5-8588e7bc68c7", "comment": "Malware payload (SalatStealer)", "value": "4320b51c01bf32b95c293297062dcf5d6d6611f7d176bbe39af9ad50393d2956d946b2507c437ee8d7907d3619cc8e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776628064, "uuid": "b253db67-fba1-4df1-b9a4-a4051902c9aa", "value": "T180C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776628064, "uuid": "22be4160-a01e-44f0-a135-93248d99ca82", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776628064, "uuid": "f0805af9-eab6-4031-acae-a3b5a4d04d1a", "value": "49152:oBiYLtcEUP6VAs2Sf9JRToDCMChlxFlxqyr/6vgJsdbkkVew3mp03eZROdwvfZOm:RYRcNSfrd4CXlTRMzSXvGw4VDEvO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776628064, "uuid": "59a8ceba-dab2-49f3-a18c-c3414e02a916", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776628064, "uuid": "2f75d2c0-2458-4220-be48-632cd6e1579b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776628064, "uuid": "1c74e9b8-dea0-4551-a9a4-6e4dc955c4a7", "value": "PTClient15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7b4ad3-3be5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776599389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599389, "uuid": "9bade44f-aef8-41a4-aaa8-254a5c2a90b9", "comment": "Malware payload", "value": "b203668f0cfbfd3bd06ce7f4f1b68d0b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599389, "uuid": "ab4790c9-74d4-49f2-86b7-309ed4aa7d1e", "comment": "Malware payload", "value": "62db863c13494f24e4be08df3962466a15a32bd078dea6ecb13306c400dee1e4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599389, "uuid": "0675aa39-118d-4086-b4a2-5d09d4568b79", "comment": "Malware payload", "value": "025a4d85b585857220162d7431dad738805e1a64", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599389, "uuid": "4c332555-f427-4069-a7dd-248dd44548bd", "comment": "Malware payload", "value": "01c3d8acbeb872f817fef95446446087163717b60c5cded3018ae430963e4575cfa3060a56fbf6cbaa9704569f15d62d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599389, "uuid": "03d6ed0e-45e9-482e-af7b-f9d553044d35", "value": "T19CD3DDCDAADE84A48B5F64284A1F1C128ACDA137061DC9C0BEDEBF543F115B139FA9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599389, "uuid": "799ded00-bce7-49c1-88d8-a4ea79cddee7", "value": "1536:IgQkQ4/uioPe1mfXF46U7tX3dS/JCJ934YmcDSsjl:TDTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776599389, "uuid": "e1b4fe9b-1ced-4483-8f92-216af6476cbc", "value": 134371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776599389, "uuid": "ff3db852-c901-49c0-8b11-df4bfb3f5a3d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599389, "uuid": "d36aed50-f254-4fe1-a3ed-b7e07d349b2c", "value": "Quantum_Journal_Asia_7662.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed0e65f-3bdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595604, "uuid": "6d9e52a7-5764-410c-9f22-c06e2d497028", "comment": "Malware payload (Mirai)", "value": "7805caaf65bcb21b637274e2cf4b1c9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595604, "uuid": "4907ef95-1204-42ca-a654-96d181dd7623", "comment": "Malware payload (Mirai)", "value": "6411d990948b96e8347a053611e6d4d178f995e913d973404ea7fd8d07b442d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595604, "uuid": "8ee6b9ba-cfb4-4617-9184-909614fbbc9d", "comment": "Malware payload (Mirai)", "value": "3a4f46e7263b0e80e91d0dd89d8aa52d213b5c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595604, "uuid": "5ec81383-f833-44a9-9826-01c56b4c1fb5", "comment": "Malware payload (Mirai)", "value": "19c1e7361d72626b35ebba01d56e78fe8ec1a5e73262fce1e51aa828eb01d071795d651a8908f4ac6fd74297766faf0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595604, "uuid": "01c81285-3ad6-49db-aa1d-1ed389c11083", "value": "T173B2DF3C1B121B98DA1EC0BD839D0B613DB41B2591829D4B6207BDD7AF968B47493BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595604, "uuid": "35162231-d4e9-46b0-974f-d9496e76bfd2", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiymdtJgGlzDpH7uNj1JA4z:YeD8ZSWvZHZbs1row697qohQvg9yitJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595604, "uuid": "d1f70044-2c5a-4ef7-983a-60ed67123297", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595604, "uuid": "9be746c5-1c73-4fc6-a2d6-e40390c46d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595604, "uuid": "a77afdc1-cd48-47db-b9ae-6d7b9e081d6e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc7b166-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578557, "uuid": "e5d50ba9-5ac2-4b32-b389-bc51fab063e3", "comment": "Malware payload (Mirai)", "value": "5a766f57fed16449aa6973cc0d7327ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578557, "uuid": "44d7f799-e2bd-41fe-9d0f-42188f6f3ff7", "comment": "Malware payload (Mirai)", "value": "65b9ac19a73bac53ce9393720ba22a141006208a9ce0b33655e6fe5c96b43bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578557, "uuid": "9a293c36-b423-40b9-959d-84301a6870e5", "comment": "Malware payload (Mirai)", "value": "05dd0a1df7f7654fec091be90347cd276da4d122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578557, "uuid": "d41e97b9-8564-4110-9d38-812e3790ba22", "comment": "Malware payload (Mirai)", "value": "12fe6cca41378c069d1f2bddb740868bc1fa48830986bedc612f44cb9c4486671bc3bc548425579d8064ca50eda4a495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578557, "uuid": "4cb2a80b-ad95-4b98-859d-9c17f565cef0", "value": "T1495312269403A8B5DB637D73BAE04FC3FA0A4B73B5985039215531A8F6F85612CB22D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578557, "uuid": "cacea974-6142-4e05-84ea-d3974e5cece2", "value": "1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyTILSM5Tfv83KJGTb6R4b:qdpssMPR9w4y8LXTX83K0Tb6Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578557, "uuid": "52dc1433-6eca-4b8b-b316-52c5779b7fd0", "value": 61840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578557, "uuid": "5a4ec7ea-0a59-4430-a17a-a55972946cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578557, "uuid": "cbb0a7d2-568e-4d8e-ac6a-b5438babe8cf", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098687c1-3be0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776596884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596884, "uuid": "d8cbdefe-d4c0-4415-bab1-d3332b427c3c", "comment": "Malware payload (Mirai)", "value": "a2e28b26861d7b0830e2f23c93bd8847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596884, "uuid": "27fcd810-b96e-4e84-b719-890e16e14e6e", "comment": "Malware payload (Mirai)", "value": "666a72be748db10a1e1498dd0fa51c7a4db618ec7ecd332997f80bf82c776caf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596884, "uuid": "feac5e4d-83c0-4b4f-a023-edf9a331e579", "comment": "Malware payload (Mirai)", "value": "eccf35375de2a31f8a4f891b9a7205895d550f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596884, "uuid": "aadf8dae-6f77-4eb8-84eb-b474d013e8d5", "comment": "Malware payload (Mirai)", "value": "86ec3b50cd7177769c7c17fac6b7dad76b14ce6c7cf694d0ce84a32241a065c159a27403dd288e58f9bfbcb4426b67ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596884, "uuid": "e99b8b79-86c4-45a3-90f4-137f53b55a7c", "value": "T115336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596884, "uuid": "d281df27-23f3-4838-97d9-62aa6d032b73", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776596884, "uuid": "34f36ce4-788a-45c5-9b53-19cb9d84100e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776596884, "uuid": "0de503dd-c89e-4340-b290-839ff4ebc33c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596884, "uuid": "1f30af62-1b38-4f72-92f0-e317d25a30c8", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a23ac3-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624464, "uuid": "e57489f8-5486-474c-8d80-05e3ed537345", "comment": "Malware payload", "value": "52e15ffabae8ab7268a2272dc73911eb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624464, "uuid": "92ef041d-0fe0-4c29-a49a-0ee3974b07d0", "comment": "Malware payload", "value": "666e892939273fb698f54eb1c236efbcf57d97666d18947be24c9b6eec4b95bb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624464, "uuid": "b56b0b3b-5f9c-475d-9b8c-509abc1b9d0e", "comment": "Malware payload", "value": "c3bfdb0de17039f8b74cb3df6e0c4f3376f5c495", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624464, "uuid": "c211ee40-5d25-4b0f-a3b5-df8c6063fa36", "comment": "Malware payload", "value": "68ed44b11057e83a07cedd7339abf33049dc9866dbfa214f336c9295927eff3ef8271035b3d2f2ec88b4a44588bb5dcb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624464, "uuid": "3ffa79e5-5fe3-406f-b3ab-497b6f3fe6ed", "value": "T182941263E0B70D30CA0BC977F247ABB77D2C109191872656345A890BDD27CA3679937E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624464, "uuid": "e69bbc3c-e218-47f1-87ed-136646869d33", "value": "12288:leBCw1W8FPfz6A8/NqAw5WAcN5BKeNJ2B:48VPPl5BN54mJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624464, "uuid": "14258cf0-2f63-4729-aa53-66b1f6ba6e34", "value": 408411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624464, "uuid": "53054983-f257-44b6-acc4-e4210dfad7a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624464, "uuid": "aa4950d4-4e61-43d4-8463-c8a893da8e39", "value": "OpSec-1.0.9.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2691f6c-3c25-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776626910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626910, "uuid": "d181a8f1-c07c-4d21-909a-8b064f3e9516", "comment": "Malware payload (WeedHack)", "value": "3b2d793f9a10c682c6539287f48e0644", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626910, "uuid": "649bf323-c042-4909-9d71-6ce328863fa9", "comment": "Malware payload (WeedHack)", "value": "67956925064568976430a27020b0f5e0be99726a64f21bbd91939dc05513a674", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626910, "uuid": "c8e695fd-2035-41cb-b91d-d48abf71aae8", "comment": "Malware payload (WeedHack)", "value": "e1637b42c75ce805f38456457d8d395d9a7610b3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626910, "uuid": "b91700f7-502d-4d0f-8dc1-f3b2264cdacd", "comment": "Malware payload (WeedHack)", "value": "5b8b199ceef2511d0f21caac301186fcc93e47417bd4f0981c82761bd2fc7a3f725a52a3cc27e0cebe793c1ead061915", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626910, "uuid": "d1d41688-17aa-49e6-b7b2-3fcf50c25b1b", "value": "T1EAB2D093C4729426E45AAE3030C2AE6F7E16438AC5E7B14728109D2BD4FB68BC996352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626910, "uuid": "0ff0e439-29b4-484a-a6f2-ce783cfceb32", "value": "384:bR3w9gntaxnK0A4mgheBhEBnYsX1iCCVlYkMgpzXYV2gGAkCLU6T/:bZ9nIK0RmgqhatiC+YoXQMAkpq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626910, "uuid": "d9e8e331-1f4c-4df8-9897-cd44888b1626", "value": 25663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626910, "uuid": "49bc77d3-059f-4453-8613-300e8da0ce20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626910, "uuid": "735de33c-57e2-47d9-8202-4537c9821256", "value": "Dupe_Command_V2-1.21.111.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5acf4b3-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635371, "uuid": "15983132-15c1-4ae9-9d1a-0dff2219d5e5", "comment": "Malware payload", "value": "a294c79bb3218c5f956e44f402ce6af9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635371, "uuid": "3d84f627-6daa-4ba1-952b-c86b7b345890", "comment": "Malware payload", "value": "68a23ce82435b4a5ae7454e033302bace4c81d6fd023edc6b0ecf96eedb37dab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635371, "uuid": "de814e19-9e93-4819-8011-6bfcac21ff86", "comment": "Malware payload", "value": "e05751df418c70b966d36c030dcfe2ecf08a9831", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635371, "uuid": "beb52262-f010-4d7b-bca6-8772992b505a", "comment": "Malware payload", "value": "17c4a08a4913e0caffe153d87290dd871611fc29a535ff3365a6bd1db5e01b949ef746dc6de12c749f28f391cde0cb4a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635371, "uuid": "a154e1d1-56b2-49e5-ab63-5b8ab65d1685", "value": "T116953326392A9FA17063A11C57CC985FE4FA60C5DFB121C984411DD4CAAF36B8E0DFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635371, "uuid": "5fc5f426-5ca2-4286-a753-c91850ea733a", "value": "49152:0JCMrptOqRWrDUgK5ulC+1fKOYrTBUaW6a/U/jZ8h97:06QWrDUKt11YrTnja/e837", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635371, "uuid": "180d6098-8e59-40ac-8c9d-63c8b6811804", "value": 2043453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635371, "uuid": "04eeb60a-4db0-4fa3-a54f-db8fb9dc36a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635371, "uuid": "779b0f61-2dd2-48f9-be17-720fe91ad980", "value": "Alt_bypasser-4.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c491995e-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598916, "uuid": "70bc6e06-3193-4dee-b395-db51ea625cea", "comment": "Malware payload (Mirai)", "value": "6ae2368f0eb015733c33568f5b050889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598916, "uuid": "83639a9d-a870-4aa3-9c92-1e68ef2ceb58", "comment": "Malware payload (Mirai)", "value": "68e76ee280f9ee1a8058e6ae096df03f3262c99118405dbbf71fbe2a956c8572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598916, "uuid": "cca45493-d355-4e3c-aca6-5c45807e375d", "comment": "Malware payload (Mirai)", "value": "237219fc962e65869f0cd167a99f01e6e973cc88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598916, "uuid": "b7d745ba-6383-4824-b075-5713c68b04fb", "comment": "Malware payload (Mirai)", "value": "0b68414d6e8a5214f6779a3b2dfe556e3deb2732d2a38a7e30f4b5667d90ab4ea5a0b1855a6c21cd2d35d418e9cdf9d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598916, "uuid": "7f223255-a915-4b8a-b8be-1541918d07d1", "value": "T15FC32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598916, "uuid": "02260e4b-d850-46eb-bdc7-c35badfdeb9d", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZdI+oV+M/900i/:eU/44TMKFx5oFxh0nyI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598916, "uuid": "d86fdaa8-909c-4ebf-a3f3-7f9f48021070", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598916, "uuid": "97afc89c-ce15-4159-94f9-662dc9fef5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598916, "uuid": "9af96a1c-e317-4daa-bf8a-1e553934c267", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc8e2bc-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642549, "uuid": "cddacb9e-1c1c-4808-9943-2142168ae762", "comment": "Malware payload", "value": "be607205f9cccd820c6aad0402d83911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642549, "uuid": "4fff704a-e096-42ca-b98a-4ff8fa9655fc", "comment": "Malware payload", "value": "6993b775414c63276857ea4ebb6798d8609724ebe9e661ad47d7adb7f554b0de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642549, "uuid": "a4816caa-f585-4778-94bf-1ba1daea8586", "comment": "Malware payload", "value": "471237bef0615c308d8ed0b059299a8792643fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642549, "uuid": "a5707a00-fa75-4db5-81c2-ac8819a05c0d", "comment": "Malware payload", "value": "a96ec070e31f087fe5bc75bfae39c900980593357042ef69788107117d9470dc9e284b543b07982e2b3daa0a0ed604ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642549, "uuid": "8a0ee7bf-2ac9-436f-bd39-1c949ae4769b", "value": "T1F833F11261CBC746D02B113D3CAF7B166520B249E3B417E4EEC8B17B9DF47617A29B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642549, "uuid": "7e3226d5-80a7-4a8a-9d23-2377b5439ad7", "value": "1536:3qiwmhfKeDdOcjeELg0H1hNNZyxN6TYxnouy8Nqb:3Wm9husg03NGIuoutgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642549, "uuid": "351562f7-224b-4eed-b372-b0d1a9495cfc", "value": 54572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642549, "uuid": "f58a6e4f-d88f-44ae-99f1-c87e5c978238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642549, "uuid": "44975e9d-e33e-4503-93a7-9a64a263842c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e07f25-3bbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776582053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582053, "uuid": "4fba78ae-00e5-4839-98fd-b3c85d497ef2", "comment": "Malware payload", "value": "196b397deb38970a7228ffbec52dd0fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582053, "uuid": "178dbeea-c9b8-441c-880c-e29579ef4a9b", "comment": "Malware payload", "value": "69d2cc6584f3e273192c863f027dc8d618952a6a40e98fac6533aaa060115ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582053, "uuid": "4d854a20-ca41-4da3-8dd7-55fa7b176bcb", "comment": "Malware payload", "value": "362d24d92c1f3b0112ccc414219be6291b7de810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582053, "uuid": "4ae95ee3-53bc-4a4b-9083-72db7e1f68f8", "comment": "Malware payload", "value": "6105c8cb75a195d3a8c1f820ebe397bd06b2b73cf891445a4a178df1e8f5a21fb9462cf4330c8d6ddb7a24ecf2709d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582053, "uuid": "059b0b3c-6fb8-410a-95a4-7cdd60795083", "value": "T1B5968CB3945224D8E1A9C9B4D51416527DB83C8B573873CBBAC471F61BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582053, "uuid": "a37e4a39-8e22-4340-a06d-9280b6177da2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0TZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776582053, "uuid": "b22cbc0c-2bef-4e6f-93ae-1be56184776b", "value": 9371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776582053, "uuid": "38df1301-53f8-4b3d-b94d-4214d3654bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582053, "uuid": "b47659b6-6a0d-4d74-8056-e82cd6892e53", "value": "69d2cc6584f3e273192c863f027dc8d618952a6a40e98fac6533aaa060115ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f722fc-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578643, "uuid": "9607416d-a10d-44d6-8c99-a9ec1d8bf8d5", "comment": "Malware payload (Mirai)", "value": "085bf6bc00dca528ad7b0cae2b7b2f60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578643, "uuid": "353d3d63-c08e-4c09-90eb-cc923ffd98fb", "comment": "Malware payload (Mirai)", "value": "6b5f7359a419bdbccb9f53af42ecbe230cc9ba0cd417a1a9e188d516771eb80d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578643, "uuid": "6fedb443-6f5a-413a-97dd-38da9d58f035", "comment": "Malware payload (Mirai)", "value": "91050136abf7bd68c546d5ad2af05e863d49f49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578643, "uuid": "d6db19c9-4c4d-4f21-8352-b8f6d270dfe3", "comment": "Malware payload (Mirai)", "value": "7d5fe4c0db530374bf8763abec233eddbd8cb13466f5b5941d76452bf064e5db280281d9159623d3c5a35b7d1bc734b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578643, "uuid": "50fce8b9-7606-4e8e-b5b2-eceb1f176666", "value": "T154732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578643, "uuid": "4c8bcad3-d5f4-4309-a7f2-f0dd5ade7ec2", "value": "1536:86dz9MTC0XU66Ee/pO5brAMjztPz+Sbjt+UvAs/hY:86dS6EG+rAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578643, "uuid": "ea0cbed1-503d-4ae8-a697-2be13bb994c5", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578643, "uuid": "2a931990-1e9c-4bce-be04-c8903beef0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578643, "uuid": "0e957e19-e01d-4fb5-a4d5-ca0232173716", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53b6305-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586891, "uuid": "0a22a682-bfcc-4c1b-9267-bf26b650a75e", "comment": "Malware payload (Mirai)", "value": "a0d833e910636c8cc8a4231d55249350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586891, "uuid": "9d8674df-d594-41cb-8f2d-8675e97620ff", "comment": "Malware payload (Mirai)", "value": "6bf779b37fada9a081c5a2adb5c0799f25dbc6110e40231b5e57d7d63908e73f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586891, "uuid": "11205623-65bd-4672-b536-f4d4690e7f84", "comment": "Malware payload (Mirai)", "value": "971af4cd33ae020c7c568521419c282644b89524", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586891, "uuid": "8bcb1425-4002-46ce-841c-9f540a5d4925", "comment": "Malware payload (Mirai)", "value": "c62d63d3caa4abc064bd69365abb42756aaa16508e724b6251ca2c3cddb9198b4f1b7e1353dedd9d66508953b6d3d916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586891, "uuid": "3e8bef8d-cc9a-42ff-a9bd-469b1405103a", "value": "T1A2633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586891, "uuid": "123c0209-2ecd-4e99-9dda-2b7301edabf1", "value": "1536:9yJWBrmSTKrFuT/GwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxuT/K1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586891, "uuid": "87f4985b-3952-4bd2-8929-aa9e08cadcf0", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586891, "uuid": "daf79360-4863-485c-9962-7039fa70a4ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586891, "uuid": "6e8ef1b0-a02d-4e16-9811-bd8fe2f83d81", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f505ae62-3bed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776602862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776602862, "uuid": "5421ae00-03bf-4c3a-a759-33da77b2d7b0", "comment": "Malware payload (Mirai)", "value": "b4e27671d82e6ae322f070c28d06267f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776602862, "uuid": "80889ae4-b90a-41a8-9269-ef4bf17471a4", "comment": "Malware payload (Mirai)", "value": "6c701d0cb78138c17a4421173aa01563a9a3196227bf03d5f4dac4e4c05f28fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776602862, "uuid": "65edeef5-e3d1-421c-afda-dd3e08d1ff4d", "comment": "Malware payload (Mirai)", "value": "4e8c539a3b021045c2af0694b0ad391b8dae189f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776602862, "uuid": "3db36612-9071-4bc7-ba17-38705dd4f7ed", "comment": "Malware payload (Mirai)", "value": "7a0a2cbe3ccdf6d96beb5c0354957c45e67f0cfa0d1d8f963b015f168b992fe58e6de84a9c299a91f50504381c7fc0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776602862, "uuid": "0413fb59-183f-4cc4-83eb-1392533e4c3d", "value": "T1FB237B63C83A1E08E16A92B0B174CF7553A3E45581675FBE262AC3B99493ECCF5063F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776602862, "uuid": "e2246557-de67-49e9-817d-9d300e5d8596", "value": "768:s7gBx8oaAyewvovopyTk6qC0IuKqEETa7PFolofKqYgxo7I:fBx8FAyeU5p76qCcKqEEe7PEh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776602862, "uuid": "b0544ebd-7eca-4284-8f1f-7ab75f1c0970", "value": 46532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776602862, "uuid": "51007b36-4050-42b2-a024-cf8b4c99ae94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776602862, "uuid": "a8dba96d-e3e3-461b-94b9-5d8c9be2036a", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58703fd4-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642543, "uuid": "d146d3b4-3e69-4b25-99b6-960178e35c47", "comment": "Malware payload", "value": "b6f1a0fcb17db1689a7e4e7e9acb6d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642543, "uuid": "03efc066-ee03-4fa8-a131-6912d80e4152", "comment": "Malware payload", "value": "6f758d895b72face9f0f96cf0fbd73c8ba31a0c718b55f123947b0745eb57d91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642543, "uuid": "df783afc-66d2-481a-988c-24fe0bfd17ea", "comment": "Malware payload", "value": "c9698b34e46416de0908b181d759e447d693671a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642543, "uuid": "79acceec-3db7-4706-90e8-21cb2516b9aa", "comment": "Malware payload", "value": "a80c86e633a1a54f45f0e120907faa066d7b473ae8bc93abf3edd8a9fe072003507d59c5c30703ab51927a5cb69fcc5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642543, "uuid": "f3a9beb1-8418-4241-8d31-4598b776e801", "value": "T19CF3F971984CE6CBC53321BCA0ED9FBA8E7E72DB2B59CD017CD151309AD5EAB2906C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642543, "uuid": "582b6550-bde0-4792-bd93-a6e8a361967e", "value": "1536:Qok158gadBm0DufeGRK9rTt5dJHK+pK7DKrtwp+Vp+wEiMB1l88j:Qok+ufzwVTt5dJcB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642543, "uuid": "889903ea-11e2-4a86-9e44-d320b1a45844", "value": 166040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642543, "uuid": "fe4cc351-02f7-4ba3-81a8-89a4887a8106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642543, "uuid": "44398ae3-1dfa-4cff-893e-8b2e8331486f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33da70b7-3bf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776607692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607692, "uuid": "26fa1453-3a06-4ec1-961f-7fbffd95a03a", "comment": "Malware payload", "value": "4b32322049b0ce2013c067dcb781c6a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607692, "uuid": "5876b973-2646-4a16-920a-7f91c0d8a03a", "comment": "Malware payload", "value": "70ffe67e5d601ff18b498e2f74edd1221583d784804487a7819bbea7aa92759b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607692, "uuid": "977e89fc-cf21-4048-b4d6-efee32b7abd8", "comment": "Malware payload", "value": "82bcef21bddc176fda85d5b9a409b32bfbb0dcaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607692, "uuid": "5a31d193-7f1b-4b39-b5a0-43876e6896e5", "comment": "Malware payload", "value": "018307374aa324c5f49046397de4703227309a6a1a06e4c0eed083aa36804c93b5f89c7bea3a4fae9efe488cc94880cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607692, "uuid": "5924652a-3273-48d0-8c54-16ede9559619", "value": "T15D165B31764AC92AD47E05B01E2CEEAA922D6E360B6144D772EC7E5F17754C32232F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607692, "uuid": "c2ffb52e-ccab-4841-afbe-d1b32cef98c8", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607692, "uuid": "90a3da53-cb32-4aa3-ae97-8a0347036263", "value": "98304:CQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJZXk/XAO:CQN5tgqSsl/oL+Tqv146w9Db8mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607692, "uuid": "c84da79a-81b2-4b58-a192-f3932d1fef20", "value": 4290886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607692, "uuid": "51a7fd26-6937-4617-87dd-dc60657d59d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607692, "uuid": "03c8239a-de54-4046-96c1-88cc46a2969f", "value": "RiskyBusinessDemo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5218c1c9-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "414e3530-ca18-4f75-b8f0-cf49cd9a91f2", "comment": "Malware payload (Mirai)", "value": "291b80daf6017369c04d5fca9f7e7496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "26b0879d-940d-4d7a-b7f5-29dbbc52bff6", "comment": "Malware payload (Mirai)", "value": "712bb921a8f89af45102d9b9050453d3fab8828b67eb872fe6a6408897808ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "aa5d707e-081e-41b0-9e24-072e8eaef5d0", "comment": "Malware payload (Mirai)", "value": "954923d069938de8cb2d17515a7c8ce54ed2ff94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "663f9f35-4d37-4b5f-a7b8-180714e92600", "comment": "Malware payload (Mirai)", "value": "4c84c9ce7767f093586a6ebffc67d620c48e0ee1bb5f9fcac25b3a5c267366a32f05a6d5278e1bfdaa788c695ad90c10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "e6715259-cc83-46c7-9525-c82a5cd9482a", "value": "T1FBF2E15315B94108C16E21790C6BF98E48A08AA9D6BDC9F24F58F433C953FDC3A587AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "6c1b309b-9622-4ac8-9e24-417feb4ce40e", "value": "768:WCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIp0WhnbcuyD7UHQRju:WBGbyqhXrTBrQX4oEDhnouy8Hy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578537, "uuid": "3dfceaa9-9dbd-4424-9f76-0cb4c7817ea7", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578537, "uuid": "9686064a-70c5-4a17-83cd-f9ca0e25a09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "cbc671e4-ef54-4bd0-bf82-f6c01e7e7d0c", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7936da-3b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776565963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565963, "uuid": "874c9047-ce95-4ac4-8042-7dff50e344c7", "comment": "Malware payload", "value": "18b73fde9fe1121488f8d265b643502d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565963, "uuid": "9a72eb64-b830-4dd1-8d1e-c59ef6586479", "comment": "Malware payload", "value": "718a77dce32d0afa630df0f1e67721b214db14c4888a1438de5f283cfe58dab9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565963, "uuid": "768a8feb-314e-4d57-b5aa-884916343058", "comment": "Malware payload", "value": "710cd9821d0f1077faaa94eac2e89bcd4f127bb7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565963, "uuid": "be41dc95-f16f-441c-918a-11e8cf4b14a1", "comment": "Malware payload", "value": "0e3d43410024e811dfa8a45ff7f487d6c9023f5c25754aface652de655c14e97b4afe6188274cfc5b105ace41dc500dd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565963, "uuid": "794c44dd-a286-4602-92ca-4b93bc898f62", "value": "T1F351C2205FF90219F6F3EB31ACFA7B069E7BB852E5054E5D004043090422910E9A5F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565963, "uuid": "bc8ca8fa-2670-4ec7-8dbe-6012bb79e027", "value": "48:8pHaNtgvxowNA5AWSu2YMSbpd0dAKR+/KRCO4:8pHlDNA5lMupdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776565963, "uuid": "2f606b7a-2359-4d78-a00e-0016a19f78a9", "value": 2504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776565963, "uuid": "67861835-8afe-4498-9c38-0073b2c6f0b2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565963, "uuid": "56e5b853-4825-4f94-a0f4-8dbc7b1143a5", "value": "Doc_8cad60a7-7106-4c60-9b6e-dcf8d77f40c6.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1108f150-3bca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776587448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587448, "uuid": "16352427-6aa0-41f4-ae4b-bd6edcc90483", "comment": "Malware payload", "value": "0e9cb1cc55d041d140055d5ea5d7c4be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587448, "uuid": "86006a53-a516-48e8-a5c9-198ee92cf4ed", "comment": "Malware payload", "value": "71e446c7cb1e7eb7bd7c11a08ec7f37d7b65db00eb0e0c525775d9f2c2d8dc2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587448, "uuid": "790aa9fb-397c-40be-9bfb-d2e7b6537559", "comment": "Malware payload", "value": "7b2815a78a6645312dbfa948e0a1591006134bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776587448, "uuid": "15dff028-cf12-4a97-b4da-339bdf8b075a", "comment": "Malware payload", "value": "8475f5165fd3d4cb4d50774f140d50f25b818310d42cdd1249b34b6abeb8875c953945764561652cb1ad09510e6e7a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587448, "uuid": "43f0d7d3-8727-4f4e-b651-a96be5facf76", "value": "T1C5C68C73905334D9E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587448, "uuid": "00859948-61ee-4042-892d-ac43dbbda135", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQz:cqYUQuVDt0TZEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776587448, "uuid": "35f4cdc5-283e-41fc-aa0d-6e0c04aebf1e", "value": 11534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776587448, "uuid": "e89357d6-2d08-4e1d-b9eb-3a99c79e6a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776587448, "uuid": "9416ea2a-0062-44bf-b0a4-2ef3dd47bfef", "value": "71e446c7cb1e7eb7bd7c11a08ec7f37d7b65db00eb0e0c525775d9f2c2d8dc2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f86be4-3c41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776638786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638786, "uuid": "d65c8052-34e6-4f46-95a5-3b63343d5700", "comment": "Malware payload (Mirai)", "value": "012b918f0155432df0f006ead7afce2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638786, "uuid": "8f59c5ba-c560-4d2b-96b2-8f3a73ff1b06", "comment": "Malware payload (Mirai)", "value": "741f160563312e533b9de16a4f1e5bd8360f508ecbad13d29684606c55d8a65a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638786, "uuid": "8f627526-289c-45b7-8f60-d2fa7c19cc3b", "comment": "Malware payload (Mirai)", "value": "25fcb35ab0f48c5ccb71cf8a38dfecab897f9c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638786, "uuid": "dc03c31d-a156-40d1-a721-4e64dac17b58", "comment": "Malware payload (Mirai)", "value": "8e2bb79119ef2e1ef4d49af092f993ce955a1e20fe734e394d24dc76e73ff2c54cf267fcde841f0ed9dcd7b61a604d9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638786, "uuid": "a9eee97c-6379-463e-83c4-3fff7a9baaf5", "value": "T1B2D3AEA7B30F2451C42507F41BCB5BAD2A2325015E2B96E72C6E363F6A775DF28063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638786, "uuid": "effb1190-e66a-42ee-a895-f8331a1d3487", "value": "3072:7aYt06HpX5HN5eFm2AAHjwb8Bd3UgaCBYIwJXDq:7aS37HOFm7kMbcd4CBYIwtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776638786, "uuid": "1fff81e7-36e8-4a01-9531-dce6363ef48f", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776638786, "uuid": "1906cc6e-7b02-4b63-97b4-d684f14fd8d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638786, "uuid": "59ffb773-8e78-44c7-9154-f954d5c32fb1", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dbf25f-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598886, "uuid": "8d5b64c1-e5f1-4366-b03c-5befa3899ced", "comment": "Malware payload (Mirai)", "value": "f13092aa118024f6fa53382049e26a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598886, "uuid": "16b7f9ae-0a38-4956-b3e8-aecae2b6a703", "comment": "Malware payload (Mirai)", "value": "743722b02dc5adc93f53a49dea1280ce7a0d2da4befaed81d90877dbadca96ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598886, "uuid": "6c85593c-13b2-46fc-b593-f568c187c546", "comment": "Malware payload (Mirai)", "value": "5a1fd2de45d50336b31cb5116bb99ae2d0310287", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598886, "uuid": "f8d61a6f-b116-4966-810e-77c898b8ad2e", "comment": "Malware payload (Mirai)", "value": "38ab5d5d17d054d4bdbc296bc7f1a2b2b9e80d9f64db33b21e6490d44ffac78ad1aac1b0b7e783954112a42346dd1672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598886, "uuid": "81e522a5-77d8-443e-8fd9-cc487b6b7d9f", "value": "T19EA2E11573A32D56F3ED1C3CC96A8367F9A61BFCD0F6327679415620C90D20A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598886, "uuid": "da56a1e4-31dc-4601-97f0-00762600bc16", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjas8ewhymdGUop5he:TvQn4j+ZO5fKAlxfws3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598886, "uuid": "87abde1c-9b36-4726-9bb8-06cbaf3f7207", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598886, "uuid": "8624df7e-2747-4f62-af20-b0404be9a116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598886, "uuid": "2681d019-a00b-463e-84e2-970bdae55e8b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62729e99-3b96-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776565250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565250, "uuid": "ad3b1f58-6e48-4c9b-8b9d-751c535b15b7", "comment": "Malware payload (PhantomStealer)", "value": "f1c334c3572581bf39f4615da2928e9e", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565250, "uuid": "48337853-bbf8-4295-b5af-22af6aa7b03f", "comment": "Malware payload (PhantomStealer)", "value": "75f0abd06f38675e94516a796ed8b82ac084e658702a423e6b6f21cfd27407f8", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565250, "uuid": "b2ace2f0-60b5-494d-96f2-7acbd946810f", "comment": "Malware payload (PhantomStealer)", "value": "4ace5fbed0a9fe6a3dd3796ff85952ea71d20f80", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565250, "uuid": "d326987f-67c3-4eb6-bcd9-335be364d98d", "comment": "Malware payload (PhantomStealer)", "value": "65855220700d007c694c8c04a248fe78a39ec20f0a15e9d3a1e4f2a6142b73c102bb1c587afc75ca4516354c73742831", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565250, "uuid": "207b1038-fea6-49f4-bfc5-41d07daead7d", "value": "T11E92E82689095FF409BD6272298F1C52E5110792A776390EBACED4AD3F3E361CBC11F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565250, "uuid": "405a252d-e729-4824-a041-191c9ac26a88", "value": "384:KFdOwWjveYlKCh90xfOcK8ao893Z7g0Rm:K/SEYSxfOc6oO3+6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776565250, "uuid": "9c16b91e-d73c-483a-b3dc-b476ea535a78", "value": 19804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776565250, "uuid": "1066beeb-3e73-4abf-abf4-dcf50b73261b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565250, "uuid": "3489a9b8-97b8-4c55-80f7-9a7d8b8aaa1c", "value": "Payment_Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca26988-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578689, "uuid": "f179718f-c169-4f63-8b0b-8b7af15041c7", "comment": "Malware payload (Mirai)", "value": "ecaefb5b5a804ec793d237f0ab819a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578689, "uuid": "d99b352d-90a1-4626-88ea-cb155dcf9675", "comment": "Malware payload (Mirai)", "value": "7680f180587e05e484ee3f3ce020c1a0b28a8b4d63e06fd4edb0a49dde1981e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578689, "uuid": "f13dcde6-96c8-4249-9572-e43de30a57d6", "comment": "Malware payload (Mirai)", "value": "6b3b2de8008200915edd1154cef8b365a2e45e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578689, "uuid": "207e618d-7c42-4fe1-b096-537fa73826b8", "comment": "Malware payload (Mirai)", "value": "77da447fdab7bcf7c1c9aae2ed812a3e94b26709af41c6a45c7ed5391a3a2cf1dbfd918d3d66053a835f8a392f1500be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578689, "uuid": "ee09ea65-cfb0-4c8d-a298-338f1a0d328a", "value": "T18D13199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578689, "uuid": "249261d6-e265-482d-9038-beb9cbc98c90", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwHoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578689, "uuid": "325ad872-14f0-4ba5-b2b7-7734591bb027", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578689, "uuid": "ab4cf605-6e7f-4e97-9862-912764971b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578689, "uuid": "871fb251-68ee-4831-adf3-9a972f58c554", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7383586-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598893, "uuid": "1558b01e-733e-4173-b1ac-2b97c0225fb7", "comment": "Malware payload (Mirai)", "value": "27cdea0d786b16db14d89e3620cd26a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598893, "uuid": "dd7c4d7e-1829-4a5d-99a5-898ca7519f2e", "comment": "Malware payload (Mirai)", "value": "771aadcf43022f7a83447f5d283a433a1494d04bf9b0672fa213f7a197d6469e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598893, "uuid": "9bbc03f5-1e67-49c9-947a-7379d082ebba", "comment": "Malware payload (Mirai)", "value": "a32e161518ad9d5503f5dbf17e5497b8cad86cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598893, "uuid": "b995269b-19dc-4bfd-aa96-bb86468ab90e", "comment": "Malware payload (Mirai)", "value": "2addae9a1f2daf6e96473e35407bdeae310231361a788b97a9b43b12e1384b15530c2092fff071690fdbd1e67124f5f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598893, "uuid": "db88b19a-78f7-46f4-919d-eaa1d0d596dc", "value": "T1F782DF3061AB74E5CBE04434EAEECEC697160BF8D1FC36E317586B78894610661F93DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598893, "uuid": "06a1c6d5-87ac-4e1e-bcbe-b9c5c45e74df", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaSKhymdGUop5h5lI:2dV0P6+kom0tVAoNvm+to1SKs3UoznlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598893, "uuid": "628069e2-768d-4cba-885c-96c27f6e1009", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598893, "uuid": "0b914406-d7e7-4f03-ad93-3b130ea36b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598893, "uuid": "5a70b271-4b04-4b33-981e-c6e6257a6329", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f329f41-3c1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776622878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622878, "uuid": "8498ccd3-59bb-4b04-abde-404774e01eab", "comment": "Malware payload (Mirai)", "value": "87ec8eef253db199e9b3581199fdc0f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622878, "uuid": "efb55d0b-82b8-4eb9-a6e5-39ab2515c29a", "comment": "Malware payload (Mirai)", "value": "777fa7a5ce1ddb68c68425f0fb30702240f9798b77909e91eab1264cfe0534e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622878, "uuid": "53ad545b-8c07-4b36-9e75-7eff41cc02f3", "comment": "Malware payload (Mirai)", "value": "4e2000217c882be448bd1807426d5ea327ae356d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622878, "uuid": "9d21045f-9b18-433b-8593-e767983d53dd", "comment": "Malware payload (Mirai)", "value": "ffe5ecf7723b648a1cfe00f60a898f1974d2e639e9f8094e7abfab08ec2d82e185d42bb0f7f8a7d511d7bafaa0dd3776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622878, "uuid": "af030f38-f7ae-45b6-b987-cba467c25c71", "value": "T114E3F7C7F900D9BAF809E7374853080AB130B7A248925A376257357FED7E199147BF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622878, "uuid": "730cf165-7e73-4017-af05-676ed47985b6", "value": "3072:Zo8ut4vWSDde+QPyWaYW5P0g8VF2gehfQJNQtVxjbixLlJeWYP2Tet:Zo8lWUePyWXW5PD8IfmNQULyget", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776622878, "uuid": "7ff0bc71-7d63-41e4-a544-0747ae0fe470", "value": 156504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776622878, "uuid": "9888a051-b268-4e8a-b8f2-4bc63de594c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622878, "uuid": "d49e1552-c77e-4b09-b14f-bd5bd997a07f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137a633c-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624388, "uuid": "c21d6890-16bf-4fbd-a061-237692fe96cc", "comment": "Malware payload (WeedHack)", "value": "88c10a04780bf87375b4bc4e040d86b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624388, "uuid": "a7ec1b63-fc31-4937-b3aa-4b38132b3f08", "comment": "Malware payload (WeedHack)", "value": "77f79f4ba6edb627f1edece692f3f22700b327ab6de17859fd93daca855fe4e0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624388, "uuid": "572fab06-b7d7-4528-8baa-7aa1c82981ad", "comment": "Malware payload (WeedHack)", "value": "c3dcd506eed973b7f2f2c869ff483ae1f4a5ce31", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624388, "uuid": "a357dec8-a8c4-4b02-8af2-8946f97ec380", "comment": "Malware payload (WeedHack)", "value": "f9bbaa5b1fe1e746ec3c7e9050c7b46c6b1a16ce3981e3fe2ce88dd1c0147b19edbebedd1945517a24d1c28df20fac2e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624388, "uuid": "e63dfa36-b55d-4be7-8d24-ebc3a5fe36c5", "value": "T14B3533C9E405AC73E6E3A17F41290B12F3AA1BD653C547CCA4505984A7EF8AEC9125FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624388, "uuid": "17aa9d62-dc3b-4e49-bb98-56e822f407f2", "value": "24576:EVOp2OEfFL9T3zJ7UbS1ceXOcJe/kMQ4NfRBzSxHD+ZPZ6m0:WOkFNj1JJesD4HBMHa7r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624388, "uuid": "3fcc207e-5130-4972-82c6-e55b2abbf9df", "value": 1152547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624388, "uuid": "ca4eeebc-5a65-479c-a1f6-3a2ae78cfde6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624388, "uuid": "9eac38ff-43d3-45cc-9423-ab757bfd3afa", "value": "Donut Duping-V2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257e04a9-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578462, "uuid": "0f2c829d-90f8-4363-832f-8ca7e27fbd67", "comment": "Malware payload (Mirai)", "value": "00211464ba3ca0bcf7a8e1975fb5aa12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578462, "uuid": "66f803b4-e382-43d6-8fe0-b8abae597fc5", "comment": "Malware payload (Mirai)", "value": "780c11a514b2be34c72edfc7fbeac0404157e6f64809576dca680ec89f21d252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578462, "uuid": "102b6dc1-faf6-4dde-aa27-2d2584e72e9d", "comment": "Malware payload (Mirai)", "value": "a5a12077622c5719d67aa53755bc0ad39a2ab789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578462, "uuid": "6a71ef2e-d786-4f73-b6f2-3f2b80ca85ca", "comment": "Malware payload (Mirai)", "value": "60306a28f0fd4d361baa81c17fc670a94122db6141ca25de1737ef61e73e82b30c748695cccbc6a3242662a0e1f01413", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578462, "uuid": "d2b77f2b-9c9c-41d3-bfc5-4ac8120f44b8", "value": "T1FE03D145B8A0B056C65F1C3F638901AE19A4F2D575493B7BA328CC89AF37C1F958DCE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578462, "uuid": "6311a6e9-fdd0-4cbd-9af3-e93f4d106c15", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0WGNXufW8:zl5JnsrXvrKy9QjyBZLvDmR0AV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578462, "uuid": "d5be9ef3-7925-4560-9293-78ee693be2ed", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578462, "uuid": "95f0208b-9b80-4c83-b870-b7969da2ca79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578462, "uuid": "bcddffbd-f06c-490b-9dce-ab88ac917cb8", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d5b448-3b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776557871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557871, "uuid": "ea537ea5-b6d3-440a-8c9a-361892fc9168", "comment": "Malware payload", "value": "3b8890ecae55953693870524845e57c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557871, "uuid": "7abf2690-d64b-4693-a456-2a7bb1cb54f7", "comment": "Malware payload", "value": "7850f6bf33609593b790e274080b2dc69d7e368037077d47e8bcb0c6a287a1cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557871, "uuid": "d7767f78-76dd-4747-bd82-832636f6a659", "comment": "Malware payload", "value": "65fc37012085a9290d5466e758291c160c7b01e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557871, "uuid": "98ba81d8-bfa8-445f-8901-5ba6e0c80056", "comment": "Malware payload", "value": "846aad0c8fcf957ba795de72e9b5dea2687a5dbdaa68b2184fb94764fa2a357381f36a5cb51a38653908b78aad00cbb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557871, "uuid": "b11646d0-3827-467b-8538-e0b9933e9094", "value": "T155B66C177A69E70EC61422301EB1DA94676A0C9601D7A527B355F309FAF30BC8A6FDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557871, "uuid": "178353be-4e05-4522-be73-521314024ebd", "value": "98304:yhtd7ieQLkDpYxnUjEwm7eIrmpViQu6HMRKm+m3yfV:std8kwnvwm7gFLTY3yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776557871, "uuid": "6766f362-1bf5-4b7f-a28f-6b358b64acac", "value": 10986707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776557871, "uuid": "3fa2bc74-b234-4af6-99a2-f509fc62493f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557871, "uuid": "79f6bf3f-ff56-4281-84f0-f543b70f2b55", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fa3a4a-3b93-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776563938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563938, "uuid": "627b7f87-a50b-4f05-b34c-ab5c840cb63f", "comment": "Malware payload (WeedHack)", "value": "d0b26993d7cbf04cb3a07a1cd9436306", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563938, "uuid": "b18513a0-c539-4601-a222-ae40f3d27a8c", "comment": "Malware payload (WeedHack)", "value": "78a41e1b6a01674046976348c8d41b274e7051eb2952e538d2e67f81de381589", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563938, "uuid": "23770d25-e682-4bbd-a46c-eecc63454f0b", "comment": "Malware payload (WeedHack)", "value": "cb064ac05103e47e17c2317528bb336eeaa8ae9f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563938, "uuid": "aeda9855-3e28-4c7a-86fc-bf05918bccdf", "comment": "Malware payload (WeedHack)", "value": "e460af80fe10c841b93f6bc866d2ad2d8af344233d076b9e82000c2cdaf262f817831e32e0980d05c6c32b6481cc62d7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563938, "uuid": "1599bc59-2cb8-4c23-b560-e84cb23a483c", "value": "T1E7C2D025D121DCECCD0F8B348A8EEA36BA0F1F05A547306F74A0565319E76CE7B88358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563938, "uuid": "2a9b9317-ba4d-4128-8159-6c4e3bacab4b", "value": "384:V3w9gntjarMYKCBiHuYJBRKm44cPKt4ginVEpszfNDAws0cN09sjpfe5mOBq/D:19ngiHuY/v4NC6CWzFDG5N0e4mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776563938, "uuid": "30124f50-fc82-4879-9181-84710c26f793", "value": 25721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776563938, "uuid": "dcf16f1a-28f2-49f9-b2a0-ebf8877114c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563938, "uuid": "776604af-36ba-428d-9b6c-033492d2d5d1", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72637908-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578591, "uuid": "781d6793-135b-493f-a4b3-d0a7c55be252", "comment": "Malware payload (Mirai)", "value": "f939bd0f2b4616a813271ad64f3597cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578591, "uuid": "4cda12a0-1022-40fb-bf18-0a5ee7344f8a", "comment": "Malware payload (Mirai)", "value": "78dd7f789bd2943eca0f4453a88e31440b61de6248b2043bbd2a860929b8868c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578591, "uuid": "d0eb6df6-842b-4ddf-865a-2b3e10421812", "comment": "Malware payload (Mirai)", "value": "bd383bc9356796d6b8339daf29acd88997734132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578591, "uuid": "487702ac-8572-41b9-8c73-444ed5f0b511", "comment": "Malware payload (Mirai)", "value": "9693b2014861bb2ed4d7a0f44a6135027591ed3de68f5ade07da15c3341919683ceee50ddd159f15c3cc0ca5e4673609", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578591, "uuid": "defab203-e0c4-4390-875b-66582059f07e", "value": "T11B83199AF800DDBDF80FDAB74463490EB931E3910A931A377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578591, "uuid": "e4e605ae-7f34-4e34-bfb7-f3f53b8bba97", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7I0n:4G5hLsd9lJP4npeqp+psrbI0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578591, "uuid": "cd648077-b2bc-4749-a712-bae3c13aba0e", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578591, "uuid": "cff68445-693d-44c7-889c-b210812b40ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578591, "uuid": "9b0d14be-11ec-4313-b450-4b53f733ac26", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bc3868-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642530, "uuid": "083cc5f8-91d4-494f-9125-63da7b18dc58", "comment": "Malware payload", "value": "d266f33c20ed6f0dc879e338594f541c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642530, "uuid": "fad098f7-c3a5-46bb-8984-b85a6cc4f06d", "comment": "Malware payload", "value": "78dfad1f534247d81e7e96133cfc9b685999afea3df010c0196083da38f091d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642530, "uuid": "d5cdb8e0-ad0c-41d9-8bca-f55b68d1b50f", "comment": "Malware payload", "value": "4431e601d8239d4622d8468fd358bcac800b3afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642530, "uuid": "116e9e29-e7a0-4f2a-8d0e-d540106ee755", "comment": "Malware payload", "value": "09d64e5c15d3c99f6e4dfbe9218cfd6f7b70c2c0ba4105f34b112e6899bb5f0e64e1bbeb9d3b8a5b33216808555b4334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642530, "uuid": "0b4dfede-dca8-4620-b1c3-88ab61c6aba6", "value": "T15E4301DE2ED93CC9EC386B3BACB52A906C42A1727186D79997C50A34377660331D7D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642530, "uuid": "f3ed78a9-87c8-4652-ac11-675616a1faf5", "value": "1536:BH6voSA5cKDsP88F2cIKFV0z93sSVTNU87E/xAKbyy:wkJDskKoJ3PZS6eeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642530, "uuid": "349091a6-816f-412d-b61a-d0646c08d0e5", "value": 59540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642530, "uuid": "b839812b-1f5b-4343-b878-fd79ad36e40f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642530, "uuid": "6e14b8f4-91ef-4676-b67d-2f06c30b51c1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4306aa1-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586970, "uuid": "7f57eb38-2672-4197-8680-b30563474cf5", "comment": "Malware payload (Mirai)", "value": "d0104dff90dbd5834119da020c90026e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586970, "uuid": "e71d2e90-1308-49c5-82b1-46eda7204e9f", "comment": "Malware payload (Mirai)", "value": "793ac74cb0db7f4cb74e0b3bf1513ff8480debfbbb7752b07208d760c28ddc62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586970, "uuid": "29824f72-102b-48e1-9a07-a58682f9bf74", "comment": "Malware payload (Mirai)", "value": "344e6c2a927177eedc86182e7df345a79b844a23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586970, "uuid": "8014f3f4-106c-4b5c-926d-ce6436eebf7f", "comment": "Malware payload (Mirai)", "value": "42ef04028d50d121f1489572cd9e892be4756275e1561d89b1b939b37f6e790722d367d6ba6ff465506907b0675f97a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586970, "uuid": "e3340a4d-9c76-4fe4-862e-217e74be11ed", "value": "T155415312D2E8CD73C7D312BF5683AF491717ECD300D1EF1B9A9818429D361C4E521B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586970, "uuid": "235777ce-ba7b-4513-a076-2683bfa178f3", "value": "48:fyJ5sSi0SL96DwmrSpNHxOUUUGNnZtlc98y:fyA8SoRM9Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586970, "uuid": "29e4821f-3ce2-4aa1-8023-618a633c7ba8", "value": 2217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586970, "uuid": "6ec5b437-a8f3-44f5-bd95-c11c005f06ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586970, "uuid": "a2247ad9-5f3d-4a65-9188-6adc71a6bd11", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dc548c-3c0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776617148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617148, "uuid": "983c04c5-f8e4-43fa-ae09-3dd9f8dee62f", "comment": "Malware payload", "value": "e105e3172d2c752f1e95c72e9cb87968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617148, "uuid": "6cafd433-f143-4e91-b99c-87e0d44b6841", "comment": "Malware payload", "value": "7982e01652d96f73c939c4f480fb0e283b0afb72bc5de17ffed3e7ad49871d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617148, "uuid": "fd30c2e5-4ee1-495f-9297-527cca554e6f", "comment": "Malware payload", "value": "cd4e57fef4ea9f431d55df0ebcbf422e03572292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617148, "uuid": "b07997d6-cc33-487c-acd7-56e178abe43b", "comment": "Malware payload", "value": "fe98979b889780928b170517985abda056a2077a800d5e7821089a910b3e0a3327e606bb302236a540c7c334a200ee4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617148, "uuid": "47536fa9-d733-4844-81c1-17c4b2236601", "value": "T1AB835B0933E44E91E9FE0A7B0A7291154372E5925F13E78E8EE1589E2F733828D0D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617148, "uuid": "5bf8f961-42dd-4b05-953d-d1becbbc76e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617148, "uuid": "2545cc5e-5e3c-424b-b312-1310483d2c7c", "value": "1536:gJwsHslhVsETri9gF8CILbpL2rCufRGqTomkQXg82bgV:gJwNToCILUrCufRGqTtkQXg82bgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776617148, "uuid": "ed845ab0-acf9-40a1-a48e-57ff7fa73c76", "value": 85601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776617148, "uuid": "e47f1fdc-5394-426d-a532-f6d8458b8d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617148, "uuid": "79ad4a38-e6fd-492b-8ce4-1a181325f9c2", "value": "pok.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66b389e-3be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776597657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597657, "uuid": "9bdcab3e-9901-4068-a18e-a33d191d2eb6", "comment": "Malware payload", "value": "b40eed1ab0771805ad4f537787d14726", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597657, "uuid": "2b9d8aac-695c-44fe-8aed-f0d6fd7be8f0", "comment": "Malware payload", "value": "798fe047f03fc3f2c90c7e0be764b6cfce47c8310697ec5a380b6ec6bad1f669", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597657, "uuid": "62bb5a94-59a4-46a0-980b-e12a2625ec93", "comment": "Malware payload", "value": "110fe39616931ab01e287e2441d213e977e9c64d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597657, "uuid": "d8b381f5-2a96-4530-bbc0-46f9eaef39e3", "comment": "Malware payload", "value": "b3120ee5109bf6b8c8ad5c234c61c5e70bb30efc37ff5df3c5eb9614b68a0e3c5d820c298e1f98f44d99a79a963777f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597657, "uuid": "89d73fff-47e0-48b0-a53b-3ec0da61d5d2", "value": "T126136C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597657, "uuid": "6d8587db-4fc0-420e-b375-862cd3782aa2", "value": "768:b/s9NyXsZztCD9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bUHusZBcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776597657, "uuid": "d7f95120-8bb6-4569-b889-e430e65022ed", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776597657, "uuid": "58c60d4b-fbae-4875-9831-06740e2aeb13", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597657, "uuid": "3a1c51d6-0ee6-41e0-8159-e0f9221b3012", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0d91a0-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642546, "uuid": "103dbdf0-6ff6-42d2-a584-d37d926b8c1f", "comment": "Malware payload", "value": "209392d47f918a6cbc41d4a4e443fe39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642546, "uuid": "e8513b95-3a01-4350-9fc6-8ed652e1971e", "comment": "Malware payload", "value": "79e30a42f867f3919d55dc7866e1224a3fed15a34c971fbf71c8dae07fd7e44d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642546, "uuid": "77ea04dd-118d-4a37-b192-579168c1624e", "comment": "Malware payload", "value": "e3339f81deb9d6ed014cc7a1c4e658eda155919b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642546, "uuid": "12404765-8212-405c-aa86-301241c322b6", "comment": "Malware payload", "value": "1522f84056df17aaf42dea575899f841ebcf1589af808caf79a5a1f9451e4a14a0586d0aba3aa5e53273c520ee5b94af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642546, "uuid": "c5cdbe0c-6eff-4e6e-8683-301045e7006a", "value": "T161141E32984CCA87C526127D60E9DF7A8F7E72CA2746CD227CD450348AC7E9B7916F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642546, "uuid": "557d5f60-3b3f-437e-823e-c81badcc26fe", "value": "1536:RDbu6O8e8x9W+K2eMpczBKn5Wjl8UdNSCtyDbizTlK+pK7DKrtwp+Vp+wEiwbB9J:xbu6O8ey9DK8EInnUdNSczTyt9atU4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642546, "uuid": "7c058a15-6c03-48ec-b36a-e2c6fe1b11ed", "value": 190560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642546, "uuid": "a3358345-d7cc-488d-8c03-f7b17803e8a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642546, "uuid": "27afbd23-531c-43e3-9a98-2573c9f9f661", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6f5e03-3be5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776599385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599385, "uuid": "dcf3caef-78cd-454c-be13-c2e6f94b8256", "comment": "Malware payload (Gafgyt)", "value": "ab7711ca64f06d07a6f76f361458a89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599385, "uuid": "6d76f1d7-5924-494e-a7c5-8be7b9b59dda", "comment": "Malware payload (Gafgyt)", "value": "7d118a9c48e9b0872cfbb4f96fc8663a18b659cbabb629a3bdff39652179c7a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599385, "uuid": "748cbf87-0f85-4e15-ac26-059e648c6b02", "comment": "Malware payload (Gafgyt)", "value": "c5d2d66b55e7358d4bbd5b8578b240546a166263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776599385, "uuid": "b0a959d4-d029-4160-b6ab-756319e820a1", "comment": "Malware payload (Gafgyt)", "value": "2e72a4bcde5fa2bf914b0487d61662c45ed713f3576d7ac3064b7741f328238a367d37cfbf8c9cf039879622bcf70d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599385, "uuid": "89f031a4-a151-424d-a79c-5555fb101ddb", "value": "T1ED63D50AAF654EBBDC6FDD3706BD070530CC594722E93B792874D82CB65A50B4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599385, "uuid": "edbc1bf4-f89c-4955-8229-18b105d59057", "value": "1536:fGQuan44XqjrlbpmF2o8AUVckfHZxbSESWZeJNuebBZBNYnj0C:eQ5nPSbpmofmEhIdBjE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776599385, "uuid": "aaf8a96d-909f-45bc-b74e-1acf53270122", "value": 68476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776599385, "uuid": "a78db112-0459-4ed3-a48b-3d38eb2facc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776599385, "uuid": "fcfbfc79-658b-428e-ae11-aae40268333b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c4c303-3c15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776619822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619822, "uuid": "26908aeb-c257-4b04-84c9-acf60cb273e6", "comment": "Malware payload", "value": "91acf462c8d349eac85bed578b466ced", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619822, "uuid": "a9c04fd9-c106-414b-89d0-c09117b0b3eb", "comment": "Malware payload", "value": "7ee9a3984a4301ac683c4313fb6e12f71b1bf5b10efb09910244f04d9fa7fe63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619822, "uuid": "b8e19c9c-083a-4d21-b633-12c1a297b9a6", "comment": "Malware payload", "value": "048d44468f84252dfd15bc014dbe790c3aa63b5e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619822, "uuid": "8d6abf02-bb56-4634-af39-deb16922dc91", "comment": "Malware payload", "value": "bc9977987d603e8a5df7e20318f1eaf02d6832656cbc61e3795c9667424d84db8bad656326b1ece45f3054310e2d89ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619822, "uuid": "eea8a2a4-910a-48f1-a017-81777b95b90d", "value": "T199136C6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619822, "uuid": "7d1fa0c0-9888-4a3d-9287-ea450925cdb0", "value": "768:besXRWNGxVac9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bLlxURco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776619822, "uuid": "8d8c99b9-a03e-469a-84bf-985095a7c00f", "value": 45538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776619822, "uuid": "4566f01b-a454-450b-a066-9458adedda5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619822, "uuid": "8dec121f-705a-4e70-9346-dd8efe0734b9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6d7c49-3bb0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776576358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576358, "uuid": "9dd4faff-a7db-4ced-8aea-3366a30f4435", "comment": "Malware payload", "value": "daaecc5ef69fb343f08dbf20d6dba91b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576358, "uuid": "21b82f7d-1c3e-4733-8a52-43368368b5ff", "comment": "Malware payload", "value": "7ef876ae5dd95bbdb1808538f076948b2f8ef7adf549c80941efa5668c9d6a02", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576358, "uuid": "a34b2c0f-5a56-4a09-acc9-78de8b4869ad", "comment": "Malware payload", "value": "5feb02f570dfccf4f4347341d7a2aa536fd97de2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776576358, "uuid": "dd9166a7-3c5e-4ee4-9a7b-f72562aab75a", "comment": "Malware payload", "value": "d71d32cc5195157ba1b152382d15c47a740c26632ba6b376741aef3dfdb764b3dea937ed163d1db4db442ed0f032fa35", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576358, "uuid": "9999393f-3c7a-461c-9aed-abc6d70e321e", "value": "T1A1D314894F9E44FCC75BB834468F5D83868DD12F171EC8527B9FE9423F26A1860AB5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576358, "uuid": "72a24e7d-d40e-4782-8591-e5b1a2fe6053", "value": "1536:UCTff6AdglbBUgJFBJlWxuIOgjDqosuoB7NDRRujn7:Ux7UgJFBKzs/B7NDRRu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776576358, "uuid": "4ea22200-4df5-4e6b-9ecf-620b6c674ac0", "value": 131666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776576358, "uuid": "4e049372-9f41-44a0-8d3d-0a473964590c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776576358, "uuid": "8c820cfe-18f4-4481-baf3-fbc306211224", "value": "X_Journal_Summer_8710.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcb9567-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776642552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642552, "uuid": "9918ea8a-bfe8-4a07-a07a-97226b5e39d1", "comment": "Malware payload (Mirai)", "value": "b28af6593996ff904fdcfbc385408a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642552, "uuid": "67ce4cfa-14fc-42d7-ae17-4790d7b2fd07", "comment": "Malware payload (Mirai)", "value": "8112e45d20e0cd2f620524a7bcdc4386229b93a5991ab531ee149238ba58c9d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642552, "uuid": "cc36ad74-975e-48b9-a0e7-553c743bedf9", "comment": "Malware payload (Mirai)", "value": "37862715f76cfafbb1b6d6cc7f748438bb910835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642552, "uuid": "1830ce83-5701-4b5b-8509-c6bcb4e04905", "comment": "Malware payload (Mirai)", "value": "92292581c9f23e0208742a1b422f1e19bc255e90fd722f83e82375720a59d4f980d6a7c2063a186eddb6ac9e92ffd017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642552, "uuid": "ffece071-1d49-427b-af15-e86e3438f80e", "value": "T106145F72A58CCAC7D426727E60E99F3ACD3F73EB2705CD117DD1243689D6A9B2806C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642552, "uuid": "27325960-cb47-4de6-9dd6-7e745295a26c", "value": "3072:eqf6QlThpAQVoE33sAyrEBT8Ix7DNCiCFCfCwDV:Rf/ZhpAQVoKyrsT8IdDNzUqhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642552, "uuid": "3dd78409-4c87-4cb8-8d93-aa242b881a23", "value": 205164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642552, "uuid": "a4238eed-52d4-4ae9-8291-10afe2acda31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642552, "uuid": "4abd4c44-cadf-426a-b497-6a9328b87cb8", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51b3521-3c0b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776615613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615613, "uuid": "1797efca-2c0e-4534-8aea-588d07877fc0", "comment": "Malware payload (GuLoader)", "value": "ac0cffd05fb3d019fcfef51febc3e29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615613, "uuid": "ff1721d0-fc84-4fe3-9644-f42fe7714219", "comment": "Malware payload (GuLoader)", "value": "815c846bb94902deb159aaac331fe0ac0cd14874520766677bb7c95300e8efc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615613, "uuid": "bde8db7f-f195-40ad-aa48-8127ace06d21", "comment": "Malware payload (GuLoader)", "value": "5cb9604b95eb6de1800c9dc34d39b55389ea2050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615613, "uuid": "4554e83a-c9bf-42c1-804d-c3b1849718e9", "comment": "Malware payload (GuLoader)", "value": "1e5aeca42bdace0f1d23f3089daf274fcb290c108a483c529ed864cd03e67bf217040e725aea5701c1e297adf2d35146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615613, "uuid": "4ec017d9-dae7-462c-9e52-905a2c3a9829", "value": "T1EDD4F1D3F92090D0D821D7B4CCBAE9F6137B7E29A990692A23DCBE1F3C31161455B94B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615613, "uuid": "e85ecbdc-68a2-4058-8fd0-971da1e97e9d", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615613, "uuid": "61787cee-1646-43d4-b8d5-a6bdd10785c6", "value": "12288:mX4OKQAFtsZVG354ftSNTb99upc+z+6NZY:44OksgSqn99up6I2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776615613, "uuid": "2af1209e-598b-4f9e-8d9e-aeec46849c50", "value": 613319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776615613, "uuid": "0c7bfed9-5879-49dd-a441-d62a27efe629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615613, "uuid": "9e0ee9af-7bbc-405e-84c6-0c76638f1c52", "value": "Outgoings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f171b468-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586965, "uuid": "bed91b3f-e88e-40d6-b2d0-7c5533bb5136", "comment": "Malware payload (Mirai)", "value": "846d0ed3fe3c180d25c5b58de2c32449", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586965, "uuid": "ec77fb19-a355-4ef8-962c-7466406c0fec", "comment": "Malware payload (Mirai)", "value": "8271affc813bf54e2f39a1af2d23a5dc76787ed717ee5e02752caec23b5da978", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586965, "uuid": "04785a79-e8de-4afa-bbb7-4a29411b6544", "comment": "Malware payload (Mirai)", "value": "6cbfa456403ee4b1bb9175f4382bab1cdfeeb730", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586965, "uuid": "04151205-ac1d-4a97-b5b8-98e8be60f099", "comment": "Malware payload (Mirai)", "value": "79504daffb93398da92cd7ca959fb51807f3795b1c03e050fda80951aef0f5d32ff710370ed1ecdae95044a11e4dbec2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586965, "uuid": "060da034-6f05-46d6-b621-a4d7cb351426", "value": "T10E417036F7FE4B23D861927B0AA313027B74FC4A0431A30BBA20389D9D226956F457F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586965, "uuid": "b0cacf09-4be2-4015-87e0-61b41c01f6f7", "value": "24:3vdNDq3N0yTK69khMqMA/elMSkvsKJ9lj9FmFmFmFUNo6AqAXlBT5jth3EnvB5il:TWVTrgNMivD9vUUUGNjK1hhDaE5Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586965, "uuid": "0552cb52-e9ed-462a-9464-6ea05fe5ec10", "value": 2404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586965, "uuid": "d3071048-46c3-496b-85da-2018cbaa68d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586965, "uuid": "755ab176-f494-44b5-a92f-8b25590b0109", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d127cbb2-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631149, "uuid": "a976dbfc-191e-4246-9914-8f5e41555ff3", "comment": "Malware payload (Mirai)", "value": "88a7ce6c45e67dc97301e5385c0f401e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631149, "uuid": "d7068774-cb6a-48c9-a266-8aefde036584", "comment": "Malware payload (Mirai)", "value": "82a6f04b023b3cb357074b674fceef4d5c38a2ef94e3c35ad3ea677a24c9a451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631149, "uuid": "e685327d-d16d-476e-ae21-7d47fd9bcdcc", "comment": "Malware payload (Mirai)", "value": "66393b66e16e45c0cb97a3af00c36c3b692c65fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631149, "uuid": "b3e9796d-ffb0-4718-9501-15d7054c9b29", "comment": "Malware payload (Mirai)", "value": "e6f9abe1005ce63cbd1c951a5f4060ea95474a38b5a15f78028f94cf40ca1f966b7f2aeca1369e7a487da303f4510f37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631149, "uuid": "2ba3aae2-2e9a-460a-91d1-1d12008746bc", "value": "T1BD140983B904DEF7F40EE77204D307257271BB650A531A32B21BB979AE3A2D47426F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631149, "uuid": "b81dafac-ba09-421d-815b-94a8073f7503", "value": "6144:hXgLuyqS4dixVwSmTL37Azfxcsmc6C+Po2bC2/mNPJBj:hXgZV6Azfnmc6C+Po2bC2/mNPJBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631149, "uuid": "d59748df-48bb-4601-89ec-2929cd346119", "value": 202031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631149, "uuid": "bcd28a8a-689e-4008-91ba-5f02f7c36f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631149, "uuid": "58563dbb-c41f-4036-9d69-e1c49f8f3f21", "value": "mynode.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d430fb-3b84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776557475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557475, "uuid": "baac3c38-5bf7-40b8-91b2-8430fdcfc82c", "comment": "Malware payload (Mirai)", "value": "336096bb49883e8f9c5b536f83a791e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557475, "uuid": "f97a25c3-68c5-4d6d-9414-4a92cb48f442", "comment": "Malware payload (Mirai)", "value": "83a2a81e80d50793a4e79905c44a99a78d8936755b1eeb9473abae60e4f7e883", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557475, "uuid": "d21465d1-db0e-464c-85a5-716af9ee802d", "comment": "Malware payload (Mirai)", "value": "c4294f064ae292ed65a9d6b6bf33d5eca4fba0ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776557475, "uuid": "a56e23c1-41d3-497f-a3ac-056b19472d8a", "comment": "Malware payload (Mirai)", "value": "2e7929278b1e6cae281dfe46d977c24c658033c99e3f859ed72cb8baa781ecfd21149e70e6472c523c795f445f6e6160", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557475, "uuid": "6df31dc0-102f-4efa-865c-eb8a6714885c", "value": "T16C3150C9F2601C23A8D48626B17A98C431A5D5DF81F65BDD9B9C34FAD58CE0CBE04F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557475, "uuid": "02a16b49-f517-4603-8a4d-c1510d674e7e", "value": "48:9XbPX1E2XXTjXQGXoNCXdJXbTXgsXWyXDoCX+mXdGMXv//XjFVOo1:9XbPXC2XXTjXQGXo8XdJXbTXgsXWyXDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776557475, "uuid": "91e35ffa-bd61-4548-8c0d-edf6973c1fc6", "value": 1632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776557475, "uuid": "114a39d6-52c1-4b32-9513-b7d9992d8639", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776557475, "uuid": "2949e5dd-9035-403a-8cdb-5969b1c1b29b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2699210-3bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776601435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601435, "uuid": "54cf57ad-4b8a-43d2-8956-14515a4a5bba", "comment": "Malware payload", "value": "c7b1ccf0e3f102e1567bce0165538b60", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601435, "uuid": "d85d8748-b021-43f7-a6ab-34bc872c3962", "comment": "Malware payload", "value": "83f87364e05ff509464d246cb7969f7b05e12f4ee4daaf741cc331cb92dc5025", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601435, "uuid": "ca971f79-9fb5-4d2b-9a20-be93b51ffb11", "comment": "Malware payload", "value": "972451660ad0209d5dd31e60d16bcefdb1c4c77e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601435, "uuid": "2152a29b-38e5-4b38-ad5f-b9ef268602f2", "comment": "Malware payload", "value": "be7dbec60ad3a5a43650d76ee0a4aa5929fc18c22df10aa8f09507fc2ddc715f14a9a9db28a93b87d4ce842c74bf0c89", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601435, "uuid": "d87cd5be-f804-4fbe-91c7-652dc5cb0f76", "value": "T17516E089BB58A72FC477813345E6663266874D0B8E82D7436858720C79B7AF40F5EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601435, "uuid": "8fb29a08-544d-44cb-82c7-a84f5f5770b3", "value": "98304:vzPYsrd2ZrPrZwlC53d4e56KHy7SuGs0lBep4h5E2UA:vzsEO56K/uGUaEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776601435, "uuid": "995f1675-eca4-454a-9bed-60030e3dd2f0", "value": 4041458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776601435, "uuid": "8014be59-c623-4bb5-99c5-3f4e077fa065", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601435, "uuid": "ee0574c2-e156-4b67-9bdd-cca938d608be", "value": "Android17.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44d3a92-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578326, "uuid": "64c9247f-d40a-46ad-951a-9ba1dcb85ddc", "comment": "Malware payload (Mirai)", "value": "bbf357386183ff6b613852ed3d1fb919", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578326, "uuid": "1d11911f-f54e-426f-905f-6dca447075b5", "comment": "Malware payload (Mirai)", "value": "8437ac7916d5b4a906b3669c42e606c45cc37d6b6b04340200ccb6c91b47e004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578326, "uuid": "3e5cb0f7-9032-4c4a-ae38-d5fb2d6b33dc", "comment": "Malware payload (Mirai)", "value": "8156e63a3cec6015e2f002579b4b65f13e8e9977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578326, "uuid": "29fab386-eff0-41a9-ad91-eca4cbc733bb", "comment": "Malware payload (Mirai)", "value": "78acab99a882ec8402cf1b168305f75b47f0a09ef64ccf5a356f4a4e52323208bf6fe6401fbee7cad39a60bc9fe76cc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578326, "uuid": "9c03dfb4-4c2a-4d1a-a407-200ceb5093cb", "value": "T13A539C73C8296E54D59582B4B871CB781B63B48082471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578326, "uuid": "82682f6a-e95e-4317-9f99-5de5f6d42fe6", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP6gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYSgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578326, "uuid": "8161e9ba-c536-4ae4-a82a-d6cae3e78082", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578326, "uuid": "912fa61d-4e94-41de-9e70-f08cc4b6c2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578326, "uuid": "ad0b507d-bee1-40b2-9baf-a426d02cdab0", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a32a217-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578631, "uuid": "a4bbd10d-22eb-4a94-b451-25aa802973f1", "comment": "Malware payload (Mirai)", "value": "3e6769f5e71ab03c4055d04f6fbdd21e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578631, "uuid": "7c9c33d9-6c54-45af-8bb5-1b37478ec90e", "comment": "Malware payload (Mirai)", "value": "85fb46ba0a4f629e8588c8753e2dd494e550afc5ce17193a52ef72e88a612408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578631, "uuid": "35eb93b7-c5f0-4303-b27a-50012e3c458e", "comment": "Malware payload (Mirai)", "value": "7b9e3c7327f5c4ac7979332614f64b900a79a2f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578631, "uuid": "57d30e9d-dea8-47c7-bcd8-3c1eb7c7b7d1", "comment": "Malware payload (Mirai)", "value": "963571bf127b969d99b843300e63251dd35c7b9cc43de4041f27e7a18df75e70d160bc5bcb46a0d69ed5e882690fbdfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578631, "uuid": "ed3afbcf-b144-4ae5-bbe2-119b6b6ec17b", "value": "T168E30A46F8819B12D5D111BEFE1E128E33231B78E2DE72029D246F64778A97F0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578631, "uuid": "fcfa8059-bb81-4379-b94f-ed1436f219dc", "value": "3072:tWJgI11Uf0sI5XyJS9sA2aGcYhrkxx2/+7:ob11s25XCKsPa68x2/+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578631, "uuid": "b4a6502c-ac50-4914-a6e0-40ab1040b77f", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578631, "uuid": "a7c32f63-4834-474d-9ad9-30c064ed5bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578631, "uuid": "b56fc66b-aebf-4ab1-9e97-e241edbf09e4", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7574334-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586948, "uuid": "e9738afa-dbb5-4de2-8a8b-4f3a13f02bc0", "comment": "Malware payload (Mirai)", "value": "68708091583ac4e5d05eb3a25180a963", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586948, "uuid": "a61fb58a-72d4-4ae4-95ad-325c1b302bd8", "comment": "Malware payload (Mirai)", "value": "867ea60b35d6df2fd80ab3cd343816c16d60580c70167891bcd9cf3c6554af1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586948, "uuid": "26ca8372-1406-464c-aac7-7b4fff148674", "comment": "Malware payload (Mirai)", "value": "d14bf63e35038732f7bfda5088d4f6563b21f798", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586948, "uuid": "1519fdc6-e12c-4adb-8c36-abd7d5200a6a", "comment": "Malware payload (Mirai)", "value": "0736585f3073d0b73eb0ff9b6c8df61f36b412340d5c065ebd5c1aa623b5ff74b63896679668655eeb218063e469facb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586948, "uuid": "326240dc-e55d-445f-be68-5f4b095c43bf", "value": "T156217597A0815D94EF24EB3C497106517B11C925C11FD3CF4E1946EB781B18C6AD00D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586948, "uuid": "1c6377af-5452-4bb2-bcc7-ecd6964802aa", "value": "24:wSLsYdGtSnUpzzbBWpzmsiyKyB5gDpum2E7ClikC7m17IfNf+:wesYdxnUpzzbBWpzmsiyADpumR7Cli7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586948, "uuid": "2ec6271d-17d8-41f4-b185-e367bb8d591e", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586948, "uuid": "3e781963-f13a-4b2a-945d-bdefd1d80f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586948, "uuid": "b7c2cb0f-16ce-4b42-a38a-5de633ffbdbc", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06da26b2-3be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776597309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597309, "uuid": "8c9c4668-c467-40d0-a7d6-0eda6c342a4d", "comment": "Malware payload", "value": "230437583fd91bdc166dc706fe830c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597309, "uuid": "656ce7a7-335b-4e47-91c2-39e5d174b76d", "comment": "Malware payload", "value": "869fc93a733ba9d9abc1d6b666e76f92f164ec063f120715e9de408da0dc3cdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597309, "uuid": "58556261-b46a-45a8-ac6a-e5080b08912a", "comment": "Malware payload", "value": "7f2aa01f135bdc21e022bad7d44cd4360c9206cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597309, "uuid": "1fd3a26b-712b-44e9-8657-495942dde7cb", "comment": "Malware payload", "value": "86551d2bbea7f96db5800ada273f6cdd674fcf540a78d1ad013ff36bee9f013e60954caaf4f02774edc0ceb8d20b66c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597309, "uuid": "22c3580c-9cec-4866-8b49-ca1cbab48aed", "value": "T14F562903FC5545ADC1BEE134C9A58273BA613C885B2063C33B60B7B91A7A7D45B7A3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597309, "uuid": "b1772574-45d8-43a7-a5c0-e0b6c3a4ea7f", "value": "49152:pPqH0hk84r4mf3arb/TFvO90d7HjmAFd4A64nsfJyBMbxbi0JQUwEskenUGKORxM:pPq4zUwiMxcx9fEL46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776597309, "uuid": "fd6efdbe-5596-4042-9701-ed94d738a9bb", "value": 6070256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776597309, "uuid": "7354ee8f-12c3-4f13-bf6f-3e918893b5fe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597309, "uuid": "96c70969-f145-451b-8825-60988780a05c", "value": "10dfff942805d90d6ebb28bd58093653_20251208021850.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a095ac-3c25-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776626761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626761, "uuid": "f4143ed6-fb87-4b73-aacb-c0c9f14ef0d4", "comment": "Malware payload (WeedHack)", "value": "7f97e6fdb6cf6970424037b660eb0268", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626761, "uuid": "fca11a5a-30cd-4752-965d-c7ef427ce5de", "comment": "Malware payload (WeedHack)", "value": "88ab9978945819a9f18c755643f406df9a02f0f48241b5a7ab6fba4c7d0ce225", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626761, "uuid": "26d7efe5-0f9b-4c36-a1d9-0628946f52e1", "comment": "Malware payload (WeedHack)", "value": "4ab54c6ba2e21b5eaf40b1a0afdc3b35c3a814ca", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626761, "uuid": "da586317-43a0-4577-8751-d4308ae8bd8c", "comment": "Malware payload (WeedHack)", "value": "222ace3b75cb29532d758a8ed79540c2d653b1ec3585987ad7391160b7d5dcd293f50f0dbae09a5c1c957ced7dfddfe6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626761, "uuid": "14fc44ef-6560-41fc-8ca6-dfc137209642", "value": "T1B5353346E34B8B4AC6335F3452ED173BFA5F062004286DCF429858DA8E99B1C7DAE5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626761, "uuid": "8eca3882-4501-4f84-bec8-c4bb5ef171f2", "value": "24576:jVQ0znUOKTlB81g/zAOe7yKr5nOVakfhlndwRybzyH:jVT6Lkg/zAOMB2akDdwCzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626761, "uuid": "62ce5dbc-8df0-4ada-8c4a-a2e6df6bbadf", "value": 1097076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626761, "uuid": "40c0e7cc-6294-4067-ab5d-e4b469e777a8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626761, "uuid": "b506beb9-a35d-4057-abc0-c7fd3c926ea0", "value": "DonutDupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4199d5-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578579, "uuid": "78f355a2-4dbf-42ac-9e4e-6549cafbd002", "comment": "Malware payload (Mirai)", "value": "f6e49d89d103de6c3f111bba643220a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578579, "uuid": "d6009a9b-9003-4d98-b6b2-d066bc075e12", "comment": "Malware payload (Mirai)", "value": "8939d7f3422bee3284e67ecb13267e4c3d8ae3db317ceb83e887b27883e1a42f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578579, "uuid": "bf55cc7a-bc4a-4b13-bf6e-3ded00e9f607", "comment": "Malware payload (Mirai)", "value": "98c4e824090a48738b237c14ad03246f0f3b15ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578579, "uuid": "027a117a-5cdc-4dbf-a4d8-aa6675aa84e7", "comment": "Malware payload (Mirai)", "value": "996e8d5c968c4e2e55c5ea43587b0581ecaca9bcf983f79084436b6d3d2dcab379b701efba6b1a8a9be9429d546ff3c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578579, "uuid": "67bb6364-772d-4036-85a3-bfdbcae515b9", "value": "T14D141A46AA404B13C0D627BAF6DF42453333AB5497EB73069528AFB43F8679E4F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578579, "uuid": "84ea3c62-f27c-4483-8fd0-18a071902608", "value": "3072:e0F3JNNHJBbWICaqUW0hFOOS5vFNGeT3Qm7Wo2M/REQSm:P5HJVFCaqUW0hFOX5GeT3lf2M/RHSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578579, "uuid": "22f7d656-7f9e-4ae4-b2d0-8f914dd8ec06", "value": 190651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578579, "uuid": "9f7c4eac-7d31-440f-b205-ecd8d2ce42ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578579, "uuid": "af087383-1a0a-4de8-9a59-eb71ae220de8", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb3ca73-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607388, "uuid": "c4e63306-15a2-420c-aebc-8299da9b7869", "comment": "Malware payload (WeedHack)", "value": "ac661e623a7807cfd66c3c125bc32f55", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607388, "uuid": "670a0feb-3bad-4806-8e11-3c1fd2933d62", "comment": "Malware payload (WeedHack)", "value": "8941309715fb2c6e432dfb6a03430cf797a74bef0971eb2085941816cabf71c0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607388, "uuid": "745244a9-cb32-43db-84ce-d38fca77cbb8", "comment": "Malware payload (WeedHack)", "value": "bffe24f03f6dae35da01b4ec5eb2398524672913", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607388, "uuid": "6ee968ba-e260-4347-b696-f3901612dd8b", "comment": "Malware payload (WeedHack)", "value": "6cab1391f1994509d4e013ff00a4212e1d3f7808250cbb1ecd4f985f0350aa7d92513a76398b24d8f2a294a24ac25a90", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607388, "uuid": "41274449-81e2-4ad5-bbcd-2910542a7de9", "value": "T129C4234AD02495B20076051D1CDCBF47484ABFE71ECD6628FB06AA6FCD16ACE790E8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607388, "uuid": "c6b13044-b650-4fcc-9905-08ae2e1a4c26", "value": "12288:ud89jqMvaiAK/F6n11zIQIRpXMu1Qx1xoqRNNc:ykqvm6nrxQpcu1QjZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607388, "uuid": "8e753cef-fcc7-45ba-a206-a4d2d9df0473", "value": 558423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607388, "uuid": "6996b07e-b61f-4e42-b2e6-583fa7d60178", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607388, "uuid": "a63b96bc-a7ef-45b2-bd9a-d8d02b10d28e", "value": "Prestige_Client_1.21.5-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849103ce-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578622, "uuid": "71732b85-3364-476f-96eb-6ba0246387cd", "comment": "Malware payload (Mirai)", "value": "dc88790453e030123a46f41d216c0638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578622, "uuid": "1add5bae-39ec-441a-a972-b4b8b8198bc9", "comment": "Malware payload (Mirai)", "value": "894fd61310b1f9628deb9f2a40c01ceec8d812866367db2004d2c8905153e1bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578622, "uuid": "2056a5a7-db73-403b-a74e-2024f9a1bcac", "comment": "Malware payload (Mirai)", "value": "c8ce4539e56ff3cb2c5c5ce363cae2e455ff3095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578622, "uuid": "89468f05-586f-449e-ab26-050b8f40fce0", "comment": "Malware payload (Mirai)", "value": "b1b4a0193be9c43d807d2ce9abf78432cbee95601412becf4bd18086d8189f26dfaa7acfd2e8a3165f730ce6b12492d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578622, "uuid": "8d08e60e-25fd-46c7-93f3-12b1494c2524", "value": "T14704A71E6F228F7DF668873147B78E25975C23DA26E1D680E1ACC1105E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578622, "uuid": "ad3fd997-ffb3-41a9-bd3e-4e9e2005002b", "value": "1536:fmlcW4LXVIwIM6xBS//3FRQS/Z+aiuinlvfQ9IeilifVG9b4TXDHZWupLSG9A++:8D4Loo/VZ/ZauilvfQclifiE5WuNv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578622, "uuid": "282bf9ef-c764-466d-9659-7319a57c94f1", "value": 182636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578622, "uuid": "3a59711a-82f4-4999-9f3b-143a5e94b483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578622, "uuid": "188c0cdc-99d3-421a-820c-fe01fc1ce2f5", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754ecf95-3c15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776619828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619828, "uuid": "798b3b6e-cb18-4ad2-b3da-7c403247ee66", "comment": "Malware payload", "value": "cbb5d3354738d7f5a860f5f889036c5c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619828, "uuid": "acc5c8a9-8beb-4df7-9a0a-b2f2e8042c75", "comment": "Malware payload", "value": "8a187350b253216b3a91c371a6581c6446230538d0daafe36a8c7c6e967416a6", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619828, "uuid": "1e897c5d-64ba-4893-8ef5-7a21e1149402", "comment": "Malware payload", "value": "c519ce8e4122afda6b5baff0f2456305d4207a08", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776619828, "uuid": "db421ad0-bea6-4f3c-9ced-42bb03b05525", "comment": "Malware payload", "value": "3d2adfd18d7f8517a03c155ca7b0845023380b7a6cb0b97ee60c80ad8e74704dd0cdc126644fff289844eec9810af7db", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619828, "uuid": "9df76aa6-0cb5-4846-9aaf-ed284931247e", "value": "T1B2D3EE8F5EDE48FD479B64A4459F5C46CAAF5213092DC6A0BADFBE623F21D2070D48E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619828, "uuid": "7fe6b9b4-3bd4-410a-9974-17a6bf5fc4c0", "value": "768:8ifWY2HBigX/fYXwstCiHJjXN5n3UxxeJvx91y972dJGnGfGEG1GoGdGn0LKx4/i:/WYEP9pDBbT7kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776619828, "uuid": "82af6657-ad05-4943-a3b0-d730ef76f3bd", "value": 135114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776619828, "uuid": "49b8b3a5-d077-4236-9412-be59ba5c71c8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776619828, "uuid": "7b772620-622c-47f1-92a5-d6deace78854", "value": "Security_Archive_New_8538.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60e28a1-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598891, "uuid": "7b0d9d3d-154e-4cad-9108-8d7f8cc720fe", "comment": "Malware payload (Mirai)", "value": "d10e9ea59c7112cf68e246c730fb723f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598891, "uuid": "5f10539f-25d0-427d-8aa6-d8d0a7ce2fa8", "comment": "Malware payload (Mirai)", "value": "8a93e9fefe874fae76c5006658c8f4e72e8372700879e5b3f23d29a32f91a20b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598891, "uuid": "e4d44c89-40ad-4eb6-9890-92083610ff11", "comment": "Malware payload (Mirai)", "value": "4ac61bae1999b4a51c3c895fd9a411106c4906be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598891, "uuid": "3cd360db-7b1f-45c3-822a-632e646128ee", "comment": "Malware payload (Mirai)", "value": "29f7c9faf26103c00c11b57ab78127d6ff9daad28324d9bf1c9a2f242e35d3a6ba895bf9decbae40238a09bcc30bb702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598891, "uuid": "067b6033-8455-4131-9070-3a4b2d2dd985", "value": "T11AC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598891, "uuid": "bd23b641-0203-4df6-bd42-a57eea64e991", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoYrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIYrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598891, "uuid": "9c621043-b557-4075-9e3b-2bbd50fcbfa5", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598891, "uuid": "9b32f030-d4ac-46c9-9d67-6921eac9f2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598891, "uuid": "b71593fb-b9ae-4b00-afec-398ec50925f8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2240cc-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624480, "uuid": "b831091e-cd08-473c-9cb8-58435d81cdb8", "comment": "Malware payload (WeedHack)", "value": "5d0c247f362d839ca120e8afe4adb3ff", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624480, "uuid": "3375e26e-bb09-4e09-8fa8-4fafef6ad02c", "comment": "Malware payload (WeedHack)", "value": "8bb51f6df905803f01ea0f7a201a65c144e2c274030109033a3be75c49416f36", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624480, "uuid": "ff21b361-3012-4aff-afcd-3de68487115b", "comment": "Malware payload (WeedHack)", "value": "65edba3f96ce7d47d4c8a63e248f65e40ea9e186", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624480, "uuid": "074dd60c-9d4b-4edc-884b-4924347bdd1c", "comment": "Malware payload (WeedHack)", "value": "663e398aed2b97fa335e0e87b6f30b0511454829510b529847a31fbe5da2739a7d9189931b2f3990d8b747a6b4e4688f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624480, "uuid": "23642994-4fd2-406f-b1db-357f09f2cb51", "value": "T136252366EE5BB159E0274F24FC048DE1916B7E88B8906C1C123B457FCE4B7A81F89DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624480, "uuid": "ef7fdecd-e38f-4c54-bf0b-38a22a618b2f", "value": "24576:1zJEHNsy9tKn7NYIJHJOwbUN202W/4jK63aBsd:pGt19kp7JZoMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624480, "uuid": "ebbb431c-4a4b-46f0-a957-26a553ccabb8", "value": 998773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624480, "uuid": "89e55d26-042e-426f-8a24-15edc7aaaeda", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624480, "uuid": "5c483a72-4551-4bf6-9504-d4fd70932fef", "value": "RevClientCRACKED1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dad3ef-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586865, "uuid": "732f4dea-f9a4-44f8-b683-3fec5fe1f78f", "comment": "Malware payload (Mirai)", "value": "191d47c08399bcaa00a8ef6eaa56cc70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586865, "uuid": "94414ffe-aaaf-4b68-9321-5141af76067d", "comment": "Malware payload (Mirai)", "value": "8cd56c8e9e93485e3a7b9a69fa600ac146dce8baaba63078493f58dbc46d8f23", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586865, "uuid": "5a06f481-4c21-4e84-b694-6df4116cb19e", "comment": "Malware payload (Mirai)", "value": "52bc1c65009b3d0ea680e4cdfc386b05defa8554", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586865, "uuid": "fd84ab73-443e-4429-9c9a-21a17de18e13", "comment": "Malware payload (Mirai)", "value": "a57d2526f3f69db31d3d650f6caa7869f4f3a1de900cadcd45f0154bf0e86de1b97fd96d10293f357ffeb0e8feee2963", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586865, "uuid": "a43e4c06-2412-4ddb-af54-e026e728ed35", "value": "T111F2E128F7AA5E8DEEFF3A706890A3C06771C95EB35A6D62108D2F530243487661DDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586865, "uuid": "55629197-01c7-450e-98fe-868b74101847", "value": "768:lk9hrdmlHUkwQaaqmVWt2Azd5h/c+3WqdPAVhC9XrO4q4uVcqgw09z:lk9Nd6HxwQV7VWsABPBpsl4q4u+qgw09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586865, "uuid": "86a9b3b0-4fa1-4036-a2c5-4f3447f898a7", "value": 34316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586865, "uuid": "b0e66d7e-2535-4185-a7af-87095d9426b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586865, "uuid": "254d7a5c-9136-4040-82be-b99adbf03d53", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da93ae14-3bd5-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776592510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592510, "uuid": "019c6f9b-5f4e-474a-bf79-acefec7cc4d9", "comment": "Malware payload (NanoCore)", "value": "12ae2402c8cd0a8ad61284c5a2b8a018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592510, "uuid": "17eee573-d53f-4490-add4-773df1b24718", "comment": "Malware payload (NanoCore)", "value": "8d8b467cc8473f5a02df308943a7e87927d5e3c1b6f52f1916226a1687697c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592510, "uuid": "7f10509c-ef6c-4a88-9850-2ea0bc86284d", "comment": "Malware payload (NanoCore)", "value": "559c539af9fe5b5b2f3db720c1a9e8568857b7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592510, "uuid": "a40de4a9-8427-4ed9-9ee1-78583d17ad85", "comment": "Malware payload (NanoCore)", "value": "f91d2cbde6ce8606a48e691182c1c4a8d8fde20fb2d146eabb80f3a3e299018cd1555cc717eb3a7244d2ba13c1719a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592510, "uuid": "38041f12-b066-4740-bf76-633bbddaaa27", "value": "T14964AE1137A5B81FD29E467563126532437889D3ACC3E3DA24C876EB7A7EAE006371D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592510, "uuid": "b59542a8-8e9c-4643-bddb-28b4dea04af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592510, "uuid": "cc9a8b2c-d403-49d7-8a45-a2bf7b56efbe", "value": "6144:WLV6Bta6dtJmakIM5wzch5V7lyc3E96/evBaLH8QT:WLV6Btpmksv7l/y62ajBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776592510, "uuid": "a39d3e68-0158-4773-b4d3-f18cf9fc6804", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776592510, "uuid": "ef664a75-a5f1-49aa-ba0e-c5f0c6b77d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592510, "uuid": "67cdc2ed-edfc-4fe2-ad1e-f5e8d0aa3592", "value": "reverseapi1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc229bd8-3bdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595895, "uuid": "c264abee-583a-4de9-8bdd-c13787e92d78", "comment": "Malware payload (Mirai)", "value": "04672a34d64b98489524d54a03cc6366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595895, "uuid": "be1a209c-5e77-4633-b076-2b5321d2ef0a", "comment": "Malware payload (Mirai)", "value": "8e33ed298c7f597dfee90e22ff874d2cb1ea978013763e0e0e04a08845aaaa03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595895, "uuid": "0bf6cd8c-a592-4793-8bf9-14405b1cfce3", "comment": "Malware payload (Mirai)", "value": "0d56c696684031a0a65eff9a79dd31845bd9db07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595895, "uuid": "2ed56ee2-6b8a-47e6-a7a6-fbd5b64df2f1", "comment": "Malware payload (Mirai)", "value": "dd77f28f11659f6da3c318c883c1c61c23df8826953207dc36d53c0fa413de3c10734c2308ab418980210a76c11af4b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595895, "uuid": "e1f55f73-3bc3-4e92-a924-dbc7b8ac5e18", "value": "T138B20981B4E29F4AC6D12676BB5F57997303B7C8D2DBBB13D4085710BA6B21C8E2DB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595895, "uuid": "189a32a6-ebc3-4cea-8fe5-0a98ed32a7ff", "value": "384:5vfsB9gh/flURZhpx5BJRZhpx5BJRZuW+mO2eGuW+mO2eGuW+m3+2eGuW+mO2eGq:FfWo/fKRZhpx5BJRZhpx5BJRZuW+mO2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595895, "uuid": "1b7ab9b8-a2cd-4f14-bd22-411a351669dd", "value": 23824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595895, "uuid": "7767fd57-561a-49a3-b96b-8699a8b9d4fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595895, "uuid": "b450daca-ab1b-4724-9ebe-97821e2f389f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b99b25-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578485, "uuid": "25d58d6b-7532-4d61-9afb-1b052c80207f", "comment": "Malware payload (Mirai)", "value": "68e58129c6e5380ad75edc989722c1ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578485, "uuid": "268c2649-e3a5-446d-9e8e-49454ad743ed", "comment": "Malware payload (Mirai)", "value": "8f433d5f032f8129a9d1328a3a507be38c21b7aec4a8b9d46b06bb4361687814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578485, "uuid": "e7797fae-73df-4358-a487-46701e16f15d", "comment": "Malware payload (Mirai)", "value": "c909d007dccf28316d793b124ff83a17c8264755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578485, "uuid": "ca0100fa-941b-48b7-8633-bb48ece96188", "comment": "Malware payload (Mirai)", "value": "40af7e965ea8dfb27dfc6c765f4bc2b969674121ede567fc623b040021c8053878b8b4fce8fa85de729cc4287b53b23d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578485, "uuid": "dc91d601-606d-4a3a-b7e0-43f3b543bc6e", "value": "T161F2F166931D3E91C375ACB2C3248ECE3B67035255A7A96718C406B0CE9ED5A33B1DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578485, "uuid": "41608582-6c0a-4106-b7f7-817907964df8", "value": "768:/ZAb2jdTWDPtuRl/gZ5lWG2hYatGPn4QPYKmfPqs3Uoz/:/ZAKjBWDPtuTgZmBnz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578485, "uuid": "4de2e318-e5fa-4d70-ac0a-b181f6a4c540", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578485, "uuid": "a513d4c7-d275-4a28-8bb1-4de47fc5939a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578485, "uuid": "1798c102-088b-4c45-94c0-1ec8fcb07060", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58365888-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "03db59cc-dd28-4db2-a5fa-ab44e02f94c4", "comment": "Malware payload (Mirai)", "value": "03c3ef98db084fdd8f3613b4c8458c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "3898e138-e918-410e-b3a6-e970da42e066", "comment": "Malware payload (Mirai)", "value": "8fbd36c057b55914e35670526a01b50a9fa219158d1f2a24b5d1f51abb4fa6c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "eaf94487-ce4a-4ca0-b712-ae9fa084dfaf", "comment": "Malware payload (Mirai)", "value": "035e79bb39f8bd1c506821c403fb9f4e5ed8f872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "f4387ea4-84d0-4ab4-bc98-cbc329d37655", "comment": "Malware payload (Mirai)", "value": "e8fff9e96d7a21a5a69a994a9070a1be57aec49bf06fb5edd3118b03c4a3eb87b77072bb5aff99588edccac6aa48fdae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "f1feff0d-b7f5-41ec-bc48-276522f80ccf", "value": "T16B92D0304526BCB2C7617432973F8902CE5A03FEC6F6317A236465A4DAD558F2EA468E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "cc867f70-38a9-4514-848a-fd7f037ed8d0", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8uTzPahymdGUop5hts:QCyEPgoKRwZGx04nIns0t2nys3UozLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578548, "uuid": "76986238-3da1-48b8-bd54-be5eadf2131c", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578548, "uuid": "140ef1f2-5ead-4dfc-bdcb-8389eeae0414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "4cfca9fd-b972-498c-98ad-dc10cf16a68e", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000572f-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586936, "uuid": "e1671f85-0f1e-4b15-91bd-b5811aee6d5c", "comment": "Malware payload (Mirai)", "value": "4034873545670f8ed2e76490fe36717e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586936, "uuid": "cab16f23-519d-448e-800b-9c9d177b1070", "comment": "Malware payload (Mirai)", "value": "8fd5fbecf67a1887e28d3c1cb15f0fff1d102e58d2cf1e11a58d3a096d73c455", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586936, "uuid": "aeb22a2e-e9f5-4c66-9829-82778c35560f", "comment": "Malware payload (Mirai)", "value": "295fecd5f6eeadc403d40adb756e0a6515495539", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586936, "uuid": "3bc5747d-7853-45be-bf5f-589161861b16", "comment": "Malware payload (Mirai)", "value": "856a995b705c673edfe4dff82e0b558bdd18297be02977e49759eb7ee2cf3e45f247aaa73ef17ff96dbe1ba83e0fd852", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586936, "uuid": "bf6a3acb-6805-4ff8-96dd-7cc4351a582d", "value": "T1E3513044DBE20E7ECCF0227F56971B6433A9EE1090D67723432CA6140E27AACAE33585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586936, "uuid": "e27a3c14-5bb0-448f-9da5-c7238e318680", "value": "48:un1KGpa7UrLZLaRlPSBu3AAO2IixNS+w+1lQbM:un1KGcPSlIRwYlYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586936, "uuid": "8d0f4cf9-83f4-4f0c-8d17-05bf8ab0be03", "value": 2919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586936, "uuid": "0cd97219-e879-4d57-9f95-42416d761f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586936, "uuid": "80a6ffb0-5faa-4072-87d9-4da8557e95d6", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262a2181-3bdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776595643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595643, "uuid": "e6d8beea-c8c6-426e-b80e-c55101214239", "comment": "Malware payload (Mirai)", "value": "94cc942214516694050cb81003ce209a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595643, "uuid": "fa937e8a-9eed-4790-a531-614b09baad04", "comment": "Malware payload (Mirai)", "value": "93e4e5006079c7668fd7e8e7f90e000421c72147719681c3a65b2675789a06d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595643, "uuid": "89481ef2-7e9c-4bb0-9ffa-2ec85d3916ac", "comment": "Malware payload (Mirai)", "value": "5d852dbdc9e5af475756d09ab4c93cf46a23ca5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595643, "uuid": "e6462e6c-6d30-41fb-af57-14c6bf567769", "comment": "Malware payload (Mirai)", "value": "bfb74f8511135fdbf0ffcd2057d213aa38f45ed89076242150af314723ba6c43b3b3e14866f4f1295f95cd6fa76eec06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595643, "uuid": "3f4106b7-ebec-4bfe-87ab-fefbe95455b9", "value": "T10F63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595643, "uuid": "77c9ea5b-c102-4921-ad9d-a5c858a299ed", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAC:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz5L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595643, "uuid": "a714d7a6-4b3d-4563-b98e-a1ad0f6fd7ea", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595643, "uuid": "595cfe65-844b-4af7-aa8a-811656d32e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595643, "uuid": "fc81a43b-a450-4c7f-b239-bec81aec635e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f02af15-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607282, "uuid": "04692e42-ba11-482e-aacb-b726cb9b23c8", "comment": "Malware payload (WeedHack)", "value": "e1c2201a62839a5945fc2a71ba074e91", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607282, "uuid": "944c88b9-8881-45ca-8b12-5894f3d6c901", "comment": "Malware payload (WeedHack)", "value": "9621e0d64e702b873b3b4cf9362175c0fe612d7882dc27b1f08803861010ca1c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607282, "uuid": "1db0ab11-710d-4b1a-9fb6-4fb8127d6e82", "comment": "Malware payload (WeedHack)", "value": "663288b869969aa6599637cea616a90d05d786ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607282, "uuid": "fb35af67-091a-410d-8ee4-bfdd61ecd1ad", "comment": "Malware payload (WeedHack)", "value": "18609cc36a5c43ef4259f46917cc5457a220d12dc50054eb20c641d673f2757a192b1999ff98c924b2bbc025f3ac536c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607282, "uuid": "00b51951-1db9-4751-9407-8fe5335d2213", "value": "T12A94230E2395EC55C723DD30DA4F694B340D8F6DE732166255602CA2B27A13E973BB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607282, "uuid": "b06a7e76-f871-4c08-aab4-051ce103a122", "value": "12288:cLIbp8g6NdPGza6Wpz7RAorhKI1dPtGHZ9GqlJKBiN5If:YqmdMIz7OMh9gHiqlJKk5If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607282, "uuid": "e16ad0f7-5e33-4921-978d-f6ebd5fa574e", "value": 435381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607282, "uuid": "42124f68-7d25-4b91-a8f6-8b5fb26a1ae1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607282, "uuid": "e86a64cb-a5dc-43ca-886d-baa6cd8f19c7", "value": "Ciscos_Fantasy_Medieval_RPG_Lite-16d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcc73ac-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578694, "uuid": "f0c6ef8c-8cd1-497b-a6b3-ef5cfa667247", "comment": "Malware payload (Mirai)", "value": "007995f344582e513ef92a6f2ecb167d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578694, "uuid": "b93e2303-5169-4bd1-a0e9-d473f3b7b001", "comment": "Malware payload (Mirai)", "value": "970ffbece0014fc210ac1cc82b49a11432e5d62b5d686f4dab6d37c9ede5ede0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578694, "uuid": "5804e5e4-ac80-4f37-9318-f248a7096b01", "comment": "Malware payload (Mirai)", "value": "f0ba700877f9de1ec9e5a47924cccc6315e8c16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578694, "uuid": "fea8c8ce-4184-4a89-90b3-d68a5bdaeaca", "comment": "Malware payload (Mirai)", "value": "d982d2d25e64dd48ba0521cd89ab086c49adcf50e19b6eb03ee03fb8871a3aecde1236518aa72b03a6a4fa8c8ddd1ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578694, "uuid": "d2ff491f-3a87-43b0-bbca-5bf585d5a7f5", "value": "T1D5F33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578694, "uuid": "fe415ee1-2308-41b4-9956-f39d4995f317", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjdHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OdHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578694, "uuid": "799f66e5-ff32-4da2-819c-270471ea53b9", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578694, "uuid": "bfd077be-d244-4c5f-92b5-4e8470b923b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578694, "uuid": "73600b54-b65d-463e-b0bf-b68b7a81f765", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826c052a-3c18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776621139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621139, "uuid": "5f8a6306-05dd-4506-83ca-a34eeea9d2c9", "comment": "Malware payload (Mirai)", "value": "ac9c0659b9e229efb91993fead6d68fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621139, "uuid": "b726b447-4474-4d2f-bb53-9554c096dddb", "comment": "Malware payload (Mirai)", "value": "97298c07e8e5f8f2d79277546b33d0210f39593b5fe2e4d480c2e3bf912594e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621139, "uuid": "ebb5769b-2162-405b-8e43-ecd57dcc4c9a", "comment": "Malware payload (Mirai)", "value": "05884cc0366b5122886c1a79bc2e6a49b57d48d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621139, "uuid": "8161eb20-e8c8-4873-ac3d-c774ff4cf63f", "comment": "Malware payload (Mirai)", "value": "ce2b512cfb86d800b27a6ee3a444f9c16cfd80d64963c4a43ae23122f7763a14f963837fae14a018877d486a94e60664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621139, "uuid": "dff53b44-380c-415f-a090-a07878a75992", "value": "T151735C89F783F0F0ED070671105BB77E9730DE125124DE6AEB94BE72ED72A12A11A61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621139, "uuid": "7c3b655f-6d01-4d44-a179-8e9a93518f8a", "value": "1536:TeGMFNoFKpTsekbivaKIcoCvZBvPUc31fMxnV40TfvXr:aGMEcpTlkbiv+GziD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776621139, "uuid": "43973557-47f1-4257-acdc-fe1896257220", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776621139, "uuid": "1df99fb2-047c-4b86-9973-d803ecd6111e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621139, "uuid": "32863569-3bf9-415a-879e-5709f5a60f6c", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c962b893-3be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598494, "uuid": "dd6dd334-747f-4f10-8eeb-90821eb4f265", "comment": "Malware payload (Mirai)", "value": "797d175d449d055578f1277b0e0225e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598494, "uuid": "721014b2-009b-4f5c-984b-6d8cd6cfd667", "comment": "Malware payload (Mirai)", "value": "974402fd8dfdad5bd83fa223ff6536213ad7c03862ba567a9001ceeda575a937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598494, "uuid": "ecd07d64-fbcd-4465-a3b9-6a60d56d7662", "comment": "Malware payload (Mirai)", "value": "e8c575360f77f31f431637b186d2114eace67021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598494, "uuid": "c6d7d723-a241-4286-b2e4-43e92a900d9d", "comment": "Malware payload (Mirai)", "value": "8fd788797f015216caf865a37c5d338bbc2f7d9d4e871e83213c55a629a8e940d95002f0f83a4e9bc76c7caa4262b24b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598494, "uuid": "e30d4dd9-fc34-4c09-b048-77e6111724e9", "value": "T13A633917B9819F11D5C1127AFE5E224E731307BCE3EE72229E24AB2077879670E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598494, "uuid": "c5a6637f-32d1-4a91-b8c2-f32ffc79d8f1", "value": "1536:34nLpj4qHylDFOxdI9itt8z0v2aFXqg3X5yYDR:gpQCt8z0v2aF6aXoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598494, "uuid": "e51a6c9d-20ad-4645-9a51-6efe2f939578", "value": 66948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598494, "uuid": "30d3d3a9-dcfc-459d-8d93-c9b857abd4ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598494, "uuid": "26b2516b-148f-46eb-af45-bf16fd248730", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4e9497-3bad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776575363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776575363, "uuid": "f049d649-8d67-4556-84e7-707bd4d3089d", "comment": "Malware payload (Mirai)", "value": "ae264f9096811e3eb69973e00fb98360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776575363, "uuid": "72227588-e7b5-4f1f-aa77-9c5af69c7496", "comment": "Malware payload (Mirai)", "value": "9794a9e6403b12f28526270712855bdbcf8caded5a465ca1e7df892f3817e961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776575363, "uuid": "e8edae1f-5fa9-4a48-9b09-c681be8d3e5d", "comment": "Malware payload (Mirai)", "value": "5b5074537917874c7d1c8da01f1a805ca1e44cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776575363, "uuid": "b76581b6-ade5-4bba-a3ac-bfb4907530bd", "comment": "Malware payload (Mirai)", "value": "3538d76f475608c01a86d3e3afbb432e54b18592b237edcecc6f6f2e743ba021493ad92507533d6d313d99e896d96b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776575363, "uuid": "dd0f7dcb-0ea3-4cc8-8c38-6b7ed400ed0d", "value": "T1B53465759B5CCD97C42ADA7E11E98F6B9C7D72DB2205EE127CF49034EA85A8B2C43C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776575363, "uuid": "769f84f0-a125-4cf3-917f-7bc544dd3bc9", "value": "1536:KRq9mjxJsjn81ELYMAZefaMPjM+NLsBbiTFK+pK7DKrtwp+Vp+wEibLH7NiTKnh:uymyLYX/8bTlH7NiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776575363, "uuid": "9e6d4ba1-231d-4a0f-a897-759a94e2c208", "value": 232288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776575363, "uuid": "7085c49a-d8c3-4d91-8344-7269638b313e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776575363, "uuid": "e4278c43-57fc-41cb-90b6-c7d0a6cd382b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a4fad0-3b8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776560801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560801, "uuid": "93871e28-1e3b-495f-aeee-e05ce7261516", "comment": "Malware payload", "value": "a490d33fbb582346acbb2c46df72eefa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560801, "uuid": "1a19af3a-0cd0-4ba2-833b-5ec97b51dd93", "comment": "Malware payload", "value": "98354dcf4cc1682b8b4ce83862650e1e57b46d96b10a6aa609083c7a2dfef519", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560801, "uuid": "73d66d1f-d0e0-42fb-a52c-32fc54900050", "comment": "Malware payload", "value": "739e92a746d224283d81fd87b00c5ffb7db791d2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776560801, "uuid": "4e26e3bf-63ac-4fcf-950e-6a83a8e5a5c1", "comment": "Malware payload", "value": "3b1730778054625f90478cb69f2b08177e29d67240e6655ef7ccc32e64517d7e8ecba61090b19b0d3ebf1f4230cfda01", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560801, "uuid": "c6bfb985-24e6-48b6-8795-1cb2a875eba4", "value": "T17782802A3807CA1911F3A326B947B04DFE0320AB87652640F9DD86C51F71959D6EEFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560801, "uuid": "23c0e643-1efb-44ba-a125-0c56512f7965", "value": "384:NipEClF/yKBuE7EUENinrJEmEHEeYEyJ746E+7T1e9:w6ZoIvWraVkMy0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776560801, "uuid": "ea2d9e1a-22f3-47ab-ac0f-7cb83fe589e6", "value": 17875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776560801, "uuid": "24c5bf59-f5f3-41df-8900-a669363e3602", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776560801, "uuid": "6d1de984-24ef-4f7b-8758-58222a14c39d", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30432d16-3b8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776561730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561730, "uuid": "f20ab71f-a8d5-4815-816d-138deef0cab9", "comment": "Malware payload", "value": "8ec00991f4122b3f34b5181ff2e9f0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561730, "uuid": "61ac409a-6a4a-41ec-ae93-3695d2fe971d", "comment": "Malware payload", "value": "98ed48c1f09fbcbe4f484327901f4852e18ace0dbf44b926336544cd4167c5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561730, "uuid": "51bc199e-ce8d-46bc-9039-1621c3cdab90", "comment": "Malware payload", "value": "610832552a3132ac93e98e38db257186b0d672a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561730, "uuid": "d93b282e-2e17-469b-9d6e-c0f3aaab48f9", "comment": "Malware payload", "value": "87cecceb13d5a232f93cea3ca2508c9fe53a35579adb12dacdf4c26bc063c07199151e7a0286b45dd888ef44a9eb0744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561730, "uuid": "ce191318-857d-41d2-81a6-781225d6bd03", "value": "T1331406D1BAC9ADDAEA06023855A7C335633CFAE557929707083072362F139D0AED771B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561730, "uuid": "e197901c-a000-4503-9914-ee576bc5e00b", "value": "33b58ae9059d1916e8799f8e6a820d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561730, "uuid": "3471e9b6-2e5d-4107-be57-0dfa3d534f45", "value": "3072:Yt++x/OfLvKDErDs/3t807rFvM6Kdn6hHwpC:Yt+vjve32073RwpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776561730, "uuid": "9f535bc3-f900-4954-bcfd-21eaa979f13c", "value": 199101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776561730, "uuid": "6d57b6eb-1e72-4f86-81a3-d40702d7f3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561730, "uuid": "4daf5e9e-9c39-417c-bca6-a4376a078d5e", "value": "System_Repair_Tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00934c90-3be9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776600734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600734, "uuid": "8aac684b-e612-4583-b1f5-6622a9703ea9", "comment": "Malware payload (Mirai)", "value": "84d956dca249fad496c7c3403c136b64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600734, "uuid": "d3256565-5f8f-405e-8817-6eb4c2ab8a57", "comment": "Malware payload (Mirai)", "value": "9a09f53dcbc60348d8d4f7c241aaceb98cdd3704db0a1a0a34b54b0a1b220289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600734, "uuid": "b4169eca-c24a-4d08-8e54-bffd2cf8e75d", "comment": "Malware payload (Mirai)", "value": "7ccc911175f59a0230f0dd07af105daa125431d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600734, "uuid": "9eeb7c2a-423d-4d88-a800-c9f5b599b670", "comment": "Malware payload (Mirai)", "value": "5a6c95595b6d4c1ec7acbe63f31dcd71776dfd50ace53caa6c0b73bd00054dd1fee524f34916f0d8d95fd3d0be0b9211", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600734, "uuid": "2dbb0cdf-136b-4151-8d46-7a0d65a18812", "value": "T1C063C55A2E358FEDF66DC33487B74A30A7A923C613E1CB84D25CD1055F6024E946FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600734, "uuid": "e81ee378-f6f2-42f7-a2d9-0bb1b28b1e0a", "value": "1536:h4dE4AdWMXTP8fC7D93+1Q6uzazsKTweDLVr:h44XTP8K7l6uzazsO1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776600734, "uuid": "3164d9d2-624f-4922-be7f-2e65af989e36", "value": 68476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776600734, "uuid": "8fa6a304-5e74-4517-a3e4-49b231229bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600734, "uuid": "36519a01-f8a7-417e-bdbb-b7ce95e6ae16", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb69a204-3be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598498, "uuid": "5d4453b1-8a38-4e5e-8af6-2da9984faa7a", "comment": "Malware payload (Mirai)", "value": "84e64b30f3cdf348afa6509be0445537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598498, "uuid": "a9cc67d5-99aa-4b78-b03d-b6ac7485463f", "comment": "Malware payload (Mirai)", "value": "9a2be56efd02f3b2de58f4df53620790dd72798fe866fa96a5268eba85d6c0b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598498, "uuid": "d6cce33d-a7ab-478a-a4fd-6a063e583e77", "comment": "Malware payload (Mirai)", "value": "62034f1f5f42ddaa4cf37f88f8ae3d39e01f1524", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598498, "uuid": "037870e7-7453-4dbb-b3c2-2726a66da416", "comment": "Malware payload (Mirai)", "value": "5ebf930a25b4ab48d8480d4d0bbcb38a226be543d5efae3ce9b4b75973b28b2938c482188db7c419336890562852cb67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598498, "uuid": "41102a2a-7b98-4929-91a8-6aac3e911a54", "value": "T1CE330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598498, "uuid": "e5137c14-aef1-41d3-98d5-5c1f3f81793c", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGS:r/hqaJMDg9eqK806MHdkfQX6HuCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598498, "uuid": "7b5c3b86-3143-462d-9755-2218e94c84aa", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598498, "uuid": "61e0cdb7-e4db-4d9a-8930-359788d9b39b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598498, "uuid": "0d9f5a8d-85fc-4516-881e-bdda5e95a414", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d1b989-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607353, "uuid": "9a38fc1e-d298-4b2d-9418-5ed422a6895c", "comment": "Malware payload (WeedHack)", "value": "b102d5438bebb3883bba556e21348c14", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607353, "uuid": "722e41ec-e751-4e04-84a7-494a16cf7941", "comment": "Malware payload (WeedHack)", "value": "9a4fd893ba01f9c6684fb114759553ff229d3be75ddc5fb2321fa97e79feaf29", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607353, "uuid": "e20bef5c-e367-4dbe-a76f-a5c764062d81", "comment": "Malware payload (WeedHack)", "value": "f8c3db2e5310a89c455f8a536b2e7dab1337332f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607353, "uuid": "e6d4857f-ee85-459f-b090-969105b98914", "comment": "Malware payload (WeedHack)", "value": "bc68dcdf39e6e8d4dd37248d16e561610628f059eaa4fe59e27272084555031f35989633bbfffd6244b5ceca674d3eea", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607353, "uuid": "d96705db-5df8-4ce3-b944-98de2c7a4beb", "value": "T122C42342211FBF89C1CBC736E151E600FAA9BAB4E56D7DD3660F281AEB1735AC351348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607353, "uuid": "276bceb5-87f9-4d9b-b908-bd3ea5bccdee", "value": "12288:ma3hizNW+9/5idmiPv+4MXcwO5ZSUbZ1dQ9bNlr:Z3qEc5qmEv+4AcwO5ZH3wxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607353, "uuid": "70f70c8e-d942-4e5f-be92-43702556b67f", "value": 558419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607353, "uuid": "60105760-d296-456b-8491-a4170ac10e52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607353, "uuid": "b127c360-abb7-4198-9858-eb7cbd5a2952", "value": "meteor-client-1.21.11-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6dbf17-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578449, "uuid": "b0e860d0-8921-4e39-8930-f71f62a82c64", "comment": "Malware payload (Mirai)", "value": "76f7a54fe6f18405282a5ef0f3dc5b03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578449, "uuid": "12ed8acc-bc21-4b64-b571-acde77a45003", "comment": "Malware payload (Mirai)", "value": "9a65c9decfc67c9d447e1fce11db550800ef71505900ce38394b8506c2480ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578449, "uuid": "362877bd-5b2e-43df-8c86-f0fe3a23ece5", "comment": "Malware payload (Mirai)", "value": "88cadc0aca1087fe22b762a183069bd330dfcdb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578449, "uuid": "efd49809-059b-4ccf-ad17-9c21fb4a8540", "comment": "Malware payload (Mirai)", "value": "bc3f73035a2350f80484fc0430a30efdedc3765f863fd847892a2a4f0cc8739aa8f6de0590792d85e7783cfd46933eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578449, "uuid": "acd940ab-2cff-4fa4-86cd-d6712e643dab", "value": "T1A403E18CADB868D2CFDD48B0511617A8B9A1B5D27347C74D9624CC6CEB1B57EE0C8471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578449, "uuid": "e5b1f4ea-e912-48a9-811b-fdfe35983835", "value": "768:pVyIwYjG0JFzFubGdtjUq8pi1zKxrxaZ71tK/WJ:pVyYjXJ5cbwKq82KxAM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578449, "uuid": "d46ff919-1d63-4660-b23b-ef5b610d995a", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578449, "uuid": "4edc5158-a964-4eea-adc3-4da800e8e1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578449, "uuid": "056e283c-71bf-4d9a-91b9-2a94da51eace", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b0d37c-3c19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776621495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621495, "uuid": "454d1b4a-8e48-464b-b976-daa845070d6b", "comment": "Malware payload (Mirai)", "value": "08339c9172fe19dbb4a41756103afbf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621495, "uuid": "65d928e6-dc7f-483c-81b0-3a0cfb24bd31", "comment": "Malware payload (Mirai)", "value": "9b9ac143c2c2cb5ff525ff80c939f64550808df1487e5a4c51c383b442996a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621495, "uuid": "3157050e-4576-4744-9745-949b10d094b2", "comment": "Malware payload (Mirai)", "value": "f8f2c53c28473bef2de15a49a4a41f60db40d764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621495, "uuid": "be9a2771-9a19-4d42-9cb6-6ef71497ff4c", "comment": "Malware payload (Mirai)", "value": "90c5ccf1f2cd6a67814c28af43df44ed445eeb0c6f2138aadf4ea0d52189c656086f446a9fc24cd510d09923db218430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621495, "uuid": "fb71f0aa-5ab3-425b-8a7c-b0f29aec036d", "value": "T1F4C3F845FC509B16C6C665BBFF4E438D7B2A1768D3EE720399256F20378B86A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621495, "uuid": "a84cdb49-5390-4098-83d3-73d2782f084b", "value": "3072:vIHfYIOemiBHjwaFVjckvbzR4v3GfpGB:vI/7ntBHjwkVjbvbdC3Gfpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776621495, "uuid": "170b3648-4801-4f37-9a04-619f0208d524", "value": 129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776621495, "uuid": "0d2acf54-a7ed-468e-a369-d23b92ccc889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621495, "uuid": "aece859e-d0e2-400e-9de4-abe18cb63cab", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8c53c1-3bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776601454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601454, "uuid": "ab781a08-30d4-407f-a982-b823f7a12086", "comment": "Malware payload", "value": "e404a9a5626d7013e4afb3e6c30b4178", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601454, "uuid": "97bbc988-49bf-4e7a-a9d6-41a194e4291f", "comment": "Malware payload", "value": "9cce05c0f48011c170f0b6a8bf7ca61cb6dfe02e6afa5859ff7090c688d49a90", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601454, "uuid": "9f5afc7a-9c55-4f42-8fb3-6ba1e612c5cc", "comment": "Malware payload", "value": "6a389b2d38ab4ea99098ce341c1a1aa9249153cc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601454, "uuid": "17d6aff5-0d81-42ff-8800-2cd956f3e337", "comment": "Malware payload", "value": "1e3ceef4b0b68c7f6a9be262e05fe754b7472decd2ae5edb47be00c633cd645b55db023f89dd5a2ec0f41dd8912acb1d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601454, "uuid": "2f0a8c1a-ec2c-40ae-b486-4596073fa568", "value": "T10726E089BB48A72BC477413746E6563261874D078E839B836958320C7DBBAF41F5EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601454, "uuid": "cb8b4685-91c8-4339-be4b-79cb4ea4eb75", "value": "98304:cCjxflXy6Td2ZrMIpNUbBb795nwPWIatGoF4g:cCjB+fwZ7oDuFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776601454, "uuid": "f87dc224-39b7-4b31-8ae6-fa8d0253db9b", "value": 4713283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776601454, "uuid": "35e09b15-1299-4a08-8da6-b8f7765264da", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601454, "uuid": "8f6c9224-9fe8-4da2-9857-10ef988e6df3", "value": "\u534e\u52e4WiFi\u2014\u670d\u52a1_v3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466a740c-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578518, "uuid": "207c9234-893c-46fc-916f-35ec9d422fd0", "comment": "Malware payload (Mirai)", "value": "f19399d0fda9e864a5625f2d19b4fc5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578518, "uuid": "f45582a4-f6bf-412a-93ab-be0f200828bc", "comment": "Malware payload (Mirai)", "value": "9d59db613a23060649cb0250ac3ec77c5b9441ed7a5eb358b92132db03a619d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578518, "uuid": "e425f70f-c42c-4ff4-b297-f340bdac1d1a", "comment": "Malware payload (Mirai)", "value": "25e4bbbd4ff72ccf42c5bed335f2d0631067d5c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578518, "uuid": "d6c1b024-b892-4ca6-b114-4a3e2e207101", "comment": "Malware payload (Mirai)", "value": "2c6f1f91c126cc1b00b6eed3d0ffefbc64c4f732e16732d3636985d5654b66ae2a2c46980abd763991a69f82f535de3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578518, "uuid": "f3d43a84-724d-4118-82e9-5fa19cdf7ef5", "value": "T1D7E32C46E6814B13C0D2177ABADF42453323A764D3DB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578518, "uuid": "72087faa-2767-47a8-bef3-93735c237b01", "value": "3072:U+UghWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+U3IxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578518, "uuid": "c8325948-83b0-44eb-b8a6-f82ecff1ad02", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578518, "uuid": "2682163c-9477-4587-b156-1dc2d2cf57c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578518, "uuid": "326be105-460a-43d0-b83b-be54129ecc8f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1592a316-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578436, "uuid": "fe0b25d0-0d62-46e7-a190-f3597abe9c4b", "comment": "Malware payload (Mirai)", "value": "c813b5ac75ee06348b72d21fbf82fcd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578436, "uuid": "64eaf1f5-0fd9-418a-9c98-8afc000990a8", "comment": "Malware payload (Mirai)", "value": "9e1afa28508088238ae48f7c63618e1c2a775efa014d2016b1f81d5f0819800b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578436, "uuid": "a21a0ed1-d49b-4aa5-8ae7-13abbf668275", "comment": "Malware payload (Mirai)", "value": "c7db421cdae2cec0a619bb935b5bf2b45de7399f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578436, "uuid": "569bac17-4bad-49de-801f-da1d089e094b", "comment": "Malware payload (Mirai)", "value": "768b5242e1b636a1df03636f41f04f4dba4904166d8292dd6fa286ade24155146e5caf6f3a533db1ca6cdbdb62749e76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578436, "uuid": "43af8fb6-3a29-446e-b964-e8ad286bc19d", "value": "T11803E133A655DE92CFB23831A81E89434F8216FC79FB20A115B5C41DB69B5C4FFA50C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578436, "uuid": "89d3bbeb-5572-44ab-93f6-5856381a1669", "value": "768:BhbUpgfK/AwtCpv9kskz5BCG5ljbm76GxRfLXZJ8dtXFLvOQdiQtyIuu8L39q3U6:BxUpgy4p/kz5JXmeGXLXGXF7OyYj4Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578436, "uuid": "6636cc95-d7ad-44de-b88f-ee0217198ae2", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578436, "uuid": "e764f7be-ba61-4857-8012-3984ff43407d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578436, "uuid": "01ce6098-ec62-4297-b7f7-d38df5e31134", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15025549-3c0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776617089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617089, "uuid": "5db74560-c0cc-424e-bb39-75a971e8fa7d", "comment": "Malware payload", "value": "8a989aa52f6aa8f0c2f3bde36c255f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617089, "uuid": "0650305e-57a3-4919-a504-d64eab22e32a", "comment": "Malware payload", "value": "9e1d518ac66b92c84a5adf54c88b7c65a817d6a05836871eac1c87920f89d15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617089, "uuid": "97ec5f1a-499c-4a03-bc5c-29a0a1ea0aad", "comment": "Malware payload", "value": "3f8e391630bae9d6f02f1293edbdb7754f21b031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617089, "uuid": "d97ff976-98f6-45d9-a012-b8d86d7aeebf", "comment": "Malware payload", "value": "1a7d7bccf573620edf12a35ee8ba6451b49e1726473eb04d2460cf44143f8c008c17c2dbafd57a8236337eab3f274bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617089, "uuid": "43e68a39-9a39-43a9-9a2b-5129ab2b3aca", "value": "T1E2835B0933E44E91E9FE0A7B0A7295150372E5925F53E78E8EE1589E2F733828D0D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617089, "uuid": "9b479972-4653-4e61-b8ef-0c7d1ffe3e94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617089, "uuid": "cd9cf8a3-32ab-46c6-910d-9f216676e1a0", "value": "1536:gJwsHslhVsETri9gF8CILbpL2rCufRGqTomkQXg82bWp:gJwNToCILUrCufRGqTtkQXg82bWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776617089, "uuid": "85c39f76-7aef-420a-abbb-b62e83671a90", "value": 85651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776617089, "uuid": "31680d92-998a-4ce3-a0be-f31dbd03e6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617089, "uuid": "bf1a47c7-c1dd-4a0e-a29d-c213a9a2c1b0", "value": "kalyanoffice.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658a7ce8-3b8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776561390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561390, "uuid": "38c02c2d-b577-47c0-b538-3c1bd98dc885", "comment": "Malware payload", "value": "cd2fee3a8eb6d03ed99d74395c133115", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561390, "uuid": "989ca31d-2c78-4681-a501-2fe463f66ab1", "comment": "Malware payload", "value": "9ee60dc5de01523c8093b7a223df6c5bf81634d9bebde7388ac899126091a309", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561390, "uuid": "ca9bccf2-0a64-4eb8-848f-8252fe6bc343", "comment": "Malware payload", "value": "610c31c3c7b737392bf78c5ae5ca875dfebab64e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776561390, "uuid": "9289f571-ec33-4011-993f-df067a04d5a2", "comment": "Malware payload", "value": "22fbc271d152f9fef22eb8b3182c0c7101d3a7e37e38fc1c85504faac074beaecfde38fedb1013b1c688f097aff797a1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561390, "uuid": "b351dd1a-4982-4987-bb8e-e1687025a5e6", "value": "T15352C6697906CA1911F36731EE97A00DFE1720BB87751540BDAD87C02F72916E6ECF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561390, "uuid": "09f9910b-c730-4bd9-9095-4f0600f093b6", "value": "192:PaXWvOlKwZDlF/1qxXW5Ahen0qXW+1Fla/tgI+9Kt8QFR+tJz8QTuqVnWoT6/IlS:olF/1z/aaJ7+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776561390, "uuid": "eb6c6e06-1374-41bb-a58c-804d749332bc", "value": 13557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776561390, "uuid": "3141fff6-20cc-4485-9059-4ea292ff3b52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776561390, "uuid": "40454e95-29c3-4872-8f48-0b3c49fea72e", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b3a27-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598979, "uuid": "26522a60-e3b1-448a-85a0-e316ab953f6b", "comment": "Malware payload (Mirai)", "value": "d3674d47a688e2da1b125210c2d00c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598979, "uuid": "edbd25c1-2522-4c58-aae5-24ca17ac1e73", "comment": "Malware payload (Mirai)", "value": "9f7e0e6fe5eaf9f9227af8b9e0ddbeecbe3c64953c89a5bcf6844386569d8797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598979, "uuid": "78a370df-a6d7-44f6-8b2d-ad96e4882082", "comment": "Malware payload (Mirai)", "value": "972b9c912965bb56a95bb3aed45eea80cad4c41b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598979, "uuid": "ea918c9a-6510-48e4-ade4-23285025789d", "comment": "Malware payload (Mirai)", "value": "89ef4b3519d08fa33461ddb334e836a33e5fc693b337ad5c662fe1f44a1fbd236f35349b49007d21fbb3e55d73824377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598979, "uuid": "55942511-a035-4287-93d7-817cd745a4d5", "value": "T189334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598979, "uuid": "8398dc0b-c479-41ef-abf5-5bfb1c48786d", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twx:ivW3jdQGqt7Y+Z+zN9cGgI6bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598979, "uuid": "0f2df32e-0da4-43be-a01b-bf1c265a4439", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598979, "uuid": "9d829b4f-bf23-4841-b513-8705a6949ab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598979, "uuid": "535a2172-25fc-4e93-9f6c-3ffa24c6f7f4", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f6af03-3b93-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776563959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563959, "uuid": "2c83c8bb-4eb5-4334-9916-487f44a106ba", "comment": "Malware payload (WeedHack)", "value": "0b225eb2c37df2266d8310ac8442d97d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563959, "uuid": "28b16322-f3b3-4976-b20e-59270767b12d", "comment": "Malware payload (WeedHack)", "value": "a07c1b5f308adc1101f9227f73803662c510afa2fb0e28f9121109c0b4b7b8df", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563959, "uuid": "b0b890b9-8c4b-4f8f-bd03-7d26e62184c4", "comment": "Malware payload (WeedHack)", "value": "2bb44cc4fe68aa8cd4bbc57fe6fb4dbc7ac52409", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776563959, "uuid": "cbcfd6ac-3d70-48ab-ae32-78291dddd50d", "comment": "Malware payload (WeedHack)", "value": "d204ab59ee3b7bad8efaf865ebdb98999e212b88a8eea3ea66f941c3c593ac5b3a88e3a6a021bf70404cc257d5f0b568", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563959, "uuid": "26aebf4b-8ab4-4b1f-bd4a-c24a01323cc1", "value": "T1780512378B3E001DC95FAAB6E501DC2A2C6E4DE4D00A391B1BDD4B9704E2CFE96D568D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563959, "uuid": "513ef231-4a1f-4166-a5fb-e67e37eef0f0", "value": "24576:MjYrVx5Tb/3teq8SvLUoYOoA6MwC7emhCHy1xmqg4X:6gv9bgq8sLUJoZwC7eK71xmqg4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776563959, "uuid": "b151c269-c382-4d7f-a754-32e9513b02e7", "value": 843749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776563959, "uuid": "a81381bf-d8fd-4f36-b8a1-c419ec604caa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776563959, "uuid": "c4188db8-b629-494f-b575-d9a6f5ff3830", "value": "VantaAddon1.21x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abce2b2-3bc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776585343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776585343, "uuid": "d4aa3689-f26a-4200-91fd-8b498f9a4e45", "comment": "Malware payload", "value": "66c2a6179a9fa28ea2498704c10b6d45", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776585343, "uuid": "49e83b36-543c-4f53-83b2-31a98ab0440b", "comment": "Malware payload", "value": "a2a539109b77cfa720f6e1315fa09c82cfb8eb9980b304ba54de6a8279993dd4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776585343, "uuid": "04e109fa-86bb-42f3-bb33-cfa57dd4fbca", "comment": "Malware payload", "value": "5d95112cbee2c9adaf4eb2bb297fd5869ddf612a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776585343, "uuid": "f5538bb9-8bbc-4daf-bddf-776fd9d34f1d", "comment": "Malware payload", "value": "6b8db42504aeb55c53727b86a92d1566e94dec0a38cd522875bcbf6911f18fb9eb3e72d0fd2ffd0e277a53471eb03178", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776585343, "uuid": "444cd207-2491-443e-a368-eaa59823024a", "value": "T1BEF5DF87F748952FD4BB21F68DBB4272A3664C414743AB9325447A2C2E772C84F6DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776585343, "uuid": "fa188449-5b91-43f9-99f0-4c2e472b1c6f", "value": "98304:V3aRKnfU9tma8k8Y6BIaSC+Bv8naNn2mY1U3BjMf1A:V3aRKnfU9dV3aN+x8nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776585343, "uuid": "06a54a08-a934-461a-b44e-0867639b1037", "value": 3342714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776585343, "uuid": "381a5bd2-55e5-4746-8adb-aa63aae4ca7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776585343, "uuid": "2c62b3c6-45f6-4c66-89ad-1eacc50aa528", "value": "Chess_(10.2.2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c49f3c-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607340, "uuid": "92b1c0c0-7cd7-4742-bca1-b343374eb5e3", "comment": "Malware payload (WeedHack)", "value": "6cf7e80bb0fc2f7e6bf57e6337615b49", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607340, "uuid": "9aaac398-07c9-4417-b038-42f5251eb48a", "comment": "Malware payload (WeedHack)", "value": "a2c24bcb756615c6adb0ecdb641f9d63ac979c0361225e6982306fa96949b58a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607340, "uuid": "b91832db-bb3c-4500-8511-b9a775f49677", "comment": "Malware payload (WeedHack)", "value": "f8d1bb58c8308bd0014963ca3a005c32936cbfde", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607340, "uuid": "89a7c6f4-97bd-41d6-9347-74544914e994", "comment": "Malware payload (WeedHack)", "value": "6b8e305dd8ded75150a9755cd15080d1f4b8d6c6d595b0ab4b20265e36d634af90855a6d3e74d9caf3071483e7507d5c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607340, "uuid": "b77e1166-2305-4526-b431-e24d40c36706", "value": "T133E4B787F1208AC7F44FDA7F14504310AEB0E4705607F2572B6E885A6FEB9C89E653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607340, "uuid": "6c221033-0016-4415-9c49-70e9f716b502", "value": "6144:u1eMX5Uh/W94gpr2T8PjhMogtW/IXx/e/WEO8PrBAf4DUcbr8Q/1Wp3x1ZkX:uFfSEVnjn/1YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607340, "uuid": "bd678de2-ef88-4061-9322-9896f1b4eda0", "value": 702321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607340, "uuid": "1fb32c39-712d-4cdc-8eb9-cf1775020cb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607340, "uuid": "721d3e1e-8315-4398-8504-2892f89fbd20", "value": "Marlow's Crystal Optimizer-1.21.11-1.0.5 V2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5054fed-3bb2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776577388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577388, "uuid": "ab32a291-d6e8-4991-af66-1de90edf12d0", "comment": "Malware payload (Mirai)", "value": "90ae0bc1e900022c95bb85d99c02791e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577388, "uuid": "855877de-52eb-4ffb-a528-d2d4464f1a04", "comment": "Malware payload (Mirai)", "value": "a329f1fed00ae7b5ca49e8e6a7c25b3f69e62eaafe75e10a42334f1379ddc7a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577388, "uuid": "2a70acf7-8558-40fa-bb0f-5203142bb1c9", "comment": "Malware payload (Mirai)", "value": "8ad7b667f57c17cbdfb9c926bf266a96d371d610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577388, "uuid": "da3b5fdb-e8b2-47df-91e3-a3d222735d65", "comment": "Malware payload (Mirai)", "value": "b07e1a4c6c26bbece914f13c35b301a0a40c406706bfafb75d6dd90885daaabc1726a01510f78c61ae3a6ceb063d8f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577388, "uuid": "a8d8f27a-45f9-46a9-9b1d-12d892f2a459", "value": "T1FE144231944CC783C62622BC6DEE9FBBCE7E72E62645CD017CD4953485A1EAB290BC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577388, "uuid": "0aa82f04-ad88-45da-9647-c2a2a4da3406", "value": "6144:MRELz8Q4f29P9uHAnoPpRbe+pAb0QcpTp7yL:TcGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776577388, "uuid": "ad68a08e-add6-441a-8d1c-e819c0556b4e", "value": 202952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776577388, "uuid": "fd3f0349-2cc4-4546-842f-ae7fce2cc3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577388, "uuid": "f23a3b0c-d98b-47aa-bb13-5e7ce6225365", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c945de-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624422, "uuid": "4bb009ba-683f-479e-b4dd-6a51ba134a93", "comment": "Malware payload (WeedHack)", "value": "f7f970c7e2c108446cfbbe31184cb123", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624422, "uuid": "760aa435-bb12-4b20-8cf2-4ae862a11cb0", "comment": "Malware payload (WeedHack)", "value": "a4c403f1007f8de13d417e758f1dbe0a8dc2393300bd149e2ba6cf905421cafe", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624422, "uuid": "ebeaa6de-ebca-4592-a953-5d267525d36b", "comment": "Malware payload (WeedHack)", "value": "299df2d21addfb4098086842ee08564f4d1ee824", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624422, "uuid": "1516eb76-23a8-4a0f-9368-e6a06a16f75c", "comment": "Malware payload (WeedHack)", "value": "0d3e7afd600c159921be32643d878ed7a682986230ef3f67b742d881aab236fdfb231e7b01fb8ac64ebbf17dbb8c5447", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624422, "uuid": "475d3102-7188-4e6c-a6e7-714a8a3a8cb5", "value": "T158951313BA9C143CFE775776E708DE1228AA2CD4E627702279F44BDE1817AF4934532A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624422, "uuid": "b5569a86-1ebc-4f5a-a7bb-5e168b56a569", "value": "49152:3GxEzLWzH0pDUGa7ogckYGJzNPpJ5Tw2k:3wEzLWzH0pDWLckYGJtpJBw2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624422, "uuid": "97b598b9-65ce-48b0-8340-8a86030a1626", "value": 1918244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624422, "uuid": "c9c2a745-1a3e-4014-ad28-47e4ba15f2bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624422, "uuid": "c804d8cb-47ef-4750-b804-128e7319e03c", "value": "Krypton-Client-1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9964974c-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607433, "uuid": "0bc1b3fa-2792-46ce-b3c1-732813a4cff0", "comment": "Malware payload (WeedHack)", "value": "c9bf5aa3b768210bee7dc02b5cb19ab0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607433, "uuid": "8a412d7b-0309-4a5e-bb65-814af08ce15b", "comment": "Malware payload (WeedHack)", "value": "a54d7cf9249ae2af2330b9fb4469097ae5e1f25db16acdb98d0ae293dab5b96a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607433, "uuid": "f972e268-cc9d-44c8-8623-4b43616a6555", "comment": "Malware payload (WeedHack)", "value": "07b0242661e5ad325e6fa63026791e628fe51202", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607433, "uuid": "50a33fd1-6715-48ef-8a64-042008130a2d", "comment": "Malware payload (WeedHack)", "value": "5ad82eea034ebc5a4bd92c51050d381202f07e2dfb80ebd554288eaf6744a47f859e756d81ef37d199bf9d6f54c4145c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607433, "uuid": "8609cc08-90c5-4566-9c3e-9f218ea75c6a", "value": "T157C2BF27ADDF7CB0F62718759E9A211B7F0F8B1832CA4098019E27AB1D0DC8C5E55B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607433, "uuid": "0ecb1444-8b55-43dc-8918-6807ef9d0588", "value": "384:ZbdUlm2FXzNamYr6lUViIdgInumQhW9s0J0PLsDER5Kz/Op67pxZ1TS137xiUgPB:ZBUY2FXFtImIu5W3J0PLRw9b1TS1WPrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607433, "uuid": "8d23439d-16ef-4da9-a937-7ed8aa6d7f35", "value": 27617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607433, "uuid": "c12a736a-d9bd-4b45-9948-574767703563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607433, "uuid": "0075a8fa-5a86-41b8-81d7-1503f9f81d62", "value": "Rat.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6fbbf7-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624487, "uuid": "59866ecd-ba97-45e8-a94c-5f222f645259", "comment": "Malware payload (WeedHack)", "value": "4878315cf7d9b8c0bcea1d3632730e8a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624487, "uuid": "6cbed0b1-bfcb-4174-aed2-5465bed0ed9c", "comment": "Malware payload (WeedHack)", "value": "a6b4b9163aa5ef2efc4b2d4e6ada904a0e5736ed2bfb860641417688a48b6cd5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624487, "uuid": "ef83c718-0aee-475b-a43a-c841b08e9894", "comment": "Malware payload (WeedHack)", "value": "caa67b0387e86389d410ad1ea3139d8ccadd792d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624487, "uuid": "517f11db-bbe6-41dc-96e1-1aba161fa315", "comment": "Malware payload (WeedHack)", "value": "537209bea3e7413217d187506b4895dd2f049ecfbbea06e286f818e25d684ed0bd946e9b834b82d1d011bcde5ada8a32", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624487, "uuid": "e0c2cd05-fa4b-4568-b5c3-c8b8c22f6393", "value": "T1AFC2C0F2D8BA8D13C447E37868CADD925A1F56826A1F344518E90FEB40BFCCDAB54302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624487, "uuid": "c4878efb-05a4-4307-8fbb-b79574977785", "value": "384:B3w9gntP+5A7EnwkC8Kn3UPmGYHQFE41S0+/0kkBLjAS3uwG20Qg6:J9n9Tf8g3UP0Qm41S0+8kkfASexQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624487, "uuid": "25a2516d-39fa-4f70-9c91-ac6989d83040", "value": 25873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624487, "uuid": "1409e6a0-0a54-4aa6-bac9-e57adc3819e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624487, "uuid": "d7c7ba23-519d-4b84-a1d9-5fee7def5691", "value": "schematic-bamboofarm.litmatic-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7ce632-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578506, "uuid": "c0eec26c-6cdd-4638-91a0-92b9a34018ac", "comment": "Malware payload (Mirai)", "value": "b5d279719da3a0cc347c8ef3332a215d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578506, "uuid": "187f716b-196d-444e-9c6a-5bafa5f359b7", "comment": "Malware payload (Mirai)", "value": "a6ea2b86f9ebeea6407bcc166b6681f84c58eb781af90d7a1454494587a28798", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578506, "uuid": "48103704-c067-45d1-8b21-2ff94972faf6", "comment": "Malware payload (Mirai)", "value": "0a35a215fec5e0e2598361418b94985fdfbe40f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578506, "uuid": "26a9b527-f986-4bb6-8bcd-e86cc681f50b", "comment": "Malware payload (Mirai)", "value": "00342a5a47df573b2c6c70db01960beaf6c02ccfc10094610a7c860c6ad3eec786925f09ff9c4eaaef529b345eb858ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578506, "uuid": "8eff2a89-9a13-4c25-958f-effa82fcc31a", "value": "T1FB734B21F9391927C0D5A17A21F74B23B5F643CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578506, "uuid": "d0cee0d8-4250-41f7-af69-b311cce63c43", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTOfT:7PQbrL7SYOBR2OfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578506, "uuid": "7d1b2489-b628-458d-b992-6348e393bdde", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578506, "uuid": "69e8eecf-1353-4ca5-9248-eaa2b69b3c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578506, "uuid": "8ff603fa-65e4-4204-a40b-89bb0a4b0b1f", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4aec4d-3be9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776600754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600754, "uuid": "90c18df4-ff90-48b9-a244-b374b65fa7ef", "comment": "Malware payload (Mirai)", "value": "5234aa56d98c969f17ed267a441d1156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600754, "uuid": "faf51ca5-d736-4e31-be6c-b7c21349f918", "comment": "Malware payload (Mirai)", "value": "a84b4544c37bc2b6426c5c0a5970038f1858f2cd8f4c76723cfac0d7e034618c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600754, "uuid": "85a05ade-7e72-4f86-a85a-b4c43a00ae1a", "comment": "Malware payload (Mirai)", "value": "e5d2a172a20713171285de3c1df2f79ab867a3c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600754, "uuid": "f04b2954-40ae-48b8-bb72-52615e66466e", "comment": "Malware payload (Mirai)", "value": "af05ff93c8ed39352c9216b1b675c9e7e5321f70434ffb534658725425d192b85368dece30283427c45ac72931948be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600754, "uuid": "eea1f938-ace7-49b5-88c2-29833cb20077", "value": "T1BE332889F747DAF0CC4305B0115FFB37A936B8A12224DD77DBE0BAA37CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600754, "uuid": "df15312c-7ddb-4c89-a9dc-b3c1aeb21e4f", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpOR9s0Jel/iE+nKPaO+hTvlwas:oSfvufWuq96f58X3jJelSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776600754, "uuid": "fc2bacc3-b62f-4863-a8ac-f9f57b2b422c", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776600754, "uuid": "83a9df43-fb47-4a74-ba1e-9f5e1ebad957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600754, "uuid": "3989c254-b8c0-4038-8e6f-fe2095e7cb9c", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf687c67-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598934, "uuid": "61854624-ae86-4b97-b7ea-17fad374fe72", "comment": "Malware payload (Mirai)", "value": "3a56c27e73b3230fefb877d6e5e27119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598934, "uuid": "1396b0df-3232-420b-9ff2-ce22182929c1", "comment": "Malware payload (Mirai)", "value": "a8cd372b8bb16c7a092ca336f85d5d8184c6194cdc78bac9a754e9192f20f278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598934, "uuid": "7210945c-542a-4ac1-ae13-26a3297f6db3", "comment": "Malware payload (Mirai)", "value": "d98d0a0ded0816f71b743fe22d5ca8717500c8c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598934, "uuid": "ac1c25ae-6b15-456d-a66b-47c4f04dd4a4", "comment": "Malware payload (Mirai)", "value": "49cb3bf3054be3f50a15f0d9db7324e2400b8fec3b891cea9fb84449574c960a126c5bbbc27b6162f6eac4ad2fe14898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598934, "uuid": "c85ac49a-8244-4f06-a477-9f4ff1ca02db", "value": "T1D3237CC0A543D9F8EC150AF43173EB329B7AF07A2129EED7D795A432D842702E54729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598934, "uuid": "013e535c-4744-41dc-b2e0-94bb9afe13d2", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLxD9NnbZrYMbJoSlO+Meb4ay:gWBsux3TUiG9qbBYSWV9N1Y8JoSlO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598934, "uuid": "c081db1b-09f4-449a-8be7-5d5701c8e8cb", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598934, "uuid": "9a04b7b0-6d71-43d2-8409-4d17093f4e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598934, "uuid": "97f37088-73c9-4982-a6e9-ea0520783456", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0410d660-3be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776597304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597304, "uuid": "f285ac98-c185-41bb-8952-ebcccea2edb3", "comment": "Malware payload", "value": "2b2bfc7faf8d6cf4809022892bce750f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597304, "uuid": "ed8d6a86-fee9-45c9-83ba-68ec2cd65705", "comment": "Malware payload", "value": "a98f29b6da816c9ae0364f3d4ccad7eea6b3fb8da5de868888b19eb3d8b95d52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597304, "uuid": "8bfe6831-734e-4d92-b06f-8eea47d98026", "comment": "Malware payload", "value": "d97b149892a25698678c8fc677a71a74d3677124", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776597304, "uuid": "627a6a64-e949-4150-afc8-0a0ba3317d38", "comment": "Malware payload", "value": "ac68cda179db32c9811fe581d444b283cadb41f16cccf85cd1bd92d311d8dc1e88812f3dded8052e0e38456ae66bbdfc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597304, "uuid": "6f2b72be-f59f-40bb-bf46-226c2f78e8b7", "value": "T1E5518EDB0280AB31E65CD54EB7F0B234710AE08366DF9A48EF90086C8EDAE4C7285F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597304, "uuid": "c01dede8-0744-4741-8508-5a152eca14ba", "value": "48:qmNmMmBOmB2JMImuymubiB8mKnmKuZUm9Um9cvyymBmUmvnmvbwLmUmsmWmMmtm0:2j2JMCsbiBqBuZ+obwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776597304, "uuid": "91b1f78c-8b6b-4228-a252-63bc68001cb3", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776597304, "uuid": "7c999df8-5442-4253-ae86-fac0803d777d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776597304, "uuid": "96af97d9-2c5a-4a0b-beb0-2f41b47c9772", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5a6808-3c2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776630659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630659, "uuid": "dee05364-8e39-4271-8536-aa5df60cfa8e", "comment": "Malware payload", "value": "79f8d00058b3068315cb4de6b0465b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630659, "uuid": "025f6129-f24e-48f7-a78e-37f35ef004af", "comment": "Malware payload", "value": "a9f54da77d9514467cb0e993ead87fb62d95227a46fba17102771aa3a62304b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630659, "uuid": "dc646301-f5ee-44ef-8f9f-17d544de05af", "comment": "Malware payload", "value": "1e9af4830e20f4122878b6990c8fd11ca81a2dbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776630659, "uuid": "b315f11d-c21d-4cd8-974d-4a5cdb0292fe", "comment": "Malware payload", "value": "4e12b6f6c7df488b283adeadc5388d7d9ed5a2c04fb3395dc687aa8e5f15508559edc092a28188368dd58a7a5c33e7d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630659, "uuid": "c5c1d528-067e-469c-94dd-7a9261f39c24", "value": "T1FCF6AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630659, "uuid": "f77da384-fa7d-4190-95c4-1d9c7b0b8ec2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776630659, "uuid": "8d96a819-eaf8-410d-a56e-a2a1f7919eee", "value": 16646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776630659, "uuid": "63028a25-f154-4e3f-8028-c2679ca69d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776630659, "uuid": "9a91d743-534c-4785-be8b-918be5993f76", "value": "a9f54da77d9514467cb0e993ead87fb62d95227a46fba17102771aa3a62304b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a3a1a0-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598922, "uuid": "1ee4b4db-8f26-4e07-a94f-5e28d2d7e65e", "comment": "Malware payload (Mirai)", "value": "e4c6e868893b0e0cf8c16011cd4ec654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598922, "uuid": "42326d04-f74b-4ff2-816d-a846e102c4fb", "comment": "Malware payload (Mirai)", "value": "aa12aa6a2cfcfb07c2690c08910ba7f11e38d47bf17b520a144f65ab94fbaa35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598922, "uuid": "bdf7dc99-8068-4aae-9ab1-bd89a6e1a6c3", "comment": "Malware payload (Mirai)", "value": "b094f87d6d39f2aee42eaa5211793e2b3346e6bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598922, "uuid": "925baa14-5518-4ba8-ba2c-fde0c2056e25", "comment": "Malware payload (Mirai)", "value": "83def875b11b9ee9111bbc2e8dfe18469e8dade73d1545e633fd19d13498010ca4f6529f8f34faed6a5e6b3eb75a0d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598922, "uuid": "2ac82eb2-234e-4c16-9d96-17c6319efb29", "value": "T1C7A2D019BF58828BC832797455D9F5D22297FCA1F29DCC4E2940C15FF0A33A96434E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598922, "uuid": "a7d2a024-3af0-4c27-b397-535eadd74856", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTK:798o08kxofBE+ZkXaITbp2F2TWul0c5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598922, "uuid": "e4b7839e-d6a8-44ec-b977-e2192f715c14", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598922, "uuid": "58b309c3-4706-4d70-b4ef-f3eaca3ff7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598922, "uuid": "07487efb-be3e-4cb9-bf7a-ae538e0de51e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5885aca3-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "694a6db6-3ce3-4c6f-a19f-0133a759fa06", "comment": "Malware payload (Mirai)", "value": "0a307794c3a7530258f70a7e60db222f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "ab68ccb4-4b77-4a96-840c-846449ce779d", "comment": "Malware payload (Mirai)", "value": "aa159636f2a5db68b5c8d33072d0ac243e3178d21c8bb09c5ddbaed0b8f09beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "43d12831-8e38-4186-aa1b-707bdef08c8b", "comment": "Malware payload (Mirai)", "value": "a845d34677b897a6e23e46c922db991089c60a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578548, "uuid": "9f4df6e0-4555-4de7-8a89-8fe79f1d7041", "comment": "Malware payload (Mirai)", "value": "dc7752bc663b44dad1421d3fb262fb1d68cd46b055799a272e8cf4052d6ebf5edcf927e6d936ca11bc8c9fe84564e231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "cd8bed93-f93f-4ca3-8507-4e1caf59925b", "value": "T185A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "ce18c924-332b-469c-81df-f9d02e6922ba", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj67NYK:5ZzjJa1rZ62yqPy/ULWzj67N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578548, "uuid": "297b3072-7605-46d4-9330-e6365969c0a9", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578548, "uuid": "e61790e7-f9b7-4c4d-8665-45b5c4ac06b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578548, "uuid": "2c12dc59-c1a4-4e84-a5e9-633b8744ee09", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeb1984-3beb-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776601638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601638, "uuid": "13765154-54c4-4d44-bb4e-3d1ad0c59abd", "comment": "Malware payload (WeedHack)", "value": "f050076dc13627a04cffc731fc7f81b3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601638, "uuid": "7d4f85a7-120c-485e-a6da-892ad31d4a60", "comment": "Malware payload (WeedHack)", "value": "aa708f7a308c80e5de86ba11ff88ef666d19bdb150280c0ecd24a7428242d179", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601638, "uuid": "1db053c0-c14e-4455-a12a-bb14c1b25613", "comment": "Malware payload (WeedHack)", "value": "4e8da8adced811e3031ae9f84fd0e211cc05f223", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601638, "uuid": "8998e9ed-010d-4a8e-a031-9e51b7850682", "comment": "Malware payload (WeedHack)", "value": "4af23024b949aa13005381c180cc1a1ed2cc3fe648d0c372cef28db0e9fcd68ca2164c848cf2dfcb77ebac448bd1e9ae", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601638, "uuid": "f1096ede-3949-4967-ab24-f11e0d15a619", "value": "T18315335DD0DA666EE91D92E7889BDDE038DDC9DED7C220740025C2382BC35AD4CB2A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601638, "uuid": "b2122844-89e6-482a-a0a0-d718063cc7e4", "value": "12288:QOVNhnNjot1zDHcvY4edsOQHrGGWVsbU5BEewIbugIYTQ165qOPX6RJEziB3F0/y:1HnWX/0YIxLtWD1vVQ16QOPXEKqFKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776601638, "uuid": "97819321-fb40-485c-b411-327f91c9c24f", "value": 875885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776601638, "uuid": "c13e3c30-bad7-4eee-a0a4-197b739d8512", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601638, "uuid": "544f3bd3-5039-4cc8-a5b9-842cc77174da", "value": "aa708f7a308c80e5de86ba11ff88ef666d19bdb150280c0ecd24a7428242d179.file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c77c48-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586944, "uuid": "5c7800de-3f8f-4942-baeb-446565b88a13", "comment": "Malware payload (Mirai)", "value": "cdcf4ea74a7716d96a897f54b5dd7523", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586944, "uuid": "07e09250-f9c6-4123-bcea-458fe0d56d1f", "comment": "Malware payload (Mirai)", "value": "aabc9ee393ff5ae4816a88b865c6c9bb477b7d5d39881bc7f0b07c8952df6bd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586944, "uuid": "e17e7085-a625-49bb-8651-debeeff0b23d", "comment": "Malware payload (Mirai)", "value": "b7ec5306f356ac90838b88e7c3cb660c51150b24", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586944, "uuid": "d887cfde-58a2-4670-ac95-0b7d44885ea0", "comment": "Malware payload (Mirai)", "value": "a565e072cf9d8599d582be1503959c4c76d7d61a96dd0818c26090d6555d798467a5e9940e2de753c0ba9b0f74951fda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586944, "uuid": "b1e8afb1-fcd1-451a-9487-cdcb3e022aec", "value": "T13521C00EE3596D8FD9A7117D241F06277070764AF4138523E3658E3FBE775B4121618E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586944, "uuid": "caebb7a2-6acb-4b24-99ce-f644f2652175", "value": "24:3UtbSa8DzSWPpbP78Pwy74+CiWTHH4ZWhHqJPDD8ECAfGRiowCxUFRNT1ow:EtOpP3hb/moTkWhKJX8DAf9oq7Nhow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586944, "uuid": "a8065f98-1ea0-411b-ae6a-e5808ff4d95d", "value": 1260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586944, "uuid": "1e01ea08-56db-4bdc-a00f-b811557da4c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586944, "uuid": "a9155990-f883-44e5-963f-20dbd5bc7564", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b36e81-3bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776582625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582625, "uuid": "dad4474d-0934-4966-899c-74a75c75f463", "comment": "Malware payload (RustyStealer)", "value": "34ebda5eb61d51837b7caa8f463e71f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582625, "uuid": "f6471f73-4899-42f3-b031-02e8dce363bc", "comment": "Malware payload (RustyStealer)", "value": "ac225e959e4d41c0ed8ccb5ac086bd507d46d2bf7d5ae42657ea61cb467de411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582625, "uuid": "82867241-98f9-4250-bf7c-94ba5912c304", "comment": "Malware payload (RustyStealer)", "value": "349cecd03917d480da180895d28ce9c490df53ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776582625, "uuid": "1642508a-6cd5-4273-9fda-3bafa6ddb982", "comment": "Malware payload (RustyStealer)", "value": "6cdf28beca7fa158fa8fdb451df60972bd63542d027275f6db1ffbb4bdfd2d08a1d49284d2808455e9e83af83520d192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582625, "uuid": "251c4d84-ff9a-4021-bce5-9f93b0b47e12", "value": "T1EDC518216B5A99E8C55AC074C38687B26A3130CB0F35B9FF449496783FBAAF51F3C254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582625, "uuid": "0846ae20-7872-4157-9528-f22599c3b208", "value": "9ebddcf654f694bb42525aaeb56b542d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582625, "uuid": "276eec82-62a3-4f56-b7ea-481a96eaced5", "value": "24576:xkfLZwXOWoaIlxqQyz/y3yNIRI5iFmR57KBA+6s/VCKxnAKmA6tnVwk:/+t1qV/y3GIRI5iFmR5+BAS8KxA1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776582625, "uuid": "190cdcb1-755a-4dc5-a811-b1f695deb43b", "value": 2690560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776582625, "uuid": "d90ef6a2-4b97-4881-88ae-fa42d755b0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776582625, "uuid": "822ae409-fa8a-4eb8-a579-390c80035ca6", "value": "\u5982\u4f55\u8ddf\u56e2\u961f\u957f\u5bf9\u63a5\u9879\u76ee\u548c\u4e1a\u52a1.a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ee8dc-3c17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776620731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620731, "uuid": "6845dc28-4f7a-4985-a113-89a2b755f41c", "comment": "Malware payload (Mirai)", "value": "1d595e2490070d7516ecb0810c13ee0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620731, "uuid": "f7275441-c54f-45a6-88a7-f113af42ca92", "comment": "Malware payload (Mirai)", "value": "ac470f8047afe9f5dc4092892181c2531181c1fe3a2ed2254aa4a013d872dd58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620731, "uuid": "d4044f0b-e7c9-4549-8b04-a6e72b3ef1f1", "comment": "Malware payload (Mirai)", "value": "ca279375485ab43c123fc02a6ef1910cc5196d42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776620731, "uuid": "3f312bef-6137-4ee2-9342-096bc6991ffc", "comment": "Malware payload (Mirai)", "value": "5712bc06e9aee7b425325f4af9b6de1a94674af857b829227f55276d70e8125543bc3f276057836691f69ee7e3a8010e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620731, "uuid": "96156925-b55c-480a-bc34-a46a1603fe34", "value": "T1A9D3AEABB30F2050C42547F41BCB6BAD2A2325114E2B96E77C6E373E5A775DE18063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620731, "uuid": "3751ad60-858a-4449-a445-0662ab7f93e0", "value": "3072:faxdaCG/lPqqbuIty0mX8oAbyOPDwgeCSaRrh+q:favVNqb7y0sP+xPcCSaRwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776620731, "uuid": "833d7970-6421-47ee-b98e-cef1704af540", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776620731, "uuid": "6368aae7-2b1a-4908-b875-2d7325ae9ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776620731, "uuid": "fe61377f-7240-4409-9266-637c343bc372", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d23fc3-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578684, "uuid": "1c00be98-0b4f-44d8-9f4c-e94eaf0e4508", "comment": "Malware payload (Mirai)", "value": "31840434ce817e2c2668df744926a5a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578684, "uuid": "6cbf1e28-7755-4503-9eb8-66547577b4c8", "comment": "Malware payload (Mirai)", "value": "acc0c1ad15bdcff153995dc4f6e7faa205d2430016e219c61ae2526d8b0e766b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578684, "uuid": "d5abaa2b-8c6c-4bc4-a942-50ffc1263119", "comment": "Malware payload (Mirai)", "value": "320f776deb7db80ce82bdda290e1114052424088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578684, "uuid": "82ebd8a5-a2de-46a2-86a2-54e641de29ba", "comment": "Malware payload (Mirai)", "value": "6b79f60b938ea2b89865e70a8cd99970eaf27af04c1ffc63704ac63693a9ce5c61249196833c5a85db01565523e440c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578684, "uuid": "684bdaed-756d-418d-a9ce-c931c8ea2838", "value": "T1F6634BC9F983D4B6E897093010BBBF639DB3D6BE2168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578684, "uuid": "ed888ca8-86c9-4431-b8d3-1c2491f55a2d", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSYi:ltFyA0j4HWBJOvwfIyqsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578684, "uuid": "90ad9bc3-741d-4055-82df-ebfce8d684f2", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578684, "uuid": "ad55e978-794b-4357-b9c8-2ab8c05f7e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578684, "uuid": "b729faa3-9518-4b0e-950f-62f74471a0a6", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a2ab33-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631128, "uuid": "9d3413eb-4800-4fa2-9379-707b7fd20b2a", "comment": "Malware payload (Mirai)", "value": "abd62c7adc4c299f4646035bca953846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631128, "uuid": "4af48c09-c3c0-4067-8b9d-5f151488bef2", "comment": "Malware payload (Mirai)", "value": "ad00f7c4839fed1b274cbadc566a2c046e9e9d863728c9656c4d5b32a43825c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631128, "uuid": "e644edf6-d680-45dd-9101-1960c9fbbaef", "comment": "Malware payload (Mirai)", "value": "877a9144f29f8e7109515e415d1c2004395fcfe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631128, "uuid": "b346d1c8-5e67-41c0-b203-a1c4994e38fe", "comment": "Malware payload (Mirai)", "value": "cb987b6885203d764b5a2d614a9219f6c0b7ee1ef970e0cfff6d115c2adbdadb76e61bde655e06fc5cdf7eddee0286f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631128, "uuid": "a82c7a84-0bab-40fe-a558-b027af63cacb", "value": "T194042B02771C4E43D1572EF026F727F183ABED511AA6A640F21EFE886372BB15549F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631128, "uuid": "3bdb91c3-901e-467a-a41b-38f0869e3b35", "value": "3072:740edf8BxoZySVQGuIsgC1KDQlimu6J+Po2bj2/4NPzRj:7Qf8BxWVVQGuIsj15limu6J+Po2bj2/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631128, "uuid": "19cc74da-896e-4afe-b2af-10f6c2d6e7cb", "value": 178394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631128, "uuid": "b7963814-c987-467c-aca5-0662402c6b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631128, "uuid": "28782db7-77c7-4d49-bef6-c952cb597813", "value": "mynode.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22b2f1a-3c38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776635070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635070, "uuid": "cccf06df-056d-4401-bbb8-f269432e3b09", "comment": "Malware payload (Mirai)", "value": "9e905abe741300df2a9f8e46cdc22066", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635070, "uuid": "95eecaa9-e54f-40e2-b0dd-c945220f735d", "comment": "Malware payload (Mirai)", "value": "ad0acaf2844f1971b1f9bd4e062b188e95222bbd34f25419ec6cee6b495ae409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635070, "uuid": "f969a14c-c820-4ab4-bfaf-f0f85b9c0b2f", "comment": "Malware payload (Mirai)", "value": "7d62e8c086c09e7a0a1906c1a92963860c9998df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635070, "uuid": "41b517e9-10c7-497f-99b8-a7ccfa7ae32c", "comment": "Malware payload (Mirai)", "value": "d1b6f183cd95cbd2e8cb31fcf59404b7d5a4d3fca6c1727dcf914393e67e03bf63684fa5829a2fdae86ef49336153edb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635070, "uuid": "3a8dd01b-6440-4c80-893b-f309aa5847db", "value": "T1BAF33B46F6408A13C0D6177AB6EF42453323AB6493DB73059928AFF43F8779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635070, "uuid": "ac239e5d-b10d-495e-b9d9-e154f4386c9a", "value": "3072:SbzuIQ9vKpSaKJS4BHqmUoq1+7pTyVINSLZJiM/9b5J:SbzuOSaKJS4BHqbob7ZyCSLZQM/9lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635070, "uuid": "c9641f54-d415-4be5-ad02-4257235e1e79", "value": 160442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635070, "uuid": "b7f6fb8c-2b1b-46c8-977a-d56f3f5038a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635070, "uuid": "126d6626-526c-4f01-a640-3772385e8280", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8afdd04-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578387, "uuid": "4c3e72f1-6701-46f5-8cd3-9a20d7a64e86", "comment": "Malware payload (Mirai)", "value": "5499dc2828771e24c3c87d17d1dac8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578387, "uuid": "78798e6e-cc08-4311-9ed9-3b2472a60ae0", "comment": "Malware payload (Mirai)", "value": "ae06d9198cb0870248ef73942e7c68dbfd5de9eb0cfb2bc5e70860752b9a2141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578387, "uuid": "6948ee26-1c69-4118-9ca2-1a15d58b8a63", "comment": "Malware payload (Mirai)", "value": "093fc88b3249b71acf300d62c8cc1c1cd3aa55fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578387, "uuid": "af38ace5-189f-4d24-9dac-96b957199e9f", "comment": "Malware payload (Mirai)", "value": "babe4c881dba3b8a3c74f22f85345dba57da571a7e581a529d613fda2fd5fc3da5a1e032b228597ae212ace4bde7b834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578387, "uuid": "c44a0934-5c63-4c97-929e-58e7f1552f4b", "value": "T1E6631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578387, "uuid": "c8725ae6-5e1c-4b3e-8695-8246828cbee8", "value": "1536:XGBQnw68oqNi5IBzI/GIw+D3ohyaRdWViEs/hX:XGBBa56+1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578387, "uuid": "932302f2-3f23-4964-ab19-4c3cff6d360e", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578387, "uuid": "5472ed9d-603e-4bd6-89b2-05b1425dd0c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578387, "uuid": "94054315-807d-41e4-af7c-8da89d9ea23a", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b11594-3c32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776632448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632448, "uuid": "45e8066d-1d2f-46af-9d7f-584adf7646eb", "comment": "Malware payload", "value": "7676142c11c5c3e71cfc556da6a5738e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632448, "uuid": "3d593294-d3df-4d82-8e2a-a30e65c5ccbd", "comment": "Malware payload", "value": "ae50e78ef63519e35ef6eec42167023b2ff8f0b7fbf73ff6dd58130fa378f0fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632448, "uuid": "9d0ac67a-5af7-44f7-a397-4ac2735d5bf7", "comment": "Malware payload", "value": "f919915a75b2a4b6c5abc541a4b5d549444baab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632448, "uuid": "e6c70402-5da9-4f04-8d58-aa60440942b0", "comment": "Malware payload", "value": "c8cae412a43a974e7c983913de8425ebd64c3e11245e83c887a12957a106d6ab40cd2b80e4cd76ece45d3c7788297fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632448, "uuid": "bb1a3464-3cc9-453b-8976-ac9b5eda5e9c", "value": "T1E327CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632448, "uuid": "d8fdee32-6429-46eb-a970-7204b8998e35", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776632448, "uuid": "d1392a9c-e1bc-489d-bd73-ebde91f916ac", "value": 21463040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776632448, "uuid": "4b60f395-ad74-4ef5-aa5e-c04f575b5771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632448, "uuid": "7c220165-4fc0-4240-9e3f-afb71ad35150", "value": "ae50e78ef63519e35ef6eec42167023b2ff8f0b7fbf73ff6dd58130fa378f0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6d94cf-3c32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776632458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632458, "uuid": "45e88052-ff15-413a-a7f6-4739d02844e0", "comment": "Malware payload", "value": "2f6985db2a7716bfce7259a20c16c33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632458, "uuid": "8c7846a2-7a56-4a2f-b317-f0e8df2e3ba6", "comment": "Malware payload", "value": "ae5babe295a0d9e923200451a1e94f3ef56072cd970b87c4f6ff6873e0d7c65a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632458, "uuid": "4ce5dfc0-ec49-4fda-b034-873acddc05db", "comment": "Malware payload", "value": "d55ac73b4fd3c93a820c08906d6ce19d611889fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776632458, "uuid": "cb7d2289-5724-45da-b37f-ccc1c86c35a5", "comment": "Malware payload", "value": "7d449717f1fe32cfcd6d28976100fb7cea37c0c12beaefa9025165f41a4206395b591f73e3398351005de08f38b0a41b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632458, "uuid": "a2405315-826e-4802-9912-9061bb69de64", "value": "T1BDC68C77914238E9E4A98CB4D11025526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632458, "uuid": "dfec1115-7b54-4487-b464-67fe5a18212a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQn:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776632458, "uuid": "0ba6ad16-1bec-4ec6-aeae-53d8a6d0ddf7", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776632458, "uuid": "066535af-3e3b-46ef-9282-68ee62e7ff82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776632458, "uuid": "71fb287b-f0e3-428b-bea1-2d64e36665c5", "value": "ae5babe295a0d9e923200451a1e94f3ef56072cd970b87c4f6ff6873e0d7c65a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b519bb05-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598890, "uuid": "3aca5270-0c21-4414-a5d8-c24bfc83f02b", "comment": "Malware payload (Mirai)", "value": "b6d15234b011aabf653b829e560199d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598890, "uuid": "2ff679ad-0779-4749-8b00-b9b736cbd050", "comment": "Malware payload (Mirai)", "value": "b0d9af4b5453d38919f8859f800494ca79619e1e9ae727685660ebc80de4cee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598890, "uuid": "518754c0-cf1c-49d3-bdf3-f95141eb9b2e", "comment": "Malware payload (Mirai)", "value": "df46f02288b6f9fb296c802c32ce805c75ff222f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598890, "uuid": "357b9dca-ddec-492f-9588-f8e06ef0905f", "comment": "Malware payload (Mirai)", "value": "65432f5b6c673ad38bb2833c2a6231aa7f15f29fce6ec4db52e4383951c699f6fe9d40bba896b4ea135d04ba0bc1f055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598890, "uuid": "cf5a2b51-76cc-40be-9cc5-e8fe7466acfb", "value": "T10F430852BC818A05C5D412BAFE2E11CE33136768E2DF72139D106F247BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598890, "uuid": "551c6420-7392-424a-8ab1-3d16aad96808", "value": "1536:ZVnsP+SiPuXJEbiaNV82/rKGpoSEpLWIxibJgwKWFK:6kPcmi2V8M3pZJgwKWFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598890, "uuid": "ccf8d947-3397-49ae-acd9-df54f6b59c6c", "value": 59680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598890, "uuid": "c8b78652-b139-4d7a-aef1-e037f136dd09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598890, "uuid": "dbdca5c1-e5c3-473a-b756-c74a4116210f", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590551b5-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607325, "uuid": "9a5ab4cb-a8e9-48ea-b2c6-3e6e14f6587e", "comment": "Malware payload (WeedHack)", "value": "7a5173822ff00fc383bc54a974c2bee2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607325, "uuid": "b5c5bb1c-73c5-48f1-8de5-551d4bd55ce0", "comment": "Malware payload (WeedHack)", "value": "b0ea5a84e9a762edf0179190069d410b8298e13a12ca069a612eeacf11656ab7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607325, "uuid": "a9fb136a-86b9-47eb-b0d3-39a54f251972", "comment": "Malware payload (WeedHack)", "value": "130fe9432935d195f0108f9977bca474a2f0aa2d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607325, "uuid": "c3795a47-fe78-496e-9d38-3f40f6d22dce", "comment": "Malware payload (WeedHack)", "value": "478077a507f600c83c4df9631eb59af7f016e49687595190236c813b5363385c9c252509753dbcda1e67a441db9b9e90", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607325, "uuid": "93f457e2-a26a-4941-9fd1-4e215829632f", "value": "T1F474F131D62E04EEF9076236EA1087353C5FA2C5B007323DB6A8DD53557F4AA8E7426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607325, "uuid": "808ef343-1acf-4f15-b9bd-49e6919e75a3", "value": "6144:B/fyX7aQGvh4IPAzHFQDsB46VlUmvLOeQZnW9ozLZI3Fg7m:B/sAh8zHFQAB4/mIZW9ozy1Gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607325, "uuid": "011db1f5-cf46-4a12-8362-76c83dd4beaa", "value": 353130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607325, "uuid": "c85354cf-5c6f-460e-b553-6f311ffcdcaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607325, "uuid": "bc65f061-e09a-4361-8567-26e8b0a84368", "value": "ImmediatelyFast-1.2.111.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864605f0-3c18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776621145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621145, "uuid": "a3047833-9560-4a13-aa4b-f361c1debb4b", "comment": "Malware payload (Mirai)", "value": "509e6b1011fd723cdd7257f3d981f1ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621145, "uuid": "5e97c921-36f6-4604-9475-00ad7dc11f78", "comment": "Malware payload (Mirai)", "value": "b0f8e09e82bc44426b6f89cf1125efde6a8a7631ef80924bdd5f358e7b8b02a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621145, "uuid": "205add4b-d03e-4852-bbda-d91bb87fd6ee", "comment": "Malware payload (Mirai)", "value": "f84ff983d4e80c8fb6d949576826c4027d2704d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776621145, "uuid": "dfad6d79-2349-43df-af99-986cf11b4eb5", "comment": "Malware payload (Mirai)", "value": "dfa5e964d1e2aa999b186adb8dfc9f779cc10b71800ade4a1f8e777224fcbd4d22ae74e2fb74db3aefcf4a0d80b66314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621145, "uuid": "f5402efc-add3-4804-a7c2-85ca930780f9", "value": "T1E2D31956F9809F12D5C151BAFF0E128E33131B7CE2DE72129D24AB74778A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621145, "uuid": "5edf52af-9110-4779-92df-d5a545d58685", "value": "3072:pvvRQnw4QyaXihtoa8QGAVPF4gyIyrN44NElTqFQB:t5QZa4toa8QbVPQICN4NlTJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776621145, "uuid": "737887e8-5a7d-420c-bc14-9d4767929b2a", "value": 141940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776621145, "uuid": "db0031cf-3157-47bb-95d0-e7560a1a7879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776621145, "uuid": "cec23889-371e-4f31-b8fa-d57339e6747c", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ca8388-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607244, "uuid": "ac0168da-aa94-40c4-be66-02fc5ec611fc", "comment": "Malware payload (WeedHack)", "value": "8e95b30a1b4258a2f127e710ad36c3c4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607244, "uuid": "6e4373f3-4581-4219-8351-0a2aa9a8e8c6", "comment": "Malware payload (WeedHack)", "value": "b11ea25ab01fc58b68ec9f316da1d73c77899f98ce6df8b96adf15fa9c9bbd36", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607244, "uuid": "d567dbf7-f639-408d-8772-5a50a046630d", "comment": "Malware payload (WeedHack)", "value": "e9ddaccb2ecf420af96e234fd71d3311c5d2ce87", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607244, "uuid": "13f3a19d-039b-4b7f-aae2-94959f87adee", "comment": "Malware payload (WeedHack)", "value": "0c23db7479b75ed9e6a544fdd74c9aeb6cada1fe02ca42db7a91248b948f352ea20613e25b19ba32a03990f62d927b6a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607244, "uuid": "77925bdb-10f4-48e4-8e08-db33813920ba", "value": "T1DC4423285C13CBD2EFE6967FE380041D7A2B2BC85B6B25005666D76B9F5130EBB17384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607244, "uuid": "d2f8f30e-1c4a-4bb0-870d-9a1a6ea2eb0a", "value": "6144:ztTEAyvisNaIf0XeDz6n28BMe2DgQe09i1IRC2vdVi6Rb:ztTEAUnOXeTdDgQe0AWVdBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607244, "uuid": "1fa26b8e-d403-4a06-9dfa-9300f7b3bc77", "value": 261387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607244, "uuid": "53c5dd11-973f-401b-b378-235b97a70ccc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607244, "uuid": "2deb5fe1-4cf2-4c29-a7fd-bb6aa8d8a70b", "value": "ApexPVP-3.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1861b3f9-3c08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776614089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614089, "uuid": "4541347d-fe44-4df6-8add-9e82da77af18", "comment": "Malware payload", "value": "0013700286659fad163283eb297f65ca", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Zenlod", "colour": "#347430", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614089, "uuid": "e95fe743-afec-4a44-9296-a83ee528f895", "comment": "Malware payload", "value": "b13aa04de5a3127d041a1f2e44d6b0ce42d99aec2dbf6278b06aeb634051f08d", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Zenlod", "colour": "#347430", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614089, "uuid": "95378483-e72b-4132-88ce-0c1ecce3229d", "comment": "Malware payload", "value": "072e0623a5a3b1c33c592b94fb38de24ca7268ba", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Zenlod", "colour": "#347430", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614089, "uuid": "eb276ee4-b8ac-4648-b552-c62a4f44b675", "comment": "Malware payload", "value": "341e6f2773a26b9de5f33d8c2398bc13fc23c2d6876060572c8e52fc70643c79b581b1e8c90c3f14809bf2e1a9365784", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Zenlod", "colour": "#347430", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614089, "uuid": "ef745548-934f-4bee-a70c-31217fc69f8f", "value": "T1BE231804E501D937C5E188F792A8C7B26A39EB31430613DB63C81EDA7A699E5ED3431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614089, "uuid": "0a4234c0-e5d7-4a22-bb88-b5eeacedf462", "value": "c01c4fbf2a9af4c3838720082d5559ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614089, "uuid": "91c8a0fb-ac09-44e2-9417-852055ee4518", "value": "768:KZhjmtxBoz2fH3szms3oC6MrzzU3jNF8v8SLllSk2PVDEbxb:4jOIz2fHYl3oCdDGZ6xlh2PObd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776614089, "uuid": "6b5d3689-056d-4071-91f1-355326df95f3", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776614089, "uuid": "f5437e20-5db1-49af-a585-09f04bb4751c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614089, "uuid": "b5ccb2e5-5665-44b9-9916-4aeade8a6719", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32401886-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624440, "uuid": "490dd8fd-6065-456d-9d5c-b65f363e1d9e", "comment": "Malware payload (WeedHack)", "value": "f5d8ef55fd539452caaded022d8f12d1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624440, "uuid": "eafcfcc0-a8ef-4e30-84bf-4f756b600e2e", "comment": "Malware payload (WeedHack)", "value": "b175f76080def912a6c5ad9ebd691cfc059c01448d5f5291b23816e2e16b92da", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624440, "uuid": "85413835-ed35-420a-96ae-2fc29a439900", "comment": "Malware payload (WeedHack)", "value": "18be175d57d2bf3b2061491b8b5c9b38b0670850", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624440, "uuid": "0e4b1305-fa86-4085-915f-80826ec40d46", "comment": "Malware payload (WeedHack)", "value": "744e64d06e30bfbc6997eea7193b15452ca70247b48a5543f6bdf258f8bda04e50861189392fe39666242581950d7e38", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624440, "uuid": "a1aed419-bf60-46d8-a345-f9317818d925", "value": "T1ECA63327FC8DE280D8523E33DA92ADE67561C633EB44EDFA784EB51AE7486C057106C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624440, "uuid": "cf5744ec-1bcf-46f7-b453-fa24d0074179", "value": "49152:WAYzLkkVBE3ZcpjBRvhQdTQYCm1zpTgeW3o1epcFDKq:wvBEKxviam1BzW/pcFDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624440, "uuid": "b16276de-d8b2-4d70-b723-e8b8558e2b31", "value": 10342400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624440, "uuid": "bf5775c9-2a8c-436c-95bd-d078d384cdb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624440, "uuid": "798b7265-c874-46f6-b7c0-a6d93d05a0fc", "value": "Krypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb626db-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578585, "uuid": "09788caa-2a84-47fa-8834-c7b95b8d2ac4", "comment": "Malware payload (Mirai)", "value": "50f4b95e3b095d1a371e5d80182806f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578585, "uuid": "47fc9f3d-c9a4-4f83-8937-4cb9838a881a", "comment": "Malware payload (Mirai)", "value": "b289399a731cd2a2e745ce29e6101e551962a3de634c13470932c5764168c779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578585, "uuid": "6095e2e7-96f3-44d0-bfbf-b6d1716b1966", "comment": "Malware payload (Mirai)", "value": "bf0ae54d5730194769a525fa707f73833c7f8958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578585, "uuid": "92800974-e714-44aa-9bb8-95c744aafbc0", "comment": "Malware payload (Mirai)", "value": "cdc3147896de3c845c595d02674e0fd10c9817028d502b228d260b7be334baaf4680c29d91354ae4c14023c2054c85ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578585, "uuid": "9e02ce80-f563-46ec-97ef-11638c760f2c", "value": "T156D33A06731C0A47D2632EF43A3F27E083EFDA8121F4F644655F9A8A91B1E361586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578585, "uuid": "d0d99852-7037-4a0b-a5e9-ae7f2ed62d1e", "value": "1536:5WM4Crntg3uZVoBZgQMxfa1qITG5HGXmY+0KXc9f8vATpEX9lejtSqqVoLSG1Amg:5WMtgoVegQMxxIgpY+7c9pTCGvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578585, "uuid": "dbe570bf-f6bc-4e8a-a687-86a3c1085c50", "value": 142228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578585, "uuid": "6d6ca49e-fc85-49c5-a208-2312058a27f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578585, "uuid": "3db01552-166c-4132-bce2-16f1355c37a1", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69241247-3c3f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776637846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776637846, "uuid": "5d519c3f-7cb6-4d6d-9a81-edddd842c827", "comment": "Malware payload", "value": "d60556a68a11135b91c6c528f99b7cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776637846, "uuid": "8eadcdd3-ed58-4dcf-b12b-78f8ed525db1", "comment": "Malware payload", "value": "b2a414fdebfab266396cb009a8f2a605ec6babe251a0c963913c6c278665b032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776637846, "uuid": "7c8c7fea-210c-446a-abe9-2511a0907518", "comment": "Malware payload", "value": "c30a11991173c08a2e8a8de707fa2d8993f9d136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776637846, "uuid": "093b9017-a879-4dd2-9a93-b5e7f269d0f3", "comment": "Malware payload", "value": "1cfc4e5e12489d4dd66282db3ebd5f0b2bcf2bec4b8449cdcc6f385c6fff6bca20ec8b64708a851447bf65189415b7ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776637846, "uuid": "f99aeebe-8f90-487c-b5ba-726649e15dfe", "value": "T12E17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776637846, "uuid": "434f55c6-9a3d-4a3e-86ea-6748f50063af", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776637846, "uuid": "167ab405-9df3-4ebb-b77e-d25ccc88fba2", "value": 19464192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776637846, "uuid": "fbd1bbeb-4e47-4f15-938e-e389d5221bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776637846, "uuid": "11b5d1c3-7c37-4b0a-96f2-0138eb60c0af", "value": "b2a414fdebfab266396cb009a8f2a605ec6babe251a0c963913c6c278665b032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec95474e-3c0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776617022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617022, "uuid": "b37ecd86-2db8-4783-adc5-c34d28d0ed9e", "comment": "Malware payload", "value": "1d4169eae207999937d728737b4d7235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617022, "uuid": "76e1a058-9aa2-4c20-a45a-8b6fd618e4f0", "comment": "Malware payload", "value": "b3083eeeda8c524ee959f2284efe0fad9c0047326874a2381360e6408a98e320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617022, "uuid": "ba1d7825-a244-480e-ab77-e382e7aae8cd", "comment": "Malware payload", "value": "43f420cc628232faa380cc62eb3deb60695acfe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617022, "uuid": "66fc2298-ccf5-4fbe-b506-6c5ef37303fa", "comment": "Malware payload", "value": "a3eeaca73e942f1c7ed47eb35fd734a5e4a5d53b2e7d2857e2622dc585daf33fd95c936f3db4f4ae5309bf687a7fb9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617022, "uuid": "a7e4ee30-3df8-48fb-ae97-947a86fc457b", "value": "T14F835B0933E44E91E9FE0A7B0A7291154372E5925F53E78E8EE1589E2F733828D0D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617022, "uuid": "fbd2618a-df27-4891-bc7d-a5a462696055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617022, "uuid": "472c158c-fe5c-4550-8479-b7ffa6960861", "value": "1536:gJwsHslhVsETri9gF8CILbpL2rCufRGqTomkQXg82b7c:gJwNToCILUrCufRGqTtkQXg82b7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776617022, "uuid": "8cee1ee2-4123-49ba-80c3-79089a16abac", "value": 85611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776617022, "uuid": "dd73df95-50f0-4bb5-940c-dff5c9893700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617022, "uuid": "732eb436-9b3d-4b98-a394-fa5bc968770b", "value": "66d.co.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daba8e23-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586927, "uuid": "1dfa6352-51a7-4d23-b9d6-97f39fd2a583", "comment": "Malware payload (Mirai)", "value": "0ec7ad0041eee790298b6da537007493", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586927, "uuid": "ac0da4e3-53ae-495b-89ad-367737a652d0", "comment": "Malware payload (Mirai)", "value": "b32ff29a595392ae8d24f7c75e56f63ad4d9ee514ee15eeccb36efa026ff8418", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586927, "uuid": "adcd4b43-9bd9-4aa8-a241-0af37d7ce972", "comment": "Malware payload (Mirai)", "value": "403596b58a276727c134deb3153cb64e8ba05928", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586927, "uuid": "82429241-66ee-4789-99a2-4deec7622296", "comment": "Malware payload (Mirai)", "value": "eca908496662d07bf56fec2cfd4d5dd91f16f900e37e5bae282d7372353cb58d78104cb55df39fbe427bb3bf7bacb8c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586927, "uuid": "a3ffbcb2-c2e0-4583-8eb1-9bc28f43967f", "value": "T1FC5122565BEB0E2BCCE2023B99AB4754AB06FD9340D5FB1BA31454950E3B28A7F31154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586927, "uuid": "dea23506-5fe1-479a-b8e2-1341d8f9419b", "value": "48:JO/DFqDPtRrkFSsCzLq5I7UUUGN8ZpbSl:JOLFwTkFVCz+VbSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586927, "uuid": "ed035b4f-d981-4339-aabd-02265a9337de", "value": 2681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586927, "uuid": "8e4d2fbb-6b19-4a16-b340-ba26197f4cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586927, "uuid": "db0129a9-5636-4750-b7a6-e8f1bebd1721", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c46e04d-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578474, "uuid": "4ee679e9-fcd7-49be-8bb7-0ad0834cfffc", "comment": "Malware payload (Mirai)", "value": "ecc9653ec6db6fd135589892b9eb6694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578474, "uuid": "c3b2a546-c5f9-413d-a0c9-40fef2377923", "comment": "Malware payload (Mirai)", "value": "b3a7617e995aa20f9801b0cda343f7e00d8600df97f9302f5b1ae23c7a8292ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578474, "uuid": "3d79671c-5682-417e-bf30-26e8ed87288d", "comment": "Malware payload (Mirai)", "value": "f859fd74716c149fef2195753b7dd66f7f80e7fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578474, "uuid": "273a6b06-6a44-4a31-a0a9-c99520128c16", "comment": "Malware payload (Mirai)", "value": "1f4a9a9ccbb6c84279cc5a9b4e94962dfe67b52e34c9ea02b0de20f913c481e41cea0d11ed0668bbbd19977fcf7be9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578474, "uuid": "32e73ec9-0848-4187-9518-3b3d4bb400e7", "value": "T1C5F2E134C1994FE2EE9E8FB026D153DA7FEC1B4B17228CB37142CF919701406999EAE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578474, "uuid": "560f377a-eaec-46bf-aaad-cae7168036b9", "value": "768:teDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2NJ/STE4uVcqgw099:tCRocD0Lu/PWUWr/iuMJB4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578474, "uuid": "8d0aff74-13ad-4c12-bb04-faf98086b2e8", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578474, "uuid": "1af2ab19-55b0-4d4b-a229-98751a8ba493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578474, "uuid": "df33b3a2-8b30-46e7-af88-eccb6d1b3fc3", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372fab70-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607268, "uuid": "96b8993b-5351-4f5e-8ed9-df02ffc2ff13", "comment": "Malware payload (WeedHack)", "value": "eefca4fd3e78f14d4feb6e2468d9e74a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607268, "uuid": "116834d6-9ff8-4010-b1d0-8e922d4a96b6", "comment": "Malware payload (WeedHack)", "value": "b3f81286ad7d4250002e5b70dae0b0a8f1533f13fbebd9e3a77fa8a1f0372d18", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607268, "uuid": "9886be21-4826-41c9-890a-af7cde3c4129", "comment": "Malware payload (WeedHack)", "value": "6952d3385924ec1476c84f8a82c09d259513ec42", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607268, "uuid": "60b88d08-8f70-4340-bfba-27c62c4c2a5a", "comment": "Malware payload (WeedHack)", "value": "eb016f8065bc87f3a71c045108ec6308a531c772b40502de23f0e4a1eb385f1a8e8dd7f6f9eac5f305253ed897d531fa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607268, "uuid": "a50ef81c-cbd1-4877-b5b0-d53503306ae0", "value": "T1D185DF12F8AF2878D8439F30D6854931157935D5DB0B20977BFA8B0F681AAC4B34D7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607268, "uuid": "bbffa216-186e-4337-b087-255cc4f521fd", "value": "24576:wJflrlbxo6l++DhAE3c7E8rcnkqu+EBFVEWD+89403xxqG/EIFKWOBVJSzH8Ovwo:wJf5Zmi53fGcsnaR8BSUpeUcOv2cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607268, "uuid": "a3e0f484-7a95-4cd3-a4bd-a22057fa6d91", "value": 1838752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607268, "uuid": "6209f9ca-1965-40f6-9253-8ff72cfb8fb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607268, "uuid": "a14289cc-9e58-4429-bb62-eb1eb367adf3", "value": "ChorusApiMain.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6575909-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776631131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631131, "uuid": "15bd8233-7fad-4ab0-b98b-eaa3124df5a4", "comment": "Malware payload", "value": "0206923fa3d5fe91fcf7ead13b5f2a6e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631131, "uuid": "ae1a938e-ef83-4055-bcd6-044eb0746555", "comment": "Malware payload", "value": "b414841a635b29135309aa9ea17bd2719ee35f3d9a78723f726b4ab7e67c87f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631131, "uuid": "5fc39cd4-b46b-4464-9cbb-7cc0daeefe20", "comment": "Malware payload", "value": "a9b90b9aa1390639c5d5c86cebd43f118b008d84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631131, "uuid": "58d6465d-da8e-4c91-ac13-8c2a979da3a6", "comment": "Malware payload", "value": "031bf08a61a4310e4368fee39a83006d488bce521d4f85f0473d2dcc52d1b6b9a102571ab9fc9a962acdc924319b93c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631131, "uuid": "465156cc-b44a-42d9-b78f-8880f67db6cc", "value": "T1025190CD63E04375B945B90BBBB989D07D4A50A5E6C10E2170E8BDB694CDE08BA0B1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631131, "uuid": "f9e374fb-c9dc-445b-9faf-907b9b8f95fd", "value": "48:UAeYALCUApsYAVUCAtM6zJAiaAcEArrAuf9YAtZA/RAj1:UAeYAmUApsYAVUCAtM6tAiaAcEArrAu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631131, "uuid": "9517e20d-947a-4f8a-804f-e9b258041766", "value": 2727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631131, "uuid": "280721f6-73b3-4d92-8cad-f1f8f2f35849", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631131, "uuid": "3a1211aa-6b22-4d90-9acd-a330610b9656", "value": "penis.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a166c5-3bd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776592817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592817, "uuid": "09b08208-4ef0-4d13-8891-3bdf20f909a0", "comment": "Malware payload", "value": "e8ab4f917afec451d847283fb245dedb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592817, "uuid": "24f552c1-727c-436d-a0e1-241bc31928a0", "comment": "Malware payload", "value": "b531ee0e453c6a514daa09a4e7d6e8fae8f433269afba59035d84e68a5ff42a2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592817, "uuid": "7d494d38-26bd-4976-b20d-48093ab9fab8", "comment": "Malware payload", "value": "adba96865f489f7deab9c2be2d45db31a08f9851", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776592817, "uuid": "43941631-051d-4c20-9942-1e82002dd49f", "comment": "Malware payload", "value": "bb825a991b740d4d2c09f54f23aa805f21282a3759b0ae01514e6a688c5c90afa04b1710a92971f303a31a8ae823783a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592817, "uuid": "3c5afc21-bcec-4d30-b00f-0bf3b95e2a8b", "value": "T1A3E56B137296C136F56E4573DA68DB2A107A3F651F7444EBE7D8FA6A0AF14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592817, "uuid": "e389327a-a495-4a36-87ba-ee16cde1e004", "value": "49152:8ZLYF9MftgkKATVqVZ9Rw4YP/BD/vTCPduTRUhfwEgB6zDojOwfFlgpqLOSGRJv5:KYX5A5qVPdWBqwcpqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776592817, "uuid": "c78afb71-81eb-440f-b768-8b33f490257f", "value": 3217408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776592817, "uuid": "3507f0cf-fe0f-4860-aa97-cdf2e69c3b69", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776592817, "uuid": "32358372-6e56-4da6-aad5-c539bf3c86ee", "value": "install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568cf279-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642540, "uuid": "db4cf988-0096-444b-8431-734120740792", "comment": "Malware payload", "value": "4d9e27eca0737d427535ec0c063fc01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642540, "uuid": "b6042bc4-5a5f-4f1c-83b3-aea086f663cc", "comment": "Malware payload", "value": "b55d7dd16e5664e130fcf0eaa890673ca0be2d39dd53e779ef2fff49b8b5f47e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642540, "uuid": "78dde431-52db-4837-96f4-474e9fc04513", "comment": "Malware payload", "value": "4329655fea699eeaaeffabedb49c929733494f10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642540, "uuid": "904f39d4-cad3-47ba-8a06-94da376de6a5", "comment": "Malware payload", "value": "caadbe72945387381399c6e472cb4371d50e67fb6eae6d9fe9e88128eacc73a64a27ecb6207023faa8aa0f73f525d57e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642540, "uuid": "5e8f3c95-fa28-46e3-b98f-7aabd830c321", "value": "T17D8312BAC5665003F71C06307774709E9DFCBBECA8F72AF12A0C4A2645938851CBAD72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642540, "uuid": "4b537452-a461-4384-9b58-5b739b8cce76", "value": "1536:5AwqHB9W5iDBvN4ooLzyY/ojPlmToZSwuD3q662hsk33cjAdxJMu8b:8H6OBezyxDl+olQ5622k3kUxhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642540, "uuid": "671fe803-328d-4433-9eb3-a97b66418f1c", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642540, "uuid": "6cd73b75-0f2b-4862-9610-cdcf6e101f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642540, "uuid": "6345eca6-15d9-483d-a7b3-d07f61cf9c20", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dd360-3be8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776600727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600727, "uuid": "98867540-19fa-41af-a57a-919bac70e64b", "comment": "Malware payload (Mirai)", "value": "953875614fec2a7b7b308ada235fd391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600727, "uuid": "c0d66fad-85d6-49cf-9f68-222cf614b838", "comment": "Malware payload (Mirai)", "value": "b646fab71b5e93ccd80b61786fd193086be21158ef8e25f8ff76468db55cdbd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600727, "uuid": "4efc7939-a943-463d-8e5f-13f4e345a4d7", "comment": "Malware payload (Mirai)", "value": "f20d8dadd5ba34c63377ea24b5d0e51a79aeda84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600727, "uuid": "ae453f41-f18d-4180-8ba6-de3981a19b2f", "comment": "Malware payload (Mirai)", "value": "c36fe9fcc0bdc25f2bd1d5705df2a1447708913513529bca5d46fb61460ef64d6075c063a6194e35cf9b058c41a2cd2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600727, "uuid": "56868eee-645e-4cb0-944d-134283089c9a", "value": "T16CB2E16C50940E09D85B40FF9ABE05E6E66184834AFFCBD99F270CC3E2B74A2791C614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600727, "uuid": "44b8afa1-6ec1-41d9-b530-43ca5f8b2d71", "value": "384:MniiBi3f2PSrf64K5WFSlvNjJ6mAN8bhmglJbN2EIKHT0P6+PbhDYOK6sNrUeCVn:xiBiv2PSbePxNNw8dtlJwEIGT0P1PbhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776600727, "uuid": "1e18a046-01f2-4ddf-8203-83d6a148bd78", "value": 23440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776600727, "uuid": "dcfaa816-728d-40e4-9a69-07e5c16d6e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600727, "uuid": "9762d4bf-07a0-4fc5-948a-139d6f1f1ac1", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ee076-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598927, "uuid": "2e552ec2-11a2-4fa6-a1e5-9c1dcbdf0052", "comment": "Malware payload (Mirai)", "value": "a036b86af2539bcbed700f886c2d14da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598927, "uuid": "1fce7fd2-e9a1-4301-be45-6776db443148", "comment": "Malware payload (Mirai)", "value": "b68e24a063ebec3653680e9cbac7b5c043fd18c96b0df3affeefec21e504bd77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598927, "uuid": "3f41272d-d38a-49a3-803c-2a2e6b1eb3bf", "comment": "Malware payload (Mirai)", "value": "af5cf2093304d45c7341eada32a1fcf52ebf571f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598927, "uuid": "351e7c12-23b8-4d92-b8f9-2a4dccc32ef2", "comment": "Malware payload (Mirai)", "value": "3c359e36d21b8e5318bd630fe1986eb0119812bad702d1e89980c75f76ab097370caafe3fd5d41352eb9e98faf1756da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598927, "uuid": "e988ffb1-612e-4394-bbac-574582f30497", "value": "T16B233BD9B801AD7CF95FEABE8016490DF621335051930B2B63B7FD936C321A4AE63D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598927, "uuid": "77668214-e4c9-495e-b1cd-468275316862", "value": "768:yLeD1MYbZs5paE+IXEM110+fmdbuzWenXpIWxJTBE2Lc85t:GAaY+5peFu1hmdCzp5IWxJ1E2w8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598927, "uuid": "33e54931-20fd-4031-b0b8-70eaf0cee026", "value": 49804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598927, "uuid": "1b8be273-ea1a-4a4e-8f7a-5ed832b39be1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598927, "uuid": "3c8af573-4d58-4ce6-9530-19c286dc3d16", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dabfb9d-3bd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776591388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591388, "uuid": "735f1e09-2931-4656-9c6e-62e8cac7a551", "comment": "Malware payload (Mirai)", "value": "ecfff116ddd6f7e93ec2de7cf446bf2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591388, "uuid": "ae15a82e-e492-4e4e-903d-f16d100b0429", "comment": "Malware payload (Mirai)", "value": "b7f55465f7f5400953d0f07a051f614d12740f0efc5c3b14d3a4369620a96db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591388, "uuid": "bd808ad6-1736-475c-8ed3-de5bc90c6f72", "comment": "Malware payload (Mirai)", "value": "17584df3028a7ac6a80001fcaf85336c8b32c8eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591388, "uuid": "b19768f8-08b0-4576-aa34-e950343276f5", "comment": "Malware payload (Mirai)", "value": "c4a82b2fdd7b1b4ca5af1d215b4ae63dc0d2bee3151916178b23048f4ff9d3f6a1986bb6c34917178726b008af8eecb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591388, "uuid": "e5f952a6-9d88-4045-a966-ffe929b5ca8a", "value": "T1F3334C51B9919B02CAC25177FB1F4389771B139CE2EA7303DD29AF21778B86A0E3E541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591388, "uuid": "dbf5de09-1344-4c9c-b9bb-c3939df3cde5", "value": "768:PAv/qJl/GsMxhHQfMgulefg0wGdVIO7D91hCuAuUvDKMwDiWmVHXvDgxo2I:cqJcvHQfp0eFVIO7DPxo/weWmRXv12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776591388, "uuid": "39c7dc5e-9b97-4c9b-ba10-914a92def378", "value": 54672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776591388, "uuid": "564f4960-0ad0-4651-8537-a0a8a03f1810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591388, "uuid": "e23d533e-1f1d-4eb3-97ad-7b7b74a7e6e5", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82201433-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578618, "uuid": "d26c1b26-1fcb-4a9f-85e5-3839e03e6c1e", "comment": "Malware payload (Mirai)", "value": "ebab907f51bcca0c140b5de61a6ab231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578618, "uuid": "ed6a7821-331a-4961-8843-f1d81a89804a", "comment": "Malware payload (Mirai)", "value": "b7fff4cdedc2040d74950c3339ca62d126dbe164a78c9dcf5be2058806294a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578618, "uuid": "30289883-17b5-41c8-969b-f2619fa27503", "comment": "Malware payload (Mirai)", "value": "85d117bc074df3ef6aa981e1e4bec1b449ef4fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578618, "uuid": "4ec8dcb9-f1ba-43fc-bc39-73f48746201f", "comment": "Malware payload (Mirai)", "value": "b461d33b7e0b2e1edc579c389cff98382b64e0ade4937509ee6141f1fd7fb7743f41bbc50a689524bd3c8aacc65576a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578618, "uuid": "72bf50b0-4c32-469e-a207-d49946f3b677", "value": "T15AF33BC7F800CDBEF80AE73748530905B230BBA255825B376257797BED3A0991977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578618, "uuid": "d364ff49-8039-44cd-be2b-0f30b618f442", "value": "3072:ZV5yc/y1IcSWqyAl9ed9/1qVM9uBSAsgcVljbiNLHbDLci:ZV519yAfed9/1qVaursg3LHLci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578618, "uuid": "faec742e-7f0f-413b-825c-2002544e8626", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578618, "uuid": "1cfacf01-6642-4c43-ad3c-7d238e1fb675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578618, "uuid": "29e89171-901a-453d-ac5d-43ca3ab8e891", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2c07d3-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578398, "uuid": "e7cb49d2-6727-4f98-a063-0e3df326ecda", "comment": "Malware payload (Mirai)", "value": "a1072cf9568d9ae31f1c219e58fef939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578398, "uuid": "b8b45212-6937-4e6b-ad37-ca7a0a6f42df", "comment": "Malware payload (Mirai)", "value": "b808ec200ee3dbefdb9ee589cb2c4fcf8dc99a78110c6f2937ff9a60eaa9e803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578398, "uuid": "180273d9-df78-415e-9734-52012b1a2a3c", "comment": "Malware payload (Mirai)", "value": "473cea5122e5fa7c14543014540fedf37825192b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578398, "uuid": "657e028c-f05f-4d29-9a99-4633cb421f14", "comment": "Malware payload (Mirai)", "value": "d05172c1f52e088eb8bd03dcc9455d891ee285023edcb28f177dd45b430c2f2270f875ee22ec9f1d2eb967549afb1773", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578398, "uuid": "87cd962c-3749-44bf-94da-6b6ea39d0c0b", "value": "T17E24D709AF610FFBD86FDE3702E9070529CCA51722A43B767674C928F54A54F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578398, "uuid": "cc0a23fc-4908-4c98-99e0-4c121b510cb7", "value": "1536:1+R0OdVvVAqe0d9cziPJ1FnYzUD0Zzi3/aTBA2hjYTMB+ZOgxHlIhd0Cw5oBlvnA:4yOdlq4E+JIQ8jb+oJTlvTHZ3cDq43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578398, "uuid": "761a9eed-0f3d-4bfe-b47a-d08a59bd190e", "value": 228876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578398, "uuid": "36023bfc-bd2a-44d1-ac99-88270aad63fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578398, "uuid": "2637ad46-2f54-420e-8b30-43a8a44b2138", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf68275d-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631146, "uuid": "d7034514-3ca9-4271-af35-59240bb792a4", "comment": "Malware payload (Mirai)", "value": "5adbf9ec765a02324c3d7ac53be7b661", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631146, "uuid": "f1bc51ed-7d5e-4d7c-9e2a-bf9b1f499dff", "comment": "Malware payload (Mirai)", "value": "b83de41a4096346023ae98dbf944904fc99ed3e84d9f8741b323ab0de3f7225c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631146, "uuid": "37254ac4-35fc-4bbe-b619-d0637de0ab2e", "comment": "Malware payload (Mirai)", "value": "23ab333aa9f42439820e50e3e02c9f12c7e5212c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631146, "uuid": "09ee6373-ce67-4ba1-a311-2e61dacd245f", "comment": "Malware payload (Mirai)", "value": "e602620392bbbd7fbe49b19942b3dd1bb342c1d5d1a3fa4610d390e058357d0807526d3ed76595fd4df6d201c492cf10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631146, "uuid": "f121ea4e-2d87-4efd-b9c5-b977c97fe54e", "value": "T1C3F34B13A8699F97C186AFB562E34AB50753EC154F470FAAB13AEAF40643DCDF805360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631146, "uuid": "ee30b1f4-0553-4196-b0d3-6b7b5034805a", "value": "3072:ZWGLIxaWWT8g25oOG34Wlxf922yq8YuSmcQJ+qo2Qb2j4NPGBr:ZWGLIlE87uhlz22yqR/mcQJ+qo2Qb2jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631146, "uuid": "5add069e-2c61-41d8-a875-3343feef02a2", "value": 162343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631146, "uuid": "8d44a561-f7fb-4f64-8948-dc5e3c5b5d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631146, "uuid": "e37d4e7b-4eee-4262-8a5f-afc221f320c1", "value": "mynode.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a4df3b-3bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776574403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574403, "uuid": "cec0cbf7-408f-43bd-b847-55d9c34da8a6", "comment": "Malware payload (Mirai)", "value": "af751937459c0c14f020e633723a0d6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574403, "uuid": "af1aa0f7-c3a6-4932-9f3e-7995e905d8a2", "comment": "Malware payload (Mirai)", "value": "b927020d009eade59e1b679162f57995aaf54b96e5a0cc631d81f404091cc3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574403, "uuid": "7c619026-2b9f-4371-8c11-87cd24c266b9", "comment": "Malware payload (Mirai)", "value": "7d88b8bb07542f54136399a4ab411297dd487790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574403, "uuid": "e5bec095-0a27-448f-8920-7f02d29cae3c", "comment": "Malware payload (Mirai)", "value": "a02844c08b2d59c151786f64e42813ac29d516d4928a205f4a961ba38b3650086240ef3862b7bcfcea4527bd63119d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574403, "uuid": "8f3b0bf1-8089-41e7-bf01-2106ed7f6efd", "value": "T19734623A9958DA9BE53156BD53FA8F3ACA7E33D72341CD41BDDC903049A4A8F280BD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574403, "uuid": "4a1ddc1a-4fc2-4ef0-a004-5ffe551118a2", "value": "6144:5WJIGlPaN+wcqYuKSFLGQBb0dKWlAbizlR/V6tuJ34NI4/xSME3YdwUTp7Ty:W3Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776574403, "uuid": "5573d95f-19fc-46e9-8fc6-29904ae692de", "value": 232288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776574403, "uuid": "1ed9e469-5de4-4d2e-a7a0-f704631583f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574403, "uuid": "29b25538-c6b0-480e-90fc-42169f8448a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c013ab69-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598908, "uuid": "82a83b78-6831-417c-b6a9-7ab50e3c928f", "comment": "Malware payload (Mirai)", "value": "0ea6389bb7f95647bef865593c31382e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598908, "uuid": "c29a2595-3545-4412-92b6-e427f86e1efe", "comment": "Malware payload (Mirai)", "value": "bac09703a091d0456aa58b327ff2e8a3d8a0ad3f991809597f6e386c9e3ed673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598908, "uuid": "427656a5-a33c-4489-9958-db377e176478", "comment": "Malware payload (Mirai)", "value": "969763a450e9675fc07ca0185d70dd691f0d0fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598908, "uuid": "bea03a9a-efa4-460d-bd99-4baa9e32d810", "comment": "Malware payload (Mirai)", "value": "cc07bfbf09b452cf7eeea6e988c185828da8388528c817aaf61ec68d8bed540dae8ab656a2a2e9a86a35a260dcd28dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598908, "uuid": "501836b7-c091-4a33-8b4a-8d2f5d3229a9", "value": "T169232B42722C0A47D5A25AB0393F0BE093FFE99120F4B6892A1FD7468635F771586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598908, "uuid": "c8718bd1-b609-47a6-8484-f84942906de9", "value": "768:fWLJhV3pc1tbRC+3u7RsGVBCnfd0aC3E+n8Vdk/fEXIZyq:fIRpc1tbR5kDPAMcXkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598908, "uuid": "04034c9b-4311-45db-8501-9b48240241f8", "value": 47140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598908, "uuid": "aef44715-9f38-4720-8e2f-4d17e57cee6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598908, "uuid": "b17b19a6-925c-477c-874a-3e3faa4c86eb", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7becd743-3c1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776623705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623705, "uuid": "530300df-f7fc-44ac-84ef-74c7e4e75a42", "comment": "Malware payload", "value": "eaa7e41c39f23d12e50434173b8707f5", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623705, "uuid": "9cdfb437-c439-422e-a468-ac4dfc939597", "comment": "Malware payload", "value": "bafdc672d82b8e424129e2397895d792765f233827f26897189ca289b6c0d93f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623705, "uuid": "68365b5c-edbb-405f-980d-2b8a75e6abc2", "comment": "Malware payload", "value": "87dc4e5699a1c5ffef0025301a606ee5001cbdec", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776623705, "uuid": "1abbeea7-aad7-46fd-bbb0-9562222b2e13", "comment": "Malware payload", "value": "a1140f7a72c131300711676611b10c24809db0a6e0eafa16d44fc073aa4bbfcc3f734241c36bdc38ca9773f837d44315", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623705, "uuid": "622da0b5-089f-42f0-b7f9-7fae17dcc533", "value": "T14A65230A13E41467EE39A734DAF20063E53279F68F7586BF1AD9C0784BB29C15434FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623705, "uuid": "ac99e558-819d-4ba6-9b3b-784d1fafa908", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623705, "uuid": "7eb7d31a-8cd7-4700-88a8-cb32c25767a9", "value": "24576:LjRzyZYXlJaHrvoRcau1invFtHhnpifPj0hHW4BWO5pKOtunXhirK6OsuOk464Ge:LjfaHrvDYTwHjKWUBvjqgOTOk4iH91Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776623705, "uuid": "3cb7d3bb-c7f7-43a4-bdd8-188310e2357c", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776623705, "uuid": "fe9684b2-77ac-4129-ab4e-cb3346c4c9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776623705, "uuid": "e7ec7897-4f1c-4e69-a805-d109bae325a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d527fa8d-3c45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776640605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640605, "uuid": "96d7af0d-4dfd-40a3-abc4-7d3e2b69c1ad", "comment": "Malware payload", "value": "1d94bf873e743a2e751d5ed6d5a0ae11", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640605, "uuid": "7d8a0cd9-8f8e-4737-823b-908fdff1f4cc", "comment": "Malware payload", "value": "bb88de0cc3db45033978220a986b890247556a5500a458885c60e6b7ee643733", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640605, "uuid": "f62f7f50-1e48-4468-999e-ec43220d5875", "comment": "Malware payload", "value": "ef39dbca029832bdb9dcf6d5a6a9d54bb8bfccdf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640605, "uuid": "cabb09bb-ef21-4e2c-a71a-b7723715f764", "comment": "Malware payload", "value": "c41b3162dde474f2dafaccf71b9a6a29ff8259b5c6e0d04d7c170eacace5e0f44443f28b9a6b534fa392696062832931", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640605, "uuid": "a704e971-5182-4acb-8965-4b1c2afcb150", "value": "T17A137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C496DCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640605, "uuid": "02e4eb88-f450-48fb-8d76-afb803ccabee", "value": "768:by+99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:by+eco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776640605, "uuid": "441ffbc0-0508-43d7-a899-254f73280350", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776640605, "uuid": "d709927d-a8c5-49b9-bccb-a55963e71216", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640605, "uuid": "d3da4826-7dda-4dbe-bc01-9675fd41b87d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79fc1f8-3bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776601444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601444, "uuid": "293df4a5-cdd3-4045-9051-2697b27814ac", "comment": "Malware payload", "value": "8da12a71cd5bab5a037ef12830815a9f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601444, "uuid": "98d282eb-5cfd-439e-b52b-734b0b8c3c97", "comment": "Malware payload", "value": "bc2a50906c59fdb0e7109274e322d2f8225600b456935d256b45c554975628d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601444, "uuid": "ee6709c2-561e-4fca-86b4-36b0721e7c2a", "comment": "Malware payload", "value": "ab20fe80b5bbd8564b0c9957e61956b6130f2fff", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776601444, "uuid": "0be76dbc-489f-4bda-8b2a-b04eb806f709", "comment": "Malware payload", "value": "df5ec435bc00beb8da84eeb2c8bbc081d0d104a4db87c9cbe18edc5680c9b629f0468a0bee5b02192a8a84f1ae1748bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601444, "uuid": "d2b8196a-d589-4330-a890-d8042c27297c", "value": "T189A30230C5992B8DF5739AB4D52C3E6D4DB1E7A8DD1A49E30817A74129F1EA81B02C8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601444, "uuid": "ef074f7f-5f75-4680-a129-4d34e7a6beb9", "value": "3072:8A5qK3QkDEZPkzatSjb9qAwPm4uhIJBlDc+yjlGp:P13Qk5zoSFqAwPuhIJBEjlGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776601444, "uuid": "3949562e-e508-41d8-abbd-32fac4510306", "value": 103106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776601444, "uuid": "ef6acf2c-5df6-4e74-a355-5da45392fde5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776601444, "uuid": "31a37204-49fa-42c5-a9c9-80feb9dcff81", "value": "EXTERAMDM_Locker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12746bc9-3bb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776579289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579289, "uuid": "43f43ed9-d935-41e5-8656-e18035f5156e", "comment": "Malware payload", "value": "e488c1a600a06a982982fe8847eb00d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579289, "uuid": "6091cabc-5ffd-43c1-8b3e-65e09b90cc16", "comment": "Malware payload", "value": "bc45c43489528b463a3c0970aa59a9403f5b565ad8255fe2946acab1836b8ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579289, "uuid": "46811f3e-b755-4c35-8471-fc430649d6da", "comment": "Malware payload", "value": "70d5edc11ddce278f98a97f2bbedc78db6291180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776579289, "uuid": "e89c0700-eecc-41d7-b9fe-ac3107ba9825", "comment": "Malware payload", "value": "1124d6762ac0fa3ce372ade061b88bd92d663d742b5bf56a5935e48fb006d8812cb8a1a3e2b5159ee2cd817bdc10c99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579289, "uuid": "1a15882f-0095-4a30-a941-29c831c29ac6", "value": "T1FB0833161174C18ECAF6087D53915A22B7BCB16325EE2D1EF34C90B43EA3AE985416FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579289, "uuid": "98dbd1bf-ab38-4c03-9a06-2062840fcb89", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579289, "uuid": "cb054735-fc4e-4c90-8d27-857127450585", "value": "1572864:4t9IKPBLRWYlekfXFYQWwUrFJ7M05Etl/5r+viUr7:4UKJLRWfktYQWwUx+4shrciUr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776579289, "uuid": "49350bc0-d452-40ee-815f-1cd2bd690aee", "value": 77519580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776579289, "uuid": "aff3fba6-1cec-4c7e-ba80-2d609059887e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776579289, "uuid": "b7788000-8593-4ea6-b7fe-eed6eb0f43b9", "value": "TomodachiPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8229918-3c47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776641442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776641442, "uuid": "b37b3200-4dea-4ce6-b70a-7c4efe58a8c0", "comment": "Malware payload", "value": "12f130e0d612e5ed8d11c6843ed5aab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776641442, "uuid": "a1283521-ea33-461b-b6a6-5df393ff20c4", "comment": "Malware payload", "value": "bd968c72a082d26486ae6b26371f63ad7e61a304755537a0849233c1811ea94e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776641442, "uuid": "9445233e-0760-4b55-9f85-31c2bde23b59", "comment": "Malware payload", "value": "ea4548439b7c00200363387fb7ee7f79ac39201c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776641442, "uuid": "ae2c3b2a-9500-4517-b163-8c814143aa69", "comment": "Malware payload", "value": "26709ef3b4487e0692c75c2f8302931b1564dd1914f63af320a545ba9a85e4bc0f8fc1af5cf5207943a7bb9f0bd3a720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776641442, "uuid": "74b4bc0e-973e-4c87-92dc-410017118102", "value": "T140E5F857E49550E4C0FEE174C726A223BEB13499073437E36FA196B11B26FE4AABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776641442, "uuid": "cd6b052d-7f80-4a97-bf59-7e2b5ca0fc7a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776641442, "uuid": "10ce10b9-7a49-41a2-9828-78ed81169d07", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776641442, "uuid": "9e9356fa-1a4e-4a26-976a-08e13b2031c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776641442, "uuid": "9da6138f-414f-406e-9a32-298b4f26806d", "value": "bd968c72a082d26486ae6b26371f63ad7e61a304755537a0849233c1811ea94e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bed7ad-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586952, "uuid": "fde0bc3e-f8d5-4c04-b1b6-89fed0564e1a", "comment": "Malware payload (Mirai)", "value": "5ba06919d9eafbddb2280c00fb609736", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586952, "uuid": "1759f6f1-8d72-4828-9933-aa8cbcd3919d", "comment": "Malware payload (Mirai)", "value": "bf94921215d609b02f7f5b9713b05064690bf92f89a62ae49450a49e25413c1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586952, "uuid": "fd2aa252-173c-4bdb-b6d8-074df8a30dd3", "comment": "Malware payload (Mirai)", "value": "6974fefff02dbafa6002392afb9b5815777a96dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586952, "uuid": "49c45c05-0325-4ee3-b7f3-9a157858ae8e", "comment": "Malware payload (Mirai)", "value": "c57673856a72bacf66f6fa73e9f3852bd206c589af588e176386e0d44baa0e8516c410993409f1c5d3ef6cddcf7e7979", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586952, "uuid": "258f8f8e-5a20-4ade-9a1d-7799472a39d6", "value": "T1CF41F08E1F315EF9F555D93C87370B356BAA564883C14249E1ACD9402EC430DC9DE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586952, "uuid": "18b48cd0-94bb-4146-901a-17723a805ada", "value": "24:3OShMgJc8AmsCxj8Amyz/z2Hx7llPAYWB4u33gliI8pajDdz3N9l5zBkEp7iMpA6:+SegJNOw2HnuhgjD/9LuEpHnHsdOR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586952, "uuid": "bd74bf02-5bd8-4b8f-a8c2-d2d7939284ae", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586952, "uuid": "fa4dffbd-2946-429b-a23b-ce8df866df0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586952, "uuid": "621cb746-3374-4f14-8301-6dd70707a46c", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5fb52c-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578526, "uuid": "97089e3f-c6af-4751-a118-65c6013d6ff4", "comment": "Malware payload (Mirai)", "value": "474aa8e11ac96938ae5b3eef9739921f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578526, "uuid": "52ad4962-ec68-4800-a9a2-0b574adb51aa", "comment": "Malware payload (Mirai)", "value": "bf94d86b78fe5c95a302f6b3a640a04c46610dc9f47ffd812cd21f5a8eaf10bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578526, "uuid": "886d76fe-6084-4adf-b064-b4fd9381d2d9", "comment": "Malware payload (Mirai)", "value": "ae6a9a542c6b5f5110256eb6844dfb9660c8d5c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578526, "uuid": "4b0b6b14-6c84-4eb3-8f6b-d88a48241b79", "comment": "Malware payload (Mirai)", "value": "25dae1432cb27c65babeae440867494e200c2d3e305ecf953a833078f7bdf76d73b0cda8ae893ca1c5389a64032665a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578526, "uuid": "1b04c898-d802-446c-a4ab-f10185ad03ba", "value": "T1E5F2F1F08262861CE77C52BE44ED1A4D2C4848199D04D0B6EF847D331A16FA9FDB5BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578526, "uuid": "95f3279b-9a74-40e0-8a7c-19e61369e119", "value": "768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfHey1cZ+2nbcuyD7UHQRjZ:E4B1E+TcAYC9owuiOTO+2nouy8HyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578526, "uuid": "bc288fbe-100e-4059-a96a-5359e0136c08", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578526, "uuid": "74f5f428-87a2-4b60-8702-c4dfb7e8afb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578526, "uuid": "3f30735a-667c-4b9c-9c75-b1a62e1ed680", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd1c40-3bee-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776603099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603099, "uuid": "4284d03f-7bd8-45f3-b2d0-f162f560f4b5", "comment": "Malware payload (SalatStealer)", "value": "f78d63c2934e013bd36ba9918e0b9af1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603099, "uuid": "2b315c32-b34c-44d2-b0c0-32b9f0696245", "comment": "Malware payload (SalatStealer)", "value": "c0b819c99f9b81df1192f2e9ca22caf853d36c3d48c8ed11d75a87cc40df99cd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603099, "uuid": "a851fdd1-d5b6-4d00-9644-9776ae24426f", "comment": "Malware payload (SalatStealer)", "value": "2e5dd19ef37f059a3fbaf065ed73eac04b00aa6e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603099, "uuid": "22fcc588-9e44-476c-a0f1-5eddbd12d277", "comment": "Malware payload (SalatStealer)", "value": "58015c0924b630b19e9ad8e432f379c1e211d1e1a1c4cda7e5d351867a23e5926789177d80ac1df0d65d8fd2eb88d96c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603099, "uuid": "f93475ac-e389-4781-8be1-3977bb691850", "value": "T14A063310E4CA21039A3706AE867745F5DFF9DF48D34F2649BA1A49D35A0FA7C9239383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603099, "uuid": "b479c352-bfb1-4656-870f-db6ea06b7ba6", "value": "98304:LU0lm5h+QEv4EWqBt6HqtvUuayv6SYUYAlStXGsRSKFjuWIb8NV:tlBxWqBhtJvYIlStXGu0gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776603099, "uuid": "024a665e-23c3-4885-a122-554af1c66a8e", "value": 3779761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776603099, "uuid": "e9f17b7f-947f-46f6-8fe4-085528349bca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603099, "uuid": "c61b4aa7-27b4-4973-b5a5-84f00213330a", "value": "c0b819c99f9b81df1192f2e9ca22caf853d36c3d48c8ed11d75a87cc40df99cd.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcb52d2-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578372, "uuid": "353f3b53-4cd7-4d8a-b649-aafd15656ae4", "comment": "Malware payload (Mirai)", "value": "9de4d1e3e8a0fbe64b258628c466d5d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578372, "uuid": "22ad2f69-1572-404e-a2af-fadbd1f79fb0", "comment": "Malware payload (Mirai)", "value": "c11153eee227929754d0b126741bc29c7fa74feef1b817506aaa62b2c0ccb8a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578372, "uuid": "30406ef0-54e8-4abc-92c1-c3c32b9682c8", "comment": "Malware payload (Mirai)", "value": "66b9e3e39ba1754fdb2c3b92f320ccc4c24c8a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578372, "uuid": "ece9276c-273b-41b1-886b-46e4e4e344ce", "comment": "Malware payload (Mirai)", "value": "ddbccbf30bee7488301bb2f13390dadf505adf27690249e3690161b6827eb718315101f6ff7184690ec1c450b3b2abd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578372, "uuid": "5f0cbd2b-5dac-428f-b334-bc773f4a18cc", "value": "T135832A97F400EDBDF80AD77B4453090AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578372, "uuid": "bfa65d11-4b25-4c3b-8a04-afb5320bb083", "value": "1536:quKG91H46gWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GT3xYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578372, "uuid": "b58894aa-8a8b-4a1c-b4ae-195bd080104a", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578372, "uuid": "fee5e0ab-812e-4eda-bdfa-7fff00bea882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578372, "uuid": "fe8108a7-3448-4eca-8023-fffbf4b7bead", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f376f0e-3c0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776617133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617133, "uuid": "e79f5479-a14d-4eab-80c2-ddda8826b269", "comment": "Malware payload", "value": "d3d7fdd072e4fa998b9ec1fc17a18a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617133, "uuid": "698dbc18-b2b4-4fb0-898c-b44d0aa6b4bb", "comment": "Malware payload", "value": "c435fbae50cf874d25a1c47a6e2841f2f4f007e419f6dd1c1d619a888e1d4b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617133, "uuid": "bed3d681-54a1-4a2b-984b-395153957f11", "comment": "Malware payload", "value": "fedbbbe6fda04c39ee37d08213e2c3398f942e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776617133, "uuid": "0fa7026d-1c8b-4925-9d33-39a955fe332f", "comment": "Malware payload", "value": "1ba0ea624c5a8d75d3bc3cf80d32f3d73af02400c502eeac733bfef79a5510b102d8f62620e12e2f6f7e9c7a272f491a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617133, "uuid": "2cca00ca-b2b6-4e06-9992-66850a713b05", "value": "T18E835B0933E44E91E9FE0A7B0A7291154372E5925F13E78E8EE1589E2F733828D0D793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617133, "uuid": "9253e9c9-8b5d-4733-9d47-f825a8b412cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617133, "uuid": "8a37fbce-9439-4a7b-9c84-9731983e2fb1", "value": "1536:gJwsHslhVsETri9gF8CILbpL2rCufRGqTomkQXg82bet:gJwNToCILUrCufRGqTtkQXg82bet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776617133, "uuid": "696d0475-9466-46ec-bd0f-b44081027753", "value": 85604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776617133, "uuid": "25cddbd9-05ac-4f92-b9f5-6e25aa8d22dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776617133, "uuid": "a84e4751-c688-4d89-aa15-e9f2f5506cbe", "value": "lynk.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf13a11-3c0b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776615707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615707, "uuid": "4e4f7cc1-9775-4958-9e80-6e27fe3ae71b", "comment": "Malware payload", "value": "bbc6ab6abf90f8c1b4353d2b670e91a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615707, "uuid": "99b07aa0-885e-4839-adae-8e6307fc796c", "comment": "Malware payload", "value": "c539257cbd8d6c2155691a1534f06cf741e4582761240e70978dee2e6bbaaf69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615707, "uuid": "142dcc35-fa32-4005-a07d-741e174af975", "comment": "Malware payload", "value": "6e52110e4109d89e973273fb4086ee6a03b0c847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776615707, "uuid": "3fa90537-0171-4b30-8255-1c1ae2beca54", "comment": "Malware payload", "value": "a8d40a6500974aaa7dc23d7e9a6d5d4e170ea07bcc1a668c8353e486c9a6f3f5631e3558e75ca059834e3742f75b3186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615707, "uuid": "942c1e6c-bd4b-455d-b2ea-f6a8a041ba8f", "value": "T1C3266C32F24AC52BD57606F01A2CA9AA921D5E390B7148DB72DC7D6B1BB44C31236F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615707, "uuid": "d685bc35-a8ba-4d9c-b62c-72b516fae0a8", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615707, "uuid": "232a7387-f614-4125-8d5b-e6cfffee6dfd", "value": "98304:PQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJ0xFu5g5IXAX:PQN5tgqSsl/oL+Tqv146w9DbtE/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776615707, "uuid": "48c209d2-f3f4-4204-ad24-dac083dd0dc1", "value": 4685710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776615707, "uuid": "fa03d2d7-1499-46f5-9394-50fdeef1ea69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776615707, "uuid": "bd972693-bb7d-4dc6-8471-344114ad8dde", "value": "ELFxNINJA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823cd17b-3c04-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776612548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776612548, "uuid": "74c3fbbe-b3a6-4ce5-8fcb-99a088ed92a7", "comment": "Malware payload (ValleyRAT)", "value": "e4613d46e0e73302c8471a4a0b8d1941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776612548, "uuid": "f64ba9f4-f6f5-46e4-87ef-f24d94e1ec56", "comment": "Malware payload (ValleyRAT)", "value": "c738c5f6aa0c66df3b114e87c18f4c0c5c507290b7bb87c4ed0d30a83e2c9b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776612548, "uuid": "db9353b4-d61b-4317-b37c-7d59d9cd6fbf", "comment": "Malware payload (ValleyRAT)", "value": "8f962e9e398106c1e1d4ccceadee7c2ce6863dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776612548, "uuid": "e1207bd7-e5df-490c-9d83-a7a956c5d603", "comment": "Malware payload (ValleyRAT)", "value": "9345c246718af35631e5b098eefdab1eecae45ce6ff3b8bf4f792105b71798319f5cb573191db176f989ae925ce8df7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776612548, "uuid": "10aabf05-1cd6-4db8-8d84-17fac357d99a", "value": "T1021522C01A659422DF8B13F411AFCB7A99A6DC5924F4498F8FC43F67B8733C60A29592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776612548, "uuid": "4c688969-fdb1-4242-af8d-791fcd531e52", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776612548, "uuid": "7f8dbe80-40c3-42b7-979b-e36fb03252a7", "value": "12288:Fe68Tw3E/U5gZgpRdtIpdZyPbtYndkRD37gR3kOQQ68:Fe6Pg2Tcr0btYd+37gR0LQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776612548, "uuid": "1bed2078-56fe-4e08-985f-b56aa553da58", "value": 930042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776612548, "uuid": "ab83e6e0-60a6-4a83-b7af-d6f6e3e9acbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776612548, "uuid": "d0b76539-ba27-4893-8a13-6c1a9dff1ab0", "value": "\u5df4\u897f\u732a\u8d22\u52a1\u88ab\u9a97380\u4e07U\u8fc7\u7a0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709a1969-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607365, "uuid": "0e69c245-4b5e-4f32-84c7-ee3a28b48e6e", "comment": "Malware payload (WeedHack)", "value": "770ded59fc8ff3cea6281b179f3546d9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607365, "uuid": "c84008f5-d73c-4c38-b4fb-92db1f0b9181", "comment": "Malware payload (WeedHack)", "value": "c75dcc48b8280f6a1cb6251f1ab8cc4b4db6bac2b9f8d416a0f784200bcb25d1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607365, "uuid": "dc9ee4b0-d651-421b-8725-416f31abb63d", "comment": "Malware payload (WeedHack)", "value": "4e4f18e46549b0f8a0b1384a86973feed92679ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607365, "uuid": "dc9759ee-da81-4f3e-80b0-b52d39dd67c9", "comment": "Malware payload (WeedHack)", "value": "73b35f9de324a70226596dbbedd6fcfb580da48620eda0f40dedb6ec7fd2bb956afc9af7c5bcc52a42cfc5f696a5d072", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607365, "uuid": "4ce2b7db-510a-4d34-974a-28ec9d439b96", "value": "T155A41263F16B0D35DDABC933F5422AF2FC6C544C91463A2924A5B60BC82B4E3A39535F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607365, "uuid": "e916433b-0e85-47cc-a994-488c92302a5c", "value": "12288:zBCw1W8TYm+QIOXhnRXHXKeNJ2W0o0Ytyzgn:z8ViY1SnHamJl0YIzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607365, "uuid": "71915d17-6d51-4e33-bda2-b4d2aea492aa", "value": 480749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607365, "uuid": "28edda03-b1c2-4649-b85d-5be59b3ad714", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607365, "uuid": "b8370afa-bd9a-426c-ace4-72de222af508", "value": "opsec-1.21.2-1.21.5v1.0.9.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c882d8-3c22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776625498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776625498, "uuid": "17af9870-1b2c-4e6a-9547-8bea82718c2a", "comment": "Malware payload", "value": "7fc4318a93232c9eb12397d9a39cf006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776625498, "uuid": "ee9780fd-8eff-4c2f-a83f-cfbb487c5d58", "comment": "Malware payload", "value": "c7d9dfefd8fb88de926e9384a80685ae761037e174771b668d505d5b647899c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776625498, "uuid": "5fe392b6-7969-40ca-aa7d-1b2b97280f81", "comment": "Malware payload", "value": "c920594848e7c7ecaf3b237609ba16da41204648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776625498, "uuid": "9bebb06f-4c7d-4b03-aa9a-e3f754d90766", "comment": "Malware payload", "value": "e1c129fb4156cb81ed56378448cb13dfe325b35eceb4fac85e68a38197ab3531d456360afcda4fa5aaced05b9595d7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776625498, "uuid": "1bc65a26-0f81-435a-850d-8f816d899cec", "value": "T1F9267C32768AC52AD43A05B01A2CE9AB862D6E360B7144E772DCBD2B57744C31737F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776625498, "uuid": "d4c44a1b-d7a7-4e8b-aefe-8e1c46f3471a", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776625498, "uuid": "0ac924ae-373e-48e7-916c-f5543dfc9979", "value": "98304:2QN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJtfXAd:2QN5tgqSsl/oL+Tqv146w9Dbea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776625498, "uuid": "d633a917-1f49-42d3-bf5a-2576e2f76476", "value": 4685668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776625498, "uuid": "a04bf4d7-09d3-4969-bd84-bc4b510393ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776625498, "uuid": "181123f1-4df2-4488-b433-06cfd2de7dc6", "value": "Fallen Angels.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f83fbfd-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578613, "uuid": "e02ce6fe-36da-40b1-a2c9-89d321a673be", "comment": "Malware payload (Mirai)", "value": "0bdab98f7cf4b464560ea668ea3867d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578613, "uuid": "32257936-0d5e-4b05-9ec0-8db8cd987f0d", "comment": "Malware payload (Mirai)", "value": "c9e6e65cb7515078937776e6a1ca06f46658d61f9711e95377142a316123368f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578613, "uuid": "f69b4e3c-f0b2-45fd-be2e-4d55dc590ac3", "comment": "Malware payload (Mirai)", "value": "84590debf267d081faf5c4485dffa0fb7f60f2b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578613, "uuid": "2a8bc9a6-69ab-4f42-b6c0-474839671612", "comment": "Malware payload (Mirai)", "value": "65e74bbf3e73487ed57f70a79cf1f993cfb1999b7522fb178723864fa40bf12e7801a9b9bcb7e15824dae9410ba86461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578613, "uuid": "af233f9e-5469-41ee-9c6f-435d90bb4ef5", "value": "T1F3D31A41F9404A27C6D612BBFB5E42CC772A17A9D2EF72039D215F21378786B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578613, "uuid": "c9937b34-5e29-4cf5-8ac5-bf0676d3bb51", "value": "1536:8+rPxAWgV+8JqvU5ZlVq8KApeLIK4Vv6t9T5KEizD7dmOHyISjBtEu27gWlv9wya:RrP5Ns/lU8K3/4kDEEizHi/jK1Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578613, "uuid": "def10cbb-f030-4d98-bc7f-17f1b2c7d90e", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578613, "uuid": "e423741f-3993-4aca-9e89-7e67dfcba34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578613, "uuid": "2abb6d94-21a3-4c6a-a976-c5521ba26bf5", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92de147-3bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776574442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574442, "uuid": "5e186654-3e12-4e2c-ac9c-82181c400289", "comment": "Malware payload (Mirai)", "value": "798f8340dab65410f3caf397bdffd7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574442, "uuid": "f2aa47d0-2d80-4c3e-8db8-0d9833ae53dd", "comment": "Malware payload (Mirai)", "value": "ca8eb07779893526758e8004e3489207a825c094bf642d0cf8c4b31585f066bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574442, "uuid": "5c89dd71-40f2-496e-a7c1-7bb6726ba7a0", "comment": "Malware payload (Mirai)", "value": "924b707466fa196be08ebb125c787e353267d6ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776574442, "uuid": "cb929c8f-72e4-45ce-8aeb-4f54415a4d58", "comment": "Malware payload (Mirai)", "value": "756551bbfd5e34e733a46fbc28815469006f4aa862f917e0b230bf7033a6c534efc741b63cfd1f3ddc5907a336233554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574442, "uuid": "cd151bf0-2329-4990-a05c-9c1d8f4c385f", "value": "T197245171D48CD983C563217DA5EC9FAFAA3E73EA6789DD027C9465304AC6E9B1C0BC40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574442, "uuid": "6ddbb409-4e15-452a-b735-075e60b5e0a4", "value": "3072:MusF0MgMOo9q/Nkaw45MvgFG6dCZTlH74:MusFuMOdka55MECZTp74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776574442, "uuid": "75b97a1e-1a95-408f-8199-b4ecb9ca951b", "value": 215116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776574442, "uuid": "eb3091be-5968-4a5e-8213-98a1620bcb09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776574442, "uuid": "fe649bf6-2e15-4452-b844-faa8e8f06bed", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06886227-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578410, "uuid": "bd47e71b-ceed-4090-b7a0-4c0c3b1fabd5", "comment": "Malware payload (Mirai)", "value": "100aa8fc7900757b992818584ed3b542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578410, "uuid": "3028fc3a-6c37-41a6-8960-5166df41a5bc", "comment": "Malware payload (Mirai)", "value": "cae854a2e6b41ff1c6ccf74dec41fdf54690eadeeee751b95f09aa38cf09d6a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578410, "uuid": "13f7b198-1322-49ae-98af-04a3853230d0", "comment": "Malware payload (Mirai)", "value": "74298bc5bf885f5241c776b074627d85381d3aee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578410, "uuid": "8f95c2dc-3ad1-4d6d-8b1d-7169924cef9d", "comment": "Malware payload (Mirai)", "value": "89d1bd2b28ec1cad150dfbc85ae8e314e09db5459f90f3ba8dabd586422ed171815b2863b58c6c009faa9258f847d540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578410, "uuid": "71ca4b32-4c28-4d61-87ab-c6a414d2266d", "value": "T113F2E034C5FDE9BCC03F79790C9D8A45F982F9512AA53726042962BAAFFB9C43D016C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578410, "uuid": "f385ce59-c3ac-4c08-9706-243701207c95", "value": "768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTK49AbzPwUx0nZl:rOX80VqVi2otGtzXsWdMZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578410, "uuid": "ece4f153-378d-4b6e-b2ad-6bf578012762", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578410, "uuid": "eaa486f9-003a-447e-a69b-68261d565ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578410, "uuid": "16446e36-d030-4ed5-a556-10c1d50fa05f", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe12a04-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631140, "uuid": "4f55c5df-ae30-4915-bf2c-c90e30117d08", "comment": "Malware payload (Mirai)", "value": "feb8e85b4d870a5a7f81388c1046b426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631140, "uuid": "aa692f7b-4956-4bb9-b6f9-d35b1c1c7ecc", "comment": "Malware payload (Mirai)", "value": "cb0be0b6fc1043e14124b9903e9b43061f034e79a57f0c928438e4a164cf2a33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631140, "uuid": "31f8f426-51a2-4eca-8764-6b8269ffcab5", "comment": "Malware payload (Mirai)", "value": "715c3aaae25b574231c0194416d9c93f1cd6cfba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631140, "uuid": "d9c2c1a6-efed-4f08-a05b-4fdfa7c0912c", "comment": "Malware payload (Mirai)", "value": "6632ab67d1079ea8b5106e5ea6c756b40082af773867845e1043c256e15099784e7d498b3a905468c2a2e014122f5f6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631140, "uuid": "a7c15023-d1a5-4dfe-bab3-746cd53c36ec", "value": "T1C234D71A3A21DFBFF56C863047F38A3046D576962AE19746F25CD71C1F2028E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631140, "uuid": "455095b5-408b-438c-b26e-b248a34f13ab", "value": "6144:QF1ftX7UsAAMfXUfHnxmP+NC6/DndnVLV9cMA:QXftX7zAqxmP+NC6/DndnVLV9cMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631140, "uuid": "7e19e2da-750b-4333-af42-877e616e8912", "value": 238476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631140, "uuid": "4072d4b5-4ec4-4b60-96f8-5dc7e88d93cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631140, "uuid": "3bf757ac-782f-4bbf-b7e8-5a616ae7d6b6", "value": "mynode.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd73a702-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586932, "uuid": "e8bbff4f-1d9c-478b-833d-e8a2d20bd5ab", "comment": "Malware payload (Mirai)", "value": "c8e4d7476a8427f170117b4ec409aac9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586932, "uuid": "962ca102-c617-4772-b8c3-2393de4f9bea", "comment": "Malware payload (Mirai)", "value": "cb4ab52e79aa300d9128910bf9865f07ff1626dda3a7da2d1339f7e6d7774712", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586932, "uuid": "d71b47cb-cde8-467a-aa18-bb56ec9c0a05", "comment": "Malware payload (Mirai)", "value": "431ec29260a4d2b5cba87d9ed5556a69fd76a689", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586932, "uuid": "51b5e920-e8d1-4879-b57a-874b5c9fb306", "comment": "Malware payload (Mirai)", "value": "1edec209fadaa8ec5b7550313978ea600481498a0b77555dd8406bbaf78475cecdb89e600aa712c52a4f25be1d1af7f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586932, "uuid": "8037ab31-0ef4-4c7f-b9fa-19f6760f1031", "value": "T100510E560BE60E2BCCE2023B99A76794AB16FD434095FBA7E31454850D3F38ABF32158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586932, "uuid": "93022ebd-984d-4110-bacf-7c0a95b28728", "value": "24:JZ+GgP9qD0at6EoWGorUlFSs0VzLCkIdhUg0RGIGQFmFmFmFUNoam1pzb4PLYql:JkPFqDPtRrkFSsCzL8IHUUUGNk1pvWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586932, "uuid": "46e7eda9-3709-41da-b13d-ffab79580e60", "value": 2677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586932, "uuid": "71dd25c0-baf4-4b7d-9a50-f9fa79ef52f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586932, "uuid": "954ae613-4eae-4110-a1ed-3e7b7bfe39a9", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d08849-3bf0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776604125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776604125, "uuid": "d9475234-915e-41e2-b012-d810762deeec", "comment": "Malware payload (Vidar)", "value": "0b93805b6b931b8f5bc7e423574a1844", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776604125, "uuid": "fba837c7-d644-4e87-b428-0950b0d76e01", "comment": "Malware payload (Vidar)", "value": "ccb8ef19076d6d95c1582a4a0d7475c891f186be42c2e6226fc7906c27794522", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776604125, "uuid": "55da1838-9d10-414b-9bd1-3e5efaf05afe", "comment": "Malware payload (Vidar)", "value": "a28509958dfaa09630869e630bdde779dd4a708a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776604125, "uuid": "2cc6c80d-9dbc-45bd-bae6-73e9786d6645", "comment": "Malware payload (Vidar)", "value": "fe5167964b77451dcb1c1f8eb3cb8b5446d69187f31ebbc705b37c596e2a38a71b0507c5de08bb5dd435b27a2e426e68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776604125, "uuid": "048702e8-1a83-4830-9b54-df0bc60c91b3", "value": "T170B58C0BBCD514E6C46A97728DB722927B70FC090B3223D71E50BAB92EB2BE05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776604125, "uuid": "3430345b-114b-4286-ace1-245612f99c1c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776604125, "uuid": "c01c46df-ffb6-4b54-b8dd-f38b2964eb74", "value": "24576:E39HBQ4gCbXsW3LpHODpS9cee7SF8mpEoPog/sDucNWwzZJo96bEOtPMMDEeNb5C:E39hQ4gCbXsW3s9S9gZmr/g1sAZ/EGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776604125, "uuid": "966fd25e-c8d6-4191-a1c2-255b87deaef5", "value": 2373296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776604125, "uuid": "869b2d05-3490-4d9a-a70a-a444ed1031db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776604125, "uuid": "103b866c-f94f-4ae3-98da-d2ea6c886319", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a6c14-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607376, "uuid": "fa7d077d-764a-4e6f-9ea4-720ea19df06f", "comment": "Malware payload (WeedHack)", "value": "883144108c57e178643b11aea7ef3535", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607376, "uuid": "714a22fb-f8c1-430f-b36f-348ed50104c7", "comment": "Malware payload (WeedHack)", "value": "cccf25229c49ee8f1f336b2268046be37eb28ecc58bd2ee5710ef122f14b8fe6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607376, "uuid": "747294c4-e489-4791-9bff-96b0500588de", "comment": "Malware payload (WeedHack)", "value": "92eb13ea36c2db81260d5df6ffdc04fb6bbc17df", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607376, "uuid": "edbe4642-6a39-4c95-95bd-bcb78cac928c", "comment": "Malware payload (WeedHack)", "value": "b02020884bc3dc84d2e60b49b1c007a546f283eadf744ce2f1f30f7ec85495b2a55cbba871b925f0cea4766d01888f07", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607376, "uuid": "a0bb549b-660a-463d-8281-725fac44ff7c", "value": "T110E4C787F1208AC7F44FDA7F14504210AEF0E4704607F2562B6E895A6FEB9C89F653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607376, "uuid": "fbe13a24-c7f8-41e6-ad96-a12be8a84711", "value": "6144:K1eMX5Uh/W94gpr2TUPjhMoMan/9C9pe+cemlKvBWN4mUvowOx/1Lp3x1ZfU:K9PBefWFt/1R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607376, "uuid": "3940d710-16c5-43ba-8f7a-48629c9e8cbf", "value": 702321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607376, "uuid": "23d08dc7-1e9b-4a38-8c9f-6df6d51788a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607376, "uuid": "12b92941-eb0b-4482-a7e6-e6c0e5b2e812", "value": "paper rig mod (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd7a0dc-3c45-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776640270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640270, "uuid": "f64b2f3d-efce-4c4a-a2ee-bce80a41ca32", "comment": "Malware payload (Mirai)", "value": "6eb2ea3c63157d71487b4dc8080b2b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640270, "uuid": "ea52b1d7-2fb0-4bd3-bfd8-3d76fcd7860e", "comment": "Malware payload (Mirai)", "value": "cd2a530bf8f370790993dcd5af9a289abbc4dfedd05b89e72abc29eebd6e094c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640270, "uuid": "844de958-e1e6-4f2e-9cc6-a6a0bb71080c", "comment": "Malware payload (Mirai)", "value": "c95f60cd402203737d57c34cae983d1824fcac56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776640270, "uuid": "6e2a217d-83ef-40cf-a8c7-3c1711cc4375", "comment": "Malware payload (Mirai)", "value": "d84b3f34f0a1c265441d55910fc206479da18356300ffdcec9aecb1f557aaeffc6dedc7d5c7fd2baf199a15e336ebb79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640270, "uuid": "b420d968-e112-4c6f-b104-f96d1a6154b4", "value": "T14ED33A06B30C0947E1633EF43B3B27E193DFDA8125E4E740651FAA8A9172D325586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640270, "uuid": "9960427c-97da-4a6b-ab68-d7c5fd571022", "value": "1536:XpmxNeNGfxc+Dq9muYPlvXzPqY0XTXf2kpVDvAtYQHMndE1YEoohRqywEUX/taqc:XpmxsTdY0XTfl0tYuYW4l7uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776640270, "uuid": "12c290d7-8fda-42d6-9dec-c05436c53f8a", "value": 133820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776640270, "uuid": "b5cb8cf5-330c-416a-91ae-1006fa717aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776640270, "uuid": "98e13761-7259-4acd-b0d4-c553955dfcb3", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d88f47-3bdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776595806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595806, "uuid": "80ba2b19-2bbf-45ef-9db8-1eb429a0b119", "comment": "Malware payload", "value": "62444d0b58f9989b4576b5873173ab62", "object_relation": "md5", "Tag": [ { "name": "BHO", "colour": "#2097A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595806, "uuid": "06d05260-d7ed-4d06-9c0a-8f6bd42eca7f", "comment": "Malware payload", "value": "cda8b9c1cb730cc256b447fd3cdf6e8c0de981c1dec3e1d1fb372c645c28fb94", "object_relation": "sha256", "Tag": [ { "name": "BHO", "colour": "#2097A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595806, "uuid": "f35c5252-865e-4ca9-be68-291f65eb4a71", "comment": "Malware payload", "value": "615dc3b28d631d72592fb2688006d071a3520195", "object_relation": "sha1", "Tag": [ { "name": "BHO", "colour": "#2097A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776595806, "uuid": "47258a50-00d0-4b2a-b226-3c097d7852e5", "comment": "Malware payload", "value": "41f5a9fff7465c665db70fae021fa428f9fb330f318067fe314b962f279fdcf8d4b69af468864630e8163cea863ccb18", "object_relation": "sha3-384", "Tag": [ { "name": "BHO", "colour": "#2097A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595806, "uuid": "3a10137b-01bb-4503-851f-02a426ff51bf", "value": "T167183370F8F53DDCFC735538A801FA2C611C9C46AA979C6B23197F7918A2EE571EA009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595806, "uuid": "b12ae5e6-f9d9-4797-9214-0ff5913bb186", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595806, "uuid": "f429e51c-7ba9-491c-8acc-da9f6b892eb0", "value": "1572864:STonHNJ8feECsu/9iE+DK9wVJjeTUgLXEcjg5PbcQWrHKttPabiI:S28QsrE8r1eXLXmPoQc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776595806, "uuid": "16b63ba2-68b2-4bad-8782-4ccfa0ed0811", "value": 91725156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776595806, "uuid": "9db7ad72-8fe5-4ec2-b3da-bc061e8740b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776595806, "uuid": "b1d95516-e197-4c50-b258-f9faf50e90dd", "value": "ldp\u0447lay\u0447er9_ld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ea641b-3bf8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776607454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607454, "uuid": "26020713-9788-4150-a58a-73d6af1887ff", "comment": "Malware payload (WeedHack)", "value": "9f5361dff5cc4b63cc4152580d164bf7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607454, "uuid": "70f5ac89-1615-4ab5-9430-ac4a704c06e0", "comment": "Malware payload (WeedHack)", "value": "cfeb96b3bf72d301eb641aeea4e6e4525abde9dbee909cd863efc61d03b7b86d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607454, "uuid": "28b3f997-ee62-4119-bb52-38e21c914272", "comment": "Malware payload (WeedHack)", "value": "01f65f40178c4bba29b338877eea7cc8081f2de0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776607454, "uuid": "063d115a-f633-4843-9c19-c0ec6b37e849", "comment": "Malware payload (WeedHack)", "value": "4500e9df3144b17fd42d437889f99dfd85241af6c206cca3807eee7b893cee9859b850dab86f3908f5edf0ad3dd9f102", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607454, "uuid": "1ae63da5-d5e1-42be-96b8-0800cdad5629", "value": "T142E433A801AB7A2DFCC5DBB4D0368CF3C42F844E59A55F19443B2C25B6B2AB73B61542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607454, "uuid": "bc23c9a8-9363-48b9-9998-0302cdd6a6e6", "value": "12288:lApmC4o+yQ0mFF/O+b/54xjTWZDAzY6PB+AsW6vZ2oA7tBKBB4XSmaXrqY+Yq:lA0C4oBQHAO5OjTWZDAzY6J+Asvh2hDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776607454, "uuid": "2ddfe903-6873-4f7f-9efe-6056f474cb30", "value": 712010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776607454, "uuid": "9fc2f9f6-7320-486f-8384-4c11a0f9de7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776607454, "uuid": "3309e304-c864-44e6-af3f-996fc70c2cbf", "value": "WieselClient-v3.2.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741cbe3b-3bd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776593197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776593197, "uuid": "2788094f-3cb1-49a6-933e-8398ebba984b", "comment": "Malware payload (Phorpiex)", "value": "ec7f333395a869ff240a40d71dcb5e15", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776593197, "uuid": "93c3afe8-8302-4423-8f1c-6520fbbe9dbf", "comment": "Malware payload (Phorpiex)", "value": "d0849b2ce09bffdd925bbac6327361f4e219a1c58d07b65be71d209ff7fd73ec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776593197, "uuid": "9c910520-7a5f-4510-bed7-c2030c65dad0", "comment": "Malware payload (Phorpiex)", "value": "e9dc034e0de300eb1434335d3bcf1848a1ce02de", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776593197, "uuid": "45a22e2c-7da7-47c5-9b82-b1ab2f18f69d", "comment": "Malware payload (Phorpiex)", "value": "1412c7141506bf916780f679829c67a63b45a37a5a608d3dde73c27c03c23716a60012d79fcdbc74d7dfba67617532f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776593197, "uuid": "700760d2-c527-4806-80a0-ed4ea1fc331f", "value": "T175A23A1FF801821AE0E100BC93718BBB4979A5B2378451D7F39148E99939AD5FC3E66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776593197, "uuid": "5b9cc602-e85a-436f-adcc-afba22c980c8", "value": "fed4efab6ea2c30baa97b9a0d7a02abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776593197, "uuid": "6c60f3bb-986c-45d9-be1e-c5352ae82a71", "value": "384:a8j/aLln3xeLTz8sl3YJLlDcRbHYj9unApn8tcpHB9zSX6V:a8m6ztcLCRbHYjcnAIc1Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776593197, "uuid": "90863bd5-50ba-4dd1-ac50-db48375315e4", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776593197, "uuid": "a627969a-7eb7-478b-9a4b-4322089328f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776593197, "uuid": "6648a12c-cabf-43b7-b8a4-2d482471f45c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fae8630-3c49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642233, "uuid": "b6674faf-a94f-4cc8-b4d5-6c94d3599fa8", "comment": "Malware payload", "value": "de64359763093130683b8004c00e911d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642233, "uuid": "e99ae799-deae-4f32-b456-cf453980be7a", "comment": "Malware payload", "value": "d0fdbb7ac44c4eeaf8f9a0b02064563ea364b8829f423a18f0af3c715e0d6bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642233, "uuid": "cf678a45-c8be-4eae-a025-8669a58d4396", "comment": "Malware payload", "value": "5f0299d45fd79507a899f3571e773cb8befbac8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642233, "uuid": "2e011aed-c238-464b-a727-86c19381b023", "comment": "Malware payload", "value": "20c3ca47ddc340fda1e0a070c91997d4c18d956e850473c2bc42f3f6bca89888e7b4f799f47aba8963c7c4d3363174b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642233, "uuid": "9d5b3c79-e7b4-4d5c-b088-7d638caee5f4", "value": "T170C30549ED416B01D9D635FEFE4E028973531B6CE3FE7202AA245B3523CAA6B0F76105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642233, "uuid": "53b02cc2-4fe9-449b-8aff-2d52687a7320", "value": "3072:o1dD28RGXxgLRrxcb+avtRJTsAuu5Zsdmnkc2diPF:QDpUhgLRFg+av3JTsAuIqmkc2diPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642233, "uuid": "e9a00202-8c59-461b-a407-1ad3be72050e", "value": 118564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642233, "uuid": "2670f4b5-a2f4-4db5-8a19-46ad1c4e4b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642233, "uuid": "9d196f92-cf5a-44fc-8818-830fd9bc0b33", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0556e3a9-3c2d-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776629948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776629948, "uuid": "27f37a5b-dfe9-4a39-9e07-eb2b23180e7f", "comment": "Malware payload (WeedHack)", "value": "a45fe7b023b97f2c4804c822f4fe7d3a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776629948, "uuid": "06a02807-a221-471a-a896-003fee6369d0", "comment": "Malware payload (WeedHack)", "value": "d1ac5bd34c22a4a4c3c28a6c6e6440eaead1ba450bda692953494c54e7ba845b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776629948, "uuid": "f0a7039a-68fe-4c12-9f52-a696c6c61b12", "comment": "Malware payload (WeedHack)", "value": "9cc0266cd736be4ec918f28bd13dd3737fb86ae0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776629948, "uuid": "e20fa023-b2e8-485e-a780-f8ce3df9741f", "comment": "Malware payload (WeedHack)", "value": "4ad3f87a2ffd5c0791f4a5845703a0e32012724de167c683661fb5c6a0062345ddd7373bb6e6b951f424d9e85d104dba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776629948, "uuid": "dc7da1a6-c30f-45a5-9fa5-af6025432ca8", "value": "T1451523AA9EDB20F1E447617E4472932C0F939650EBF8F304BA7D2C81D1AAB7765CC944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776629948, "uuid": "96d2fe90-8e5d-422f-9bfb-4118d58f27ec", "value": "24576:cHHA5RF3Wf8dJ5ZXa06hK6iolPOoi/ryiL2j:cnA5nS8jLKBh2olPOo0yqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776629948, "uuid": "fcc64bfc-873d-438e-b0ff-6a517642715b", "value": 900646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776629948, "uuid": "abd073e6-d3a0-4320-bd42-3c4c3317b163", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776629948, "uuid": "f1951540-22cf-427b-b936-c6ff62460ba4", "value": "Fake_Spawner_Mod-1.1.0 (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c449715c-3c40-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776638429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638429, "uuid": "dee68c5c-b148-4b5f-8038-fcbdaee832d4", "comment": "Malware payload (Mirai)", "value": "75cd32932bda13c193af3fce087ffbf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638429, "uuid": "f1742c94-9a67-4512-b2b3-177a1b7b141a", "comment": "Malware payload (Mirai)", "value": "d1bcfaea2f0b268ac6ba7ad0ef2de8f48f4984ffa99d4f5104330d01649e8005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638429, "uuid": "e3ab98e4-bc67-4f54-a94b-972d0ec76777", "comment": "Malware payload (Mirai)", "value": "07d57c5e5d57302d668c0582fb1157b2b6527c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776638429, "uuid": "db9274f6-c8c1-4fc4-8d1e-1760fc0df75a", "comment": "Malware payload (Mirai)", "value": "2c7d94683f16da092b132b7699a8f2b0df7851474f5995cb39274bddebe946b714834b417af5921e20b9da4adf347625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638429, "uuid": "18925767-c734-4946-bedf-a220112daef8", "value": "T18A04B61A9F610FBBDC7FDD3701A90A0635CDA54722A43B363678D924F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638429, "uuid": "e0bba195-7186-46d6-8d39-76697c73f2f3", "value": "3072:RHN+AyrLGKVWBFMdRIR0Av9Xf4JeynYY/D1qmlM:dNgJVWBFsc0otf4Jeynh/D1qml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776638429, "uuid": "d6ab0e0f-eb57-419c-a7b3-f6bfeea2dd3c", "value": 177428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776638429, "uuid": "d7d74238-b4cf-42e6-b810-d211390f8a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776638429, "uuid": "ec2dc145-0fc2-43a2-bb5c-9c2926a9f541", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f0bc76-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635424, "uuid": "4d630d26-3af9-43eb-a71b-7ef2bccd7ca6", "comment": "Malware payload", "value": "e35c994606839b8c672368540e8dd94f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635424, "uuid": "a0a96e98-beeb-44d8-80f4-09dd319b6a9a", "comment": "Malware payload", "value": "d21ca7376e7d1f35662299950f46bb438dbe3f10388a21d24305e3ed4968fcd4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635424, "uuid": "d0510a0d-c799-4da1-8524-b5000ee7623c", "comment": "Malware payload", "value": "5963a5104070df2e7e48b45d87831155b6f93f88", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635424, "uuid": "984068e9-addd-4119-af24-4c9bf0c75442", "comment": "Malware payload", "value": "238656fc4cf3b99f0681b0c795ef642bf0d3d1f711fa84bd68e0bc6b6b30615fcf959f753b522b0943ca829f013e11a2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635424, "uuid": "86a53a29-682b-47f4-9aaf-13c2ff362877", "value": "T1A5D533339DCC56BCE823913C58583B72351F8A90DB07742A3ABE5617A8EBDE543217E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635424, "uuid": "fd687d68-a41a-4b60-8a48-5addfa5d57c6", "value": "49152:p55vCW8/eWTaXdajWkdutFxg6XzcQUiOCCvtyPT/EDGQ6eCyRzU77rGC2p:LBCJHaXdyUto6XgQUH5vtyQDGheCUI7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635424, "uuid": "bf82d84c-25cb-4a50-84f5-92200f1882db", "value": 2984550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635424, "uuid": "96ffe28c-f79e-40e9-add5-84291764d265", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635424, "uuid": "8f98f4fc-e8d7-4fc3-9829-528bcf7c96a5", "value": "Krypton-Client_1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde6d5e4-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631144, "uuid": "54d066f5-d7ce-47ae-b147-a25c5451c1bc", "comment": "Malware payload (Mirai)", "value": "6dbb0f2be9e1e7165e8d31a52c071af9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631144, "uuid": "63ed9c44-f0e5-4e4b-9ede-74bd68612164", "comment": "Malware payload (Mirai)", "value": "d2d4796b94fd8bdc26e6ba313fa4e9d98f6c58049c9ad8ce0366677ab5e560ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631144, "uuid": "9333d5a5-5221-4cd2-85c5-930d11b5abd2", "comment": "Malware payload (Mirai)", "value": "20752dbf74d52f2dc2420b78b9ce9354a2e009b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631144, "uuid": "65b6da88-86b6-4d7c-97ea-311ce3c96d0f", "comment": "Malware payload (Mirai)", "value": "022abd94e60de734c1b48eca9cb33d00623ad43899a241806140ff2800bf85bff7a0910942978883952cadf04b38badb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631144, "uuid": "9c91d60f-39f0-4f87-967a-20a17d27bc25", "value": "T1B0140B02B9114F53C5C31BB6BBDF46953B33672897EB3301AA19BEB42F4769D1E2A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631144, "uuid": "ef28a0f0-2aab-4bfe-9282-57a829574d7b", "value": "3072:R1hGdij/KOZ4im57VYc2/RQsW2HSMT0CamJ6CJaIJxsCa194ESBj:TodeiOZ4ie7VF2/R/W2HSnHmJ6CJaIJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631144, "uuid": "53e92df7-2c52-4696-885d-c64629149b14", "value": 196182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631144, "uuid": "26d8f246-0be5-4457-9444-08f3901e900b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631144, "uuid": "2de5f39c-72b0-4913-888f-d006039076fc", "value": "mynode.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877aba15-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578627, "uuid": "f51a8edf-792b-48e7-937f-a87ce7aee3bf", "comment": "Malware payload (Mirai)", "value": "27e5e19e6c0a4ad63649d777351d9007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578627, "uuid": "d9b19f5a-24ea-4ee1-a108-0de267995748", "comment": "Malware payload (Mirai)", "value": "d2fefc3d8d8cba42c2a6c89176a75202754c011ae4168466fc61513e98a9caed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578627, "uuid": "cb304c60-e772-4097-8ae9-700a643f5b99", "comment": "Malware payload (Mirai)", "value": "205f1df6ec39f23fb7139a5375179e4b4565b877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578627, "uuid": "8242d713-8f14-4b29-a59b-4fea458c5362", "comment": "Malware payload (Mirai)", "value": "8c18ff62290c311c82258ff9c4ac6f562e27d667b5776dc1dd85132c23ae5049d588715a70ecb0a7cfacf37aa531f577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578627, "uuid": "d1079245-da87-4fdc-82a6-bae130e900d6", "value": "T135D32A41F9414F23C6D612BBFB5E428D772A17A9D2EF72039D211F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578627, "uuid": "ffd6bc61-4bbe-4fcb-856a-ea32523670ee", "value": "1536:a3Du4G5c5BEsqEh6u0eYWgAMaz4V/HFTcVmAWTNPdmOAISeSxLme42Nfly8wywMP:a3DiGqkKXWgq4RFStWTlTMNmevmZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578627, "uuid": "9ab0da87-4e1f-4228-acb4-903aa1e9fadc", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578627, "uuid": "d142f2f8-28cc-4dff-beb1-d5ac0e3a7aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578627, "uuid": "2d92d598-1d79-4e41-8757-2b3d18738a61", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a796b1d-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776624373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624373, "uuid": "650c913a-d051-4e45-ab67-596425a0e58c", "comment": "Malware payload (WeedHack)", "value": "13b5a430059d77b43bb3226ea8a31e27", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624373, "uuid": "bece733a-5e89-410b-973b-3a57b02f6a59", "comment": "Malware payload (WeedHack)", "value": "d3edf40bac71e775a2278711afa0e6c5447e20526fd060dd662a3a784dd13e90", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624373, "uuid": "7482233e-4b40-46af-aa4f-5b9c7d678b00", "comment": "Malware payload (WeedHack)", "value": "f99d2ad8bbcc921114d0deeec1c7b269f525d85e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624373, "uuid": "e061960b-ed66-4d3e-bbb1-8c7617543512", "comment": "Malware payload (WeedHack)", "value": "4e29c8837593196194ed2c0889a6709ad9f7e00f19b757b6ce803858770dc84fb76b4a0d26328a5d0ce8c83ce21821a4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624373, "uuid": "b33a39dd-eace-4bf0-9e89-477579cf7e7c", "value": "T1633533C3ACCD766CC34708F939D2A64418A0B0A2D40DEE566FCBBAD63DCC7E1D069991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624373, "uuid": "84767f80-9fd7-44bb-add5-50211de14fe6", "value": "24576:tljx6xkXa4otOPBYK5hfAJlhQksTR55bVWFC8brMw1zzvKP8DuP:nFBYKD4JlI5twrLPyP3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624373, "uuid": "29083b8a-358a-498f-a242-6ef99114b971", "value": 1121775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624373, "uuid": "83c797be-d268-4c91-9e85-c656560d623f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624373, "uuid": "26c0c6fc-d58d-4e64-b93b-82118cc363b8", "value": "ArgonV2-1.21.111.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522297a1-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642532, "uuid": "ff6892aa-2e7a-4a0f-b57a-075a5e87641e", "comment": "Malware payload", "value": "44cfa637715aaf5d78fb8ed5c5895398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642532, "uuid": "b302f69e-e613-47c3-8d1a-a81900b9477f", "comment": "Malware payload", "value": "d3f27df4b7722beb2715a7e21b4e4909b90d6ad8ae4af65b92ce511d915c56c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642532, "uuid": "bfa51b3a-2410-4251-9d74-41e7cf3db19a", "comment": "Malware payload", "value": "50e2df63aa6353822e0e4f927fc3422cf5e87bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642532, "uuid": "afdff358-bd74-4e22-a31b-df4b9fd337c1", "comment": "Malware payload", "value": "b49ff71c715662bc0da15141ecf8cc9bae0c2d91aa6089845a87e4b0b0f5286e278d7735b6413368524da119dfacb695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642532, "uuid": "25e33ce3-2a3f-487b-b87b-5ad530e03e49", "value": "T16B43027D1A0FEC9EC14399B502CD0BD6AC315B8D3C21DDC16D967CB2EAA186366ED483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642532, "uuid": "08dfecc0-7563-4aae-8a55-a394c98a8af2", "value": "1536:bCIciIgwvxjhJxFhS3VZ+BU1cfQjvdj378Xd8VrY7:2I9PMOFZX1cfAvRwX+VrY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642532, "uuid": "92ce6623-9233-4150-a213-a68f1c590066", "value": 58632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642532, "uuid": "cab7349c-aab9-4333-af15-090e5abfd011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642532, "uuid": "0558330b-46f8-4827-a265-e2105c10da18", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd1f9aa-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635415, "uuid": "85de8e51-7715-4211-9c17-e16df29da26a", "comment": "Malware payload (WeedHack)", "value": "f8aeadf41585e17a22f132ace5c0a5fd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635415, "uuid": "b737caa4-eecd-4a40-8a83-cf533b8cdc55", "comment": "Malware payload (WeedHack)", "value": "d40a137062821022dcdd77b2cea66ac53a8767ff48ea5513a5d92e130018ff12", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635415, "uuid": "cb92f1f6-abf5-4ad7-a8f7-00c8702e7c72", "comment": "Malware payload (WeedHack)", "value": "5604479e5e8b5ba14488d326fecb574244684bfa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635415, "uuid": "a450a66c-3439-4439-9744-79aad70c38ca", "comment": "Malware payload (WeedHack)", "value": "63be378fe238b62271a90245f6bf583e2343844b196909bb124b9b2b4e625da167f585a0115336178e7e83c2f7eb451a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635415, "uuid": "82bca719-9bee-418b-8b91-345fd43aa6e4", "value": "T17785D887F1208AC7F44FDA7F14904210ADF0E0B05607F2561B6E886A6FEB9C89F657E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635415, "uuid": "b5d28cb9-601f-42d5-8b0c-7705dfcc7e04", "value": "6144:O1eMX5Uh/W94gpr2TYPjhMoQV+/gvFLezWkuw3jBEv4HUQDXA4/1Wp3x1Z8:OZ7uk9bPz/1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635415, "uuid": "75f12328-a6f4-406e-8d1f-b5c9bb2baea0", "value": 1728360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635415, "uuid": "40c7d21f-52b1-41a9-9cf0-759000eb338f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635415, "uuid": "530fecd8-c3b9-4482-8248-a6e863014f1d", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c17dc09-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624457, "uuid": "018c998f-d947-4bea-9a6b-d81d60022bb3", "comment": "Malware payload", "value": "bf59b71bfae9018479e52c996bf4b9a4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624457, "uuid": "24dc6de4-598c-4601-862d-168e812cdffc", "comment": "Malware payload", "value": "d4eb109953964acc481d4568bccbff2225598384316b7b67298468afce8a4f80", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624457, "uuid": "b6446bd0-48f3-4c4e-83b0-89bc55f62dfe", "comment": "Malware payload", "value": "661b88baddaf63bd2be6c8daec31dd15c9aee391", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624457, "uuid": "c6c51779-5ab5-4607-ad93-143b1c6898d4", "comment": "Malware payload", "value": "a3cea7226406255ad4ec7a2eadcdb4e5d635d7ea40c17c39285c99eed778e21a919d0f40de7610d911c6e4f70c459056", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624457, "uuid": "16836894-60d1-4246-a55a-6a8b15be0d0f", "value": "T10BA4129AD6ED5721DA63C372A2BC45A1BD3D78C3F203B61A3C79454E987339B9326304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624457, "uuid": "b03d99d2-318e-4090-833d-5a1b1d00a988", "value": "6144:DMd2p1OWkNMjhpCuCj5DiRgRKHtkTvINI+NjpZ7eMzBf4L/GhnMMMtz:cPWNjhpZwQRgRY8vKZyYAL+5MJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624457, "uuid": "b3b4887d-3316-4531-b2bc-ae43256c1aba", "value": 458821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624457, "uuid": "8b7fad23-b687-48d9-a50c-10afa6bcd104", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624457, "uuid": "dfbda7f4-a8d4-4acf-8d0c-b62812939725", "value": "OC-autorynek.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f0c72c-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635390, "uuid": "42df2705-0291-414d-87b7-8062fc1bc375", "comment": "Malware payload", "value": "3b147ac72d1486fc0a653be7137bd222", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635390, "uuid": "2bd0afa5-7a21-4973-8bb7-a456a490f09f", "comment": "Malware payload", "value": "d508cd5cb8ad5158dda41b2312adbd394fe14d3cf2d047d31ececf5f01690276", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635390, "uuid": "a12b7b00-7df8-4837-93d9-ba14bc9b1125", "comment": "Malware payload", "value": "d3f2285ea68f643d0fcb1b651532ba199e0f5cc5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635390, "uuid": "0541c3b1-3c7e-4ce3-914c-1c99601cf5af", "comment": "Malware payload", "value": "ce342db1b4606eaf12e01eeca72845691c7d3e12ac264a044df99a8b066c68732d7ae1cc28899b4a87e55c9f80e7adb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635390, "uuid": "7a204121-6d79-4a2d-81bc-5f6de47e7237", "value": "T16C95336E91C2BE0446925C32BFA0ADE97936958ECDCC76817D105F3740F90B687372BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635390, "uuid": "0928b25a-79bb-4b52-a59e-a71c9073d4ab", "value": "49152:Eq5lylIiTPMTAWWbELrdw8INc4c7oJ8ER:jlylI4EAWMQWPAKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635390, "uuid": "888e44d2-c4cb-44a2-9261-75028835da70", "value": 2043611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635390, "uuid": "e9d7ac1b-0480-40ce-acdc-f1a5430390d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635390, "uuid": "28817973-16ff-411e-b0f4-6877370377f1", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980b3fd0-3bb2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776577366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577366, "uuid": "0dfd870c-0fd4-4f40-beee-b00a35f87884", "comment": "Malware payload (Gafgyt)", "value": "318bf65afc7d06fbe762feac8bdfcaf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577366, "uuid": "9288bdb8-772e-44d8-8524-aaf776acefe7", "comment": "Malware payload (Gafgyt)", "value": "dbb234915f65bc22e2206bceefe4c7c0916cc1678ecc22cb17136c35232fe724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577366, "uuid": "03cb61b1-c010-406b-a772-6509dc3c182d", "comment": "Malware payload (Gafgyt)", "value": "92d0fa20ace513f895eecaaacbdd65c89c2fba67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776577366, "uuid": "aa116c28-a1d7-4457-81c5-bb1d1b800a60", "comment": "Malware payload (Gafgyt)", "value": "015cc52f040eadc4cce5e35cf54bfe08bd5bef1536c98b22f6e8ad0e7582252a57ef9e0f34f2a3b99407839cc169dfff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577366, "uuid": "86893335-0ba7-4bef-b198-9a1d691af7ea", "value": "T1F8145271E88CC983C563117DA1ECDFAEAE3E33DA6385ED027DD0253156C6A9B290BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577366, "uuid": "7c326272-c04b-4c4f-badd-002d78400e70", "value": "1536:LHO7CydNe5kbJtQ2YAs0HBzwECDS+HdOpiKvriTFK+pK7DKrtwp+Vp+wEibLH750:DOzdtQ2YbQ+iuTlH71G51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776577366, "uuid": "498211d2-611d-4fa0-af1a-29d46a94c094", "value": 204088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776577366, "uuid": "d5e82398-4544-4f08-9c69-ebbbf8ad0d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776577366, "uuid": "0bdaeea2-eb3e-40ae-b19c-0b3c45f1c296", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd52ff8b-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598930, "uuid": "6ed93c4b-ac33-4c5a-872a-48c2ac1f2f1a", "comment": "Malware payload (Mirai)", "value": "e4069c8dc576857691cf03976f13bca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598930, "uuid": "8a2e2bdb-6f7a-4fd2-882e-67fa0f8e5f08", "comment": "Malware payload (Mirai)", "value": "dbfbf959516d69fc3fe2a022e6bb9ee4cb244616cde4b37d8f6ff63d14c20c5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598930, "uuid": "69bbd851-b8f6-4281-b82e-1261e382bef6", "comment": "Malware payload (Mirai)", "value": "991cca7cf9aae04d552b7fc14602c117164e2c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598930, "uuid": "fd93280c-f833-4b9f-b265-fe0b77969e3d", "comment": "Malware payload (Mirai)", "value": "a4c346ea16dbcab2fdb70557e88bd3331c949001a350d9e67a10d98cd791378e1698efe0fd8875f73470d6894c97b855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598930, "uuid": "65a0d541-16f2-4b18-9b31-7762c9edd580", "value": "T1BCA2D025E346AEF4DFAF5D9452C2C2C2B7F547CB278AC8E340EEAF016506046BB48D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598930, "uuid": "ec94a685-1456-4001-99be-598201b386b3", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5LM4uVcqgw05VxJV:9RxsSVsMD6xiJJE5zRWNu4uVcqgw097", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598930, "uuid": "88a34faa-7bf8-46fe-8641-329c3f78f84e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598930, "uuid": "edbb13af-882b-455c-a209-d41fe8107839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598930, "uuid": "8524c1c2-a10d-4c5e-a9e4-ee90c5b3a739", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab378a-3c08-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1776614421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614421, "uuid": "5892129e-d727-4cc4-b02b-452e4f6b1a58", "comment": "Malware payload (Sliver)", "value": "24ce05707f96d6f612a6b7f91b605db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614421, "uuid": "924fafdc-4525-4857-bab9-cad1320b101e", "comment": "Malware payload (Sliver)", "value": "dce3f821a6c556734a9660b07fe4f47c7323959f0dd5c0ac2fa49ff815129ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614421, "uuid": "48e89616-5953-4fcd-8fce-7d414b7c6fb3", "comment": "Malware payload (Sliver)", "value": "a290bd9dde50906396546a5536661038d8f373eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614421, "uuid": "f7551f44-662a-4713-a65b-75fc4ffbab7e", "comment": "Malware payload (Sliver)", "value": "4d814700ff3e9c3b049e8ed0f598a23c71c31a8a3157fb2a616a57e2014792b884506f2e663c235ba1822b91b01bd691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614421, "uuid": "fdc98239-012e-4e8b-9b06-0f2431474fef", "value": "T1FA774B43F8E21EA4C4AAC5B4D165815BFA723C2D1B3C23DB0AA1F7241F3ABD05A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614421, "uuid": "cae9dea6-64a1-4aac-8cdd-b4b49f58aa28", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614421, "uuid": "afffa147-1ccf-41dc-b2a9-511370c09dae", "value": "196608:6Kgjt2NrtvKsrip2IszUNLzHNhHhkwaMVdSo22/meNwdUxbJ:625tvSdNVJ2KmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776614421, "uuid": "8fb9c0cc-55a9-4967-8afc-23da34a0fc89", "value": 34448896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776614421, "uuid": "ce0a887d-d8ca-4dea-94ab-3f39540b0db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614421, "uuid": "a27819ec-6f8a-4469-9d27-f153caae2fda", "value": "24ce05707f96d6f612a6b7f91b605db6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b933ebf-3bd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776591384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591384, "uuid": "eea0da48-4881-4078-98c7-4d2cc89c5f74", "comment": "Malware payload (Mirai)", "value": "8032814a64a99e29f2d08266c53b1d8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591384, "uuid": "41dbf7b5-3160-4355-b826-debaec7ff70e", "comment": "Malware payload (Mirai)", "value": "dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591384, "uuid": "a231e679-e940-4c3f-8845-08755061c223", "comment": "Malware payload (Mirai)", "value": "95e42ffd82b2fffeb1a35f38247b2f73646c885d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776591384, "uuid": "f234a3a0-ba1e-426b-a158-39ef1c64f358", "comment": "Malware payload (Mirai)", "value": "46e5592a0d872e7e20e699e5c2c59583553ee1b910343bbf19ef20280905ffc6ad2947e4aef02d9a2d2d516907856f11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591384, "uuid": "68cf9552-7961-4d78-92c3-ef1ea0df1bba", "value": "T1C251E7C546846C792CB7EA53F6B6C12C3091A4D318EE7F99DDC8BAE0868EE14F140793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591384, "uuid": "7a3f9ce5-fa75-4b75-9108-cb16d10e1f56", "value": "48:vpd70d7N7hpdvd6GpdgndzPpdfdKWpd1doUpd71d7o7UpdfOd3bpdEd9RpdhdcgD:vz7+7N7hzV6GzgdzPzFKWznoUz7n7o7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776591384, "uuid": "adaeb45c-b693-43f0-b840-7be960682a61", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776591384, "uuid": "a07f574a-993c-4a9f-9ac8-526eb7772eef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776591384, "uuid": "64595cb8-8517-490f-8892-114efa6f561b", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df14c42-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578638, "uuid": "1b0b66d9-8a8d-45ae-be19-762d54eba9f1", "comment": "Malware payload (Mirai)", "value": "78e6627ef19bf08cf39ae4029d2ae75f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578638, "uuid": "ec7624d8-c5b6-4bbf-9cb1-4882634c484c", "comment": "Malware payload (Mirai)", "value": "df24a0a3e182fc4ee7f2bf3bc7963d0cefabb3846eb3cdce6bbd28b9e7b4a5cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578638, "uuid": "c5658bcd-4bc4-4660-a03f-de628f662e48", "comment": "Malware payload (Mirai)", "value": "e92cf1c07ab32742bbe5cd08eca1de5cb0da426d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578638, "uuid": "389dd828-6bc2-4f84-adc4-7227068be591", "comment": "Malware payload (Mirai)", "value": "50110908620a6ccb7b45d11b0292c08478c9969255f1308f7530f7f16bf124a8812d751bba36fcd03b328a22d811b51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578638, "uuid": "35a90eb1-f954-44a7-bde7-8b907543ec6a", "value": "T12D735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578638, "uuid": "5b5d7fe8-8091-4a34-bd61-f65134ab0178", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7L6t:uJE+5x8TTRkg7IF+7gLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578638, "uuid": "26a7a0eb-64f4-44da-8191-59589665b77c", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578638, "uuid": "31071bc5-6185-4db5-8f44-2471d4c12d30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578638, "uuid": "e843d27d-833f-4f6a-a638-1fc0f38a6f1a", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82accb46-3c1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776622427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622427, "uuid": "e131a41b-9d43-429a-8b9b-7e1e17c414d1", "comment": "Malware payload", "value": "457f16ed0b4dee051bcbcc914d6df4a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622427, "uuid": "b572b7e4-f293-4d54-bc14-d8040b9530ec", "comment": "Malware payload", "value": "df6557b17ac111f4e2805fff3bf4aa8adf3dc69349e5a3bfc4fe71d69364accf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622427, "uuid": "5cfa9765-d798-40e0-8cb5-63b934148c5e", "comment": "Malware payload", "value": "a71fb21423018a887e40afaf15980dcd3517fa51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776622427, "uuid": "53f0551f-9480-4e23-8301-9df771343b8c", "comment": "Malware payload", "value": "3ad0e937ed48f885675aebcb4931869a88297d45f76a50ec9851e6a62201684c960dbd105935e9614d0712a68aef297a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622427, "uuid": "7bff9586-e877-4001-a2c0-d2f09458ae8d", "value": "T16C04985A6E228F7DF278C73047F74A35976D23DA27E1D684D2ACC1141F2029E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622427, "uuid": "559369aa-192f-4081-bf97-50164a4ef01e", "value": "3072:p5lv25E8XMsVLGLDluS94yDTfjaC7LsoVpZDQh:p5WXNqfX4ib+C7LsoVPDQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776622427, "uuid": "3ecb8b2e-4a61-45e6-a5d7-2ccbffd69181", "value": 174548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776622427, "uuid": "f9df0165-ad43-4bc6-bdc4-49a4620099be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776622427, "uuid": "21a56e3f-3627-48cb-9eff-05b7b359b4eb", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc0f972-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578663, "uuid": "81cb4d81-7fea-4437-974d-71a1ec39178d", "comment": "Malware payload (Mirai)", "value": "6dd10804a976a9c719b76ef5c5368428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578663, "uuid": "2dae9c4d-ae95-4e7c-9137-0ef0f3674799", "comment": "Malware payload (Mirai)", "value": "e0761ba09e0976658f9f18fff61605c4a445c8c42dc314fa8c530293eb1248e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578663, "uuid": "25f2429b-b995-46e5-a391-54b36e9dd761", "comment": "Malware payload (Mirai)", "value": "75de99b22fbdaa5602dd4ec263205cb910ce6e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578663, "uuid": "0cac88c2-18d7-442b-8c5b-ee800b94ee8d", "comment": "Malware payload (Mirai)", "value": "74f7cebc834b1c281a08608c88e63136ae61b445f486d5e20cd1d2f8e87914709c816caff9f3c56862786f2ab1c155e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578663, "uuid": "0c9979de-4239-44b6-b988-025b88178b31", "value": "T1CA83285AF9818B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578663, "uuid": "80da8812-aede-4110-80d0-7fd02e924c9e", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYts:BVE+2dmTEZCSHYMactW4Bi9gnS4V0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578663, "uuid": "e5b42fef-7bf0-41fa-ad73-bb96a375eb3c", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578663, "uuid": "dd385441-fe4d-427b-8782-c6b84827ece2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578663, "uuid": "0618c9f4-13e5-4495-876b-bd8cc0600dcd", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f43522c-3c24-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776626287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626287, "uuid": "140c0cd1-b378-4bc7-b197-da9b287917a2", "comment": "Malware payload (WeedHack)", "value": "c72a34b1131c2ac26568daf9cbddd2bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626287, "uuid": "5b782b02-9549-4ba7-a00d-13a792dcde9c", "comment": "Malware payload (WeedHack)", "value": "e11275e3cf995524ccc5e553fce212cba9fc00f04dde039f60c6fb5ae58f4bd0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626287, "uuid": "b517c58e-6845-4079-8833-f1d9e6ca9960", "comment": "Malware payload (WeedHack)", "value": "7322251dc5536c404d1afadb5b543173da42afe3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626287, "uuid": "80efbe3a-88d0-4694-a5a9-990a6bfb68cf", "comment": "Malware payload (WeedHack)", "value": "f9e18007be1f58c9edc13a046f3cdcaf84e27c5116afff66819e459fdd10ba1e8678c17bf8884d9e2f049b33f6ffda74", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626287, "uuid": "3736d728-b26d-4588-a317-57550bebc691", "value": "T1F2050131EA3C403AED0B9376F1079455BEBA40C6B847353B38A89B5A4C53E95539A33B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626287, "uuid": "8697bcdb-1597-4254-8f44-9c52855794b5", "value": "24576:TPXHfvNR6H/HS7iuamsnOHl58SInzSrAKxmA:bnNR6f9uaLnoCzSrAfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626287, "uuid": "0f545962-fe70-4b01-9db2-3a816cc1c2ac", "value": 869005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626287, "uuid": "6d079285-928d-45ff-a2fb-43b933edd0c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626287, "uuid": "d4c0976b-2cee-44f1-ac0b-f2450cb09b80", "value": "Titanium-Client-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2bbb2d-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776635432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635432, "uuid": "882e3af1-aa29-4c5d-a504-ff5640fd829d", "comment": "Malware payload (WeedHack)", "value": "cd094db4b8e282161d61c54de1788295", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635432, "uuid": "bbd6b127-e046-4737-8f6b-841aa30bd79d", "comment": "Malware payload (WeedHack)", "value": "e21de4837a1a81ce03e0db5700a730328eea13f6106e4c4e687b26cf47c91996", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635432, "uuid": "1ff3eef1-58cc-45f3-9e80-a5a4a21b44fd", "comment": "Malware payload (WeedHack)", "value": "57d509e2f2e4afa2fede2f4b1098254187aec2ec", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635432, "uuid": "590103c5-b656-4eb5-997d-d80d95928600", "comment": "Malware payload (WeedHack)", "value": "9cf1f76633b07efd770816172ae99d89e53d5ec43d7be7a8845e6b3d2073e18428d9f10291d747b72a8f7f85a2d55996", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635432, "uuid": "c4b8498d-c5f2-42da-bb5d-090b60926b6f", "value": "T15AD4121A5F3CC6E3D6EF96F6A85A0A01FC0D40E956727022A4EC7D9BC4CF48DD254B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635432, "uuid": "fffcfc38-ae1e-483e-9634-4345976de505", "value": "12288:YFXOqYR4KDdgaRQSFVJr61PodOEXghuxVeB5xew1YMG3XZ4+qu2mqeoeU3lFkhH9:YFXsDgaC+6oTQSVeBvDWJ3p4LKoeUjkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635432, "uuid": "3e3f7202-9a35-40e3-b37b-ccfc03b19eb7", "value": 642229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635432, "uuid": "77019854-35c2-4b39-bf7b-69063fa09916", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635432, "uuid": "df94a1eb-3f2d-4002-bfeb-71d44f0e9795", "value": "Krypton1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a95956-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "86479c7b-ce91-47a3-b2f8-095728710a01", "comment": "Malware payload (Mirai)", "value": "006b5183697bc316f7bb80cef5c0b73b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "17e943c7-b60d-46a5-9765-0c21c6cf2460", "comment": "Malware payload (Mirai)", "value": "e25bc609bc2bf59e9a6c727e1463cf7c55927ad059a2edc69a2666bbf8fa217c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "b9a9fe7a-886d-4100-8bce-1604f73e3f07", "comment": "Malware payload (Mirai)", "value": "94a535f7f695e9f67933ee4e6877ccffdaaac469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578537, "uuid": "c31aa895-374f-46fb-8b45-e1886c9ffa2c", "comment": "Malware payload (Mirai)", "value": "aae5c951321613c2e5f991879f25ae16436e70b0d6c4f84b01b045a35fa208065dc85b4c11d828bbf5354bbb98214872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "b644df1f-6b47-4093-a931-5a0a2a1d3962", "value": "T18D733A57BA4080FEC499C03843BEBA36D87274FE1379729A13D8FE366D46E601E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "505ac8f6-4aef-4840-8908-d27d2d2a28ff", "value": "1536:BzIDxEwvZ8bouGctIb/+w4HnC+8l8AnzcUt:BUxEyZCXtIf4HT8l8AzcUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578537, "uuid": "9f544821-829f-4d7c-af3d-a0cf7953571a", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578537, "uuid": "dd4de0bc-bc88-4f71-ba72-24e777615ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578537, "uuid": "5cf3cc10-ce99-4735-9c57-7c54fff0ad22", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7290ea7d-3bde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776596201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596201, "uuid": "9ce95970-507f-49d2-a211-d8381e908df3", "comment": "Malware payload (Mirai)", "value": "eab352465d6dd40b666e9ebb755b5b5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596201, "uuid": "3359c6ae-dd8e-4bb4-bf1d-d54a1c0b14f6", "comment": "Malware payload (Mirai)", "value": "e25c1ccabf58844e0831ec38eb2be90f1c85b12bab55a356d95da96c333f4e82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596201, "uuid": "e3c13164-96ef-4daf-91d7-54fae995693b", "comment": "Malware payload (Mirai)", "value": "1ec67b3d83c21bfe070994562b59f3ba4162453b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776596201, "uuid": "df1bce3c-a8ba-4640-901c-0917e95a7d11", "comment": "Malware payload (Mirai)", "value": "cc8951b18ea217198cd47f18f316ed6d53bd2770a272cdb53ba093d8a0ad243e790be1d5a5454f57e88fe59066180abc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596201, "uuid": "89c490b2-07e5-499a-ba94-9ab718729306", "value": "T191435C26BE610C1BC8C4657A75E34731F6F6434A20BC4E1A7D614E8CBF68E8072577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596201, "uuid": "0981334e-f6c9-478d-99f0-dcd496c35bcf", "value": "768:lza0kPtMRWEGZ6C2trYa3lO+o+IPKVhRnA/5N/7ugz1tUAxo3IE:ZCMRWEG4fYa3lo+3FnI51tRto3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776596201, "uuid": "699ef846-6b18-4d56-9eaa-a10ad0508176", "value": 59316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776596201, "uuid": "b41eff6d-5f0b-455e-bd56-365832e7c715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776596201, "uuid": "facd65b9-6ffb-42cc-a6f4-27d1afe3df23", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e23c04-3be7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776600208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600208, "uuid": "67c96135-781a-4eba-a718-97a0ef565325", "comment": "Malware payload (Mirai)", "value": "f9813bc18e2e83d1daee3174d413a002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600208, "uuid": "5a7a05c0-297f-4824-92de-0864b2d8b12e", "comment": "Malware payload (Mirai)", "value": "e275e7547d47bbbab2915bbefa04595e111f4950b44d16c857820e8e996370d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600208, "uuid": "91d34b96-f405-4631-80c3-94a80332c0d7", "comment": "Malware payload (Mirai)", "value": "e2ca77043ed6247124567ac32fe31a1a31383a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600208, "uuid": "2e23bd7d-c2a3-4221-8821-03f116e44706", "comment": "Malware payload (Mirai)", "value": "10cc60eb271b03d353ef1e22b2c7682dd6b0c90caaaf0ec3c328af127fb3255911ef5c8747d7b4454e530f2abe2b346f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600208, "uuid": "f92c72e3-f4b6-4a4a-b65e-e59c200bb353", "value": "T13FA2E17DFF20C1CCF086847E2957167B456FF8A64B98420E6A15D0C701C39DED49AEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600208, "uuid": "f6d5724a-397d-431c-9ae0-2dc70efd9540", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxU+ch:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776600208, "uuid": "f96af187-64d3-4327-bba2-6bfd603c0e7c", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776600208, "uuid": "842b1d2e-88bf-4807-921f-b914e023e1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600208, "uuid": "375903b1-3f0d-4b73-abe2-29b188e7357c", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1297e1f-3c0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776616036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776616036, "uuid": "7a6f743c-28b5-4629-b472-fd1b32e7bf49", "comment": "Malware payload", "value": "5effd5e9ec3b1f93670c6deadb1cbe35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776616036, "uuid": "7717f2ba-6b4a-4131-afc9-f27027826e85", "comment": "Malware payload", "value": "e321c3e037df2eec82c36fc8e3d342dc4c9d22bc09a37c21efefc496aa5ad3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776616036, "uuid": "7f5a4020-28b8-491c-9fe9-95512f0422c5", "comment": "Malware payload", "value": "0c6947945d5483d900c1cdd8eea1492522268319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776616036, "uuid": "245982b7-94e7-44c8-b362-d76013b36c77", "comment": "Malware payload", "value": "8cdfbfb9bdf6038fef676c08348448d0a5f7af88c205091e38de33aef702db409404e3eca45de1372963c666ec3fbac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776616036, "uuid": "db425693-a95c-47d0-b867-977bde324302", "value": "T10D542B0BA65359F8C517D03C83ABE772E931B8151335BA5A1B94DF323E61E208F6EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776616036, "uuid": "13f24f45-5aaa-4b4c-b191-c4c525f18175", "value": "ce7333df8712e9ce58c9bd23280009bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776616036, "uuid": "3b295deb-2d7e-468e-94be-97472c957721", "value": "6144:lcB6hswnxH7xgLwm8c+uO/fw0v6fWADmJGCcUTVtX:yoxH7xIwKTO/ft/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776616036, "uuid": "2edd9bde-28a5-4422-8071-60d99348f6dc", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776616036, "uuid": "9beb1209-ff34-4aa0-b2cf-5ea6a3c76968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776616036, "uuid": "48ed49f9-f7c5-458c-b3f1-655d5b786c0e", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7663450e-3c42-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776639157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639157, "uuid": "0a1bb57e-c0b4-47ee-a8c0-4b5ac4a70ae0", "comment": "Malware payload", "value": "c469bcc31a8464eece2f5c7128a894cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639157, "uuid": "dd3b32a5-5e73-4f8f-a20b-c6c9fb529bbf", "comment": "Malware payload", "value": "e3946c53d7d6c788206c29ffde25da79242f52d4e859a0f465c70235960087f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639157, "uuid": "a2fb25a2-b06f-47f2-9e8c-11c87a6fc27b", "comment": "Malware payload", "value": "1d1a5ed8f90776e48ce99e2f4aec1932282e2479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639157, "uuid": "e4b490c2-9254-4658-a1a0-c312c7a28e64", "comment": "Malware payload", "value": "0d18bb58434e0af8c22138b66de68df69cc72f25e1c33e7ac17b0d044de02af26d2b330c155f337b9587e8421b124da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639157, "uuid": "3c1c87e2-1e04-435c-974b-c3afa656b581", "value": "T158C3F849F8509B17C6C265BBFB4E438D7B2A1758D3EE720399256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639157, "uuid": "3f415436-613a-45ea-af36-20e1140bc35e", "value": "1536:Fmeq6chrUGBOyTgCnScjFwfd1T5s7FiaVxZO+V9lAvUZ/Wp/lg/wywakv8HKJnEy:FBmrUSOyTgC9BwPFs7nVrQMZ+PDOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776639157, "uuid": "1bc3acb7-e8ba-4a51-80f0-c3865f22126c", "value": 129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776639157, "uuid": "07c67bf5-a4c8-4d06-823f-42049eaf1dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639157, "uuid": "85fbbee1-5463-4e8c-a8de-3cafb4f42258", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176f97ef-3c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776624395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624395, "uuid": "3fe22036-f070-4ae2-8777-fb0ca946bb00", "comment": "Malware payload", "value": "a85877589eeda0175d876a86aa490b9e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624395, "uuid": "7e840240-7c60-45a1-95a2-d20612b0394b", "comment": "Malware payload", "value": "e6cebc314a1570415987f07a6bd66266a768182b887e4b5bdaf2cbfb37298938", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624395, "uuid": "68dcbcfb-420f-41f3-891b-989a432390fa", "comment": "Malware payload", "value": "e0ac4e72baa2f66197b482d7b111e6b3833da458", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776624395, "uuid": "d4491396-041f-4b8b-b822-5de9d47b9d89", "comment": "Malware payload", "value": "c3cc0f820a0d274bde713a08a62137a778384ac3b59fa03349697bf4e273f76f7459bf0008233da5fe01b7ef19c21262", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624395, "uuid": "46847d29-3ff0-4195-ba57-76c13371196e", "value": "T1E8B302A251178F27DFC69370DEAD4BC3182C1BA9984BF6712894131EDD128FF9E2C895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624395, "uuid": "318e1163-9446-47bc-925e-bfa6b9e40dad", "value": "1536:dtoDg3i1xuceBc86DUdyV42HRe6Tq2HSbNtol7U0WMVBbm+jSbiuMDS5FH7Fe:rok3i1E6gweG6NtoFZBa+jMiuMDeFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776624395, "uuid": "624d5093-cc88-48ba-bd82-0544bc81b805", "value": 107540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776624395, "uuid": "ecadca3b-0b44-4b08-a566-6aee72c61e76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776624395, "uuid": "26b7d41d-ad7f-4014-9056-c5a1e4481e96", "value": "dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c845f8ef-3c34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776633282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776633282, "uuid": "7ac017fe-47a3-4167-8637-c32402e310de", "comment": "Malware payload", "value": "16e71732ed8746fef8e33ac76691d551", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776633282, "uuid": "f2a17e7a-748e-4dee-a6b6-c160be09762d", "comment": "Malware payload", "value": "e7b99eb96770b8bf24d913a31d524a033c498505b3cd075dacf9900fc0909cba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776633282, "uuid": "d224f0ac-961f-42cf-af9b-931aac23a39d", "comment": "Malware payload", "value": "25400d516559908731973637978ff0ea928284d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776633282, "uuid": "b698f319-65a3-4b34-806f-83e64fd885d4", "comment": "Malware payload", "value": "d51d181413cfde5542ee08ac770bd6d32d51e53ab5a985353bcc47a5a8c7501f78f1c5a696c284e10bd7be5844d55500", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776633282, "uuid": "21aec4c5-45a2-4d7f-9d7a-d48089923272", "value": "T13B6242E5FD6695B0735F813C9B9A10027582093F05AC782879AECF296F1C2AC52FC379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776633282, "uuid": "de9e3edd-b171-425b-8a0b-90a20ffa0d53", "value": "192:ctzk9OYhO5cGdR7qhuqBnrO37pom/1otpno8J9bqJFDeYggT63QlwS8bAcL:ctMZ+cGdRoAouOo8J9WXugu38wScAcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776633282, "uuid": "e486d9c1-ae2f-46ff-89f6-34c8ab5fa058", "value": 15900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776633282, "uuid": "4a4b731e-f847-4355-a4d4-2d04602ee53a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776633282, "uuid": "7520305e-b3fb-410b-9d41-f9734841cbb8", "value": "12312312.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c54d87-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598887, "uuid": "d6e07e3f-abb5-4e1b-b0ac-6003572596c3", "comment": "Malware payload (Mirai)", "value": "1f4a559f40d5013d0fa50d98b2949b91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598887, "uuid": "2e9e7fb8-11ea-4c2a-9aac-bc8660badf90", "comment": "Malware payload (Mirai)", "value": "e7d20cc15ad18289af9c52e64d48623d078426c7c641dc8e1adf8daf62589a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598887, "uuid": "295b49c1-0a2c-47e1-ab5d-f53ac07e2513", "comment": "Malware payload (Mirai)", "value": "ae1b393beb377e272be99d8b3b121d2b18af8dc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598887, "uuid": "09e971e5-dd70-484b-957e-b5f4651a20be", "comment": "Malware payload (Mirai)", "value": "85c2a619e1a48467b476d778046c6da29dd617315248b685a7dd816556f890a2503f9ead1895dcb19342197467f8617e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598887, "uuid": "c8321ec0-0657-45d4-8594-495710cbc81a", "value": "T10E73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598887, "uuid": "6c94f072-1fda-438e-b578-3df5b8a8ab64", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStW:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598887, "uuid": "78a48b7f-66ec-4134-9967-bd1a46b9f11a", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598887, "uuid": "309eddf1-a5a9-43c6-b4c0-5fea7bb0ed95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598887, "uuid": "b6edae8a-8c81-4393-adc0-e145f7a5b60e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67a7580-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635453, "uuid": "a4d1c9b5-472d-4f4a-8eec-b745efcdf7f6", "comment": "Malware payload", "value": "98611f0fe32b584fb1ca531ae5df37f7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635453, "uuid": "58f6dba3-59f4-4b7e-b0c3-34680c1ef5e9", "comment": "Malware payload", "value": "e850977734d66616fc6f95e581ed93ab8ab26e28d779da1181614fe56533cafb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635453, "uuid": "52f0c995-0f5c-4c04-85b9-7b83e8a47caf", "comment": "Malware payload", "value": "6f5940248775c717aff27036cdbafd69fa18c65b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635453, "uuid": "4e34383d-991a-4dc9-ae8e-e0c2901011ad", "comment": "Malware payload", "value": "750fd7c324fc83f989165dfd642bc72951de2da9e9c23fed465f72d25c0930a3eb2bfa453cf8616a079d68188ac28c47", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635453, "uuid": "ad571a0c-6067-4146-87ae-78a615430b80", "value": "T1F835330C091B7943E51FA9BFB7A88427A511700527313130DE35ED67A5ACAFC8CA86BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635453, "uuid": "ad32ad27-742a-457f-99dc-1dd412c8e1cb", "value": "24576:wySsv2wfIXnCAVN2ZhK7kqXsYq7HRdu3LEeMiSYbuqkO+jJBhQJwJJhqWwD:wmqnCQNV70YqDRkgkS9qkO+j/5MWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635453, "uuid": "9b553e5f-dedd-4537-8630-b9cb53e8cbc4", "value": 1162594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635453, "uuid": "5d7330e2-a0b5-4272-8976-4eb8fe599216", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635453, "uuid": "765d9427-7b7a-44c6-8a96-76c6a949c937", "value": "NebUtils-1.5.7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453db39-3c00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776610673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776610673, "uuid": "b4350d88-1906-4499-acf6-6f09dd426848", "comment": "Malware payload", "value": "541d0d1fe9b376b93b0ac72997b45f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776610673, "uuid": "7cf6424e-25cf-4633-9f53-4852a5a74fd7", "comment": "Malware payload", "value": "e8767d8710d75c36898f0053145ae63eccc239937b160e51131a681155ed6344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776610673, "uuid": "c3117422-1c8e-4db7-997b-68885df38341", "comment": "Malware payload", "value": "345a8ea952597d371125768b96ed4dd92a77fc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776610673, "uuid": "01421f9d-e202-4cb2-8bb1-4f185410988e", "comment": "Malware payload", "value": "8690c1e80f55b185c6ffcda7d50b88040569d35b14bb0cd1d3986ac60e112c4fa8e1bdd30492038a4575e723086cc25e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776610673, "uuid": "a83ef7f2-fba8-4b2b-8898-8a7de8f58a25", "value": "T10F267B31768AC56AD4720AB01E2CEAAA861DAE360B7244D773DC7D5F57784C31336E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776610673, "uuid": "5fd6b17e-b43e-4954-885d-5ffbf3c4bd22", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776610673, "uuid": "d622a264-992e-4d98-8475-1188cec13ac6", "value": "98304:tQN5tgqSsl/QRL+Tqv146w98aWM7uEPBUH+TY6RL5uJZ46kvyAKmae58qXAK:tQN5tgqSsl/oL+Tqv146w9DbKN4pKmau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776610673, "uuid": "93967795-82cb-443a-8029-8e06a82ac7bb", "value": 4686244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776610673, "uuid": "95d4704e-b7f8-474a-8f6c-08709ec6ac7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776610673, "uuid": "e2235313-24a1-422d-8b86-c5c812199996", "value": "Mirai'sMidnightTraining.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7615838-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598974, "uuid": "5c4b4c7c-558d-40ee-aa19-8515994566d5", "comment": "Malware payload (Mirai)", "value": "c9c7dba8efd88f11406a47278b79ba2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598974, "uuid": "642b0f93-3782-4493-9310-090df41b88b0", "comment": "Malware payload (Mirai)", "value": "ea277e4de577c410305e9431e95d5e627ae8f7e640040b8776941eaf442e3f20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598974, "uuid": "2ecd030a-cc06-48fd-b173-bd3e9db0886d", "comment": "Malware payload (Mirai)", "value": "29e0f83bb56f4486a6b6c1d07ce0d08fa4b92c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598974, "uuid": "6312c6e1-5157-4012-8528-f52564e8be4f", "comment": "Malware payload (Mirai)", "value": "36f304f0db8c850ceb8ac0541372c6609607012134413b7689c9916c59d84bdc8aa035fcd088eaa658105062f08e670d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598974, "uuid": "d31951f3-279e-4d9d-acf2-b851d8f5b3e0", "value": "T1EB2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598974, "uuid": "712a1aec-66f1-4428-934a-31772f20f26f", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2ime:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598974, "uuid": "a9fd0d49-f88f-45f1-89aa-c674341cdeef", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598974, "uuid": "d9283849-5897-492e-ad78-0ede6c1c3e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598974, "uuid": "4c8c2479-c457-4c0d-8147-72a673d68df1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e04352-3b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776565957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565957, "uuid": "22727989-d148-43e5-b06e-7e389203df50", "comment": "Malware payload", "value": "6d334406d2916fa2656be99881695a5a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565957, "uuid": "64b68efc-d3d9-4314-b681-57b4ca91a479", "comment": "Malware payload", "value": "eacdbee73f13e2f6e28906f45f787400b94dc5b3be0017a8c4ff74506ac3aaae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565957, "uuid": "5394a85c-3af7-49ae-b9a9-0458449d2abd", "comment": "Malware payload", "value": "de41dc174bcd880e7bd664c62ef846edc0adac83", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565957, "uuid": "425f2e71-bf71-464e-a1d4-1c2825679572", "comment": "Malware payload", "value": "528ed2eb3f7f00a4c51791ea353bad59f3f8fb23462877df05348d43f53714721696a1eb5c6c7e660e7c55dcc3d49d80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565957, "uuid": "9ad15f08-89ea-4245-ae9c-7b86f11473db", "value": "T12F218916475BF24CF7FE8D34D50CD6260C205623C4D9A9132E8D27511555DE9454D2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565957, "uuid": "cd5acedc-9227-4871-be1d-3ada0317a0c5", "value": "24:9Odo3MKJ7AWJh2HwF0JZwt8n8VqHARfdGHZKPQq4DnHqxAs6d1:9z3beW+HwQi8n8TfQHoP/4zH0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776565957, "uuid": "aa1aee9d-ce97-4955-a984-3d2ff093fc89", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776565957, "uuid": "e5c06e6a-fdce-470a-919e-d39774c58db9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565957, "uuid": "3046fe63-1f69-4bf5-ab5b-907aeeb07387", "value": "19042026_0202_Doc_8cad60a7-7106-4c60-9b6e-dcf8d77f40c6.lnk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf8bfca-3c25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776626790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626790, "uuid": "3afaf4e3-59a1-48f4-a243-cb55a0dbc314", "comment": "Malware payload", "value": "5e56323a46f752fa528a3807a73c4467", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626790, "uuid": "386db1c3-81cb-4d27-907f-e77d5427f243", "comment": "Malware payload", "value": "eaed836b3832b27aedc12e2413b915d7b27128f5cadaec3f4745e9ce7cb14f4a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626790, "uuid": "e94f3980-8d91-4721-8860-bc09552a6dd1", "comment": "Malware payload", "value": "3a2c2dc3a3238d6cd3813720b3238a65787cbed8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626790, "uuid": "1ecc8bc0-8649-401f-bef8-9aeaafcedcab", "comment": "Malware payload", "value": "5e784ccccb84c4acaddfb0ef2b7bc24f64e53e07815a2d28a02d921730f8aab91f5d71f1837a1019675947e3bf495dd2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626790, "uuid": "fc9766fd-0bd5-4157-8ef7-64f51ab4a561", "value": "T14C161211F8AF2878DC479331D7854E31153D35C5DB0A3097BAEA8B0FA855AC6A34D3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626790, "uuid": "f759f51f-7a05-49ab-a8d9-fabc93807e70", "value": "98304:jKWzvC1twhaM+FBhdp2sVFsblE8iBr2TRzYyxevMvqct:zzaTWIL728FspCr2NzZLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626790, "uuid": "24ec2a8a-3096-4db2-aaf7-88f5b95f5cac", "value": 4371357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626790, "uuid": "c91775be-6031-4b63-9194-fd473d86f167", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626790, "uuid": "aca24bac-58b5-46ec-8e0a-71b01ee54f0a", "value": "GRIMV4.21.21x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d107d933-3be7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776600225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600225, "uuid": "b12d963f-e3e6-41ee-a85e-de97e3f13c9a", "comment": "Malware payload (Mirai)", "value": "c23874c9404a033eda6156024e361d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600225, "uuid": "b12bcd29-4a17-417d-b97d-ea466d2f652b", "comment": "Malware payload (Mirai)", "value": "eb8369f1d55c1b96d75c44e0d8c1a7d5563906d61e58877f672b556314f99504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600225, "uuid": "a3ca7324-0fa0-4048-af2d-e19917aa9258", "comment": "Malware payload (Mirai)", "value": "a1c66fa829461ab6b002d482f13bb9e5514316bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776600225, "uuid": "df94c2bb-2bb3-4a39-9163-74fa0da62066", "comment": "Malware payload (Mirai)", "value": "5068ba9ab7686310cdf56c7858f7095f78a5e203cc34a74adcfe0c1f4e22d492658e875f5c46d0ecded9b440f12a9d5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600225, "uuid": "50868fa4-d7e7-4b9b-a548-c7d25a300842", "value": "T1EC33F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600225, "uuid": "b3c77b39-6f4d-48bc-a156-67cc53b56f0e", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHJYC0QkiuVn4P:yHlPZMEcTFZ2A1HHJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776600225, "uuid": "ee62aead-e67a-4755-b2de-fdc83da64e43", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776600225, "uuid": "f318eff2-04d9-4ef5-96eb-e9db83c6e3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776600225, "uuid": "619c27f4-5754-4198-98ee-432d69395477", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bf12f6-3c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776635364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635364, "uuid": "70c5e4f5-5691-4845-9c07-efd3fe6ab9d1", "comment": "Malware payload", "value": "659f84a34477e6742ff788f9bc56b332", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635364, "uuid": "ba050a63-9d9f-4b78-b21e-59e6d3e50620", "comment": "Malware payload", "value": "ed2da930e99e9c7d4d75bdd2c18cd4329da066dda876c3b9591e57cb35e85ed9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635364, "uuid": "c530f2b9-3c55-45f3-b919-d29108bdeffe", "comment": "Malware payload", "value": "8a8a3664e9f6421d5e9b904e1ecc9bf5a811b495", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776635364, "uuid": "4a581e1d-8d02-431c-aa01-4abd564945d2", "comment": "Malware payload", "value": "f087b7a5a1751561bc24982582a1a9219f952d727ab46bea01b852750f9af21909bad08834cfef9f2b4df83d22b9a61a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635364, "uuid": "0154da32-6b73-4a70-8ea6-6d3a5555c763", "value": "T121450163E12D49DAED2B85FEF0003C123CAD46E5D10BBB2B25B4E99708D79CD9B443A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635364, "uuid": "4e5a96ff-ee7d-4604-89b1-d1b99c20b2cc", "value": "24576:LsUdx/j+R3ZqwaHmAorNlDgaC4VsTmXtdrOvcG+vy6T:wUnr+PmGAorDgxSReqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776635364, "uuid": "1e9f72b1-0956-4754-a095-05615c4a7440", "value": 1261708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776635364, "uuid": "e8499021-65ea-467f-8abc-f200c8a2b066", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776635364, "uuid": "d6789880-f733-404a-aff5-b89252889e40", "value": "4E Client 1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26ac35f-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586940, "uuid": "14007fee-3307-4e3b-9097-c3b6f89e5104", "comment": "Malware payload (Mirai)", "value": "e04192f57631625e51b64073f0b2edcb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586940, "uuid": "b00b6867-fbac-42f6-b72d-4ab0e05d907a", "comment": "Malware payload (Mirai)", "value": "ed3367ec310d9856ff7aacf229bf6a3dfc5213469b18e7dfb6309ec94992cf63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586940, "uuid": "0b5a4c1f-bcdb-4ecf-81e2-e99fc71e6d7c", "comment": "Malware payload (Mirai)", "value": "957c8255204a72a66207c4b216764e648ded1006", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586940, "uuid": "e569caf2-49bc-483f-85c4-3c461fcca15d", "comment": "Malware payload (Mirai)", "value": "0bc0543a9e7a471c6a6289686484c9e96250920e65883bcb3eb332ac0333628da477b48eb47a34f1256f02cb64e45f60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586940, "uuid": "8ad61f99-a636-44e1-af40-e53f62a88c68", "value": "T1B55165518BE54DBDCCE0627F1A6347687368EFC280C27313430C6D94AE237AD6E22D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586940, "uuid": "8d98ac34-3a2d-4cb8-9b8e-f66ccb72e8bb", "value": "48:qKGpa7UrLZLaRlP9BuHAAAeTtnAGiBDCB1nr4ezSJp5l:qKGcP9+ncUB1nrBYp5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586940, "uuid": "c1ef1a4d-3d60-4d87-926d-e955f57b4671", "value": 3127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586940, "uuid": "9e1ba921-5d82-4f11-9388-272d0c4b1e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586940, "uuid": "f1117c6f-c08a-47ff-af35-09d57b2e0952", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14f2ff5-3c08-11f1-a769-42010a9c0008", "comment": "Malware payload (CrystalX)", "timestamp": 1776614372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614372, "uuid": "96483b81-b8e3-420b-9f08-2122f9bb5a05", "comment": "Malware payload (CrystalX)", "value": "0086bd9d9053890e8ed999a4444e7b57", "object_relation": "md5", "Tag": [ { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614372, "uuid": "b336677c-ed93-45a2-8494-c59cdea9d4f3", "comment": "Malware payload (CrystalX)", "value": "edd7e88acbf5e866bf68fdb45d2dcb3fe19bb8c5014a4ddc65ff59703abd42da", "object_relation": "sha256", "Tag": [ { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614372, "uuid": "2b475a34-6e07-4c1d-8737-47f44332a0dd", "comment": "Malware payload (CrystalX)", "value": "ca33f55d44de5c97389785f7281c03050d7d6f33", "object_relation": "sha1", "Tag": [ { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614372, "uuid": "c4492d3a-740f-492b-9382-77ee6c5568d7", "comment": "Malware payload (CrystalX)", "value": "6cec62e8d14f770e8abc238ff1608ce08552c87ebe1a09837d1fc9b7bdc0cbcc1a19b3b201ee0f95d23f5bab3f72c30e", "object_relation": "sha3-384", "Tag": [ { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614372, "uuid": "80221bd3-bdd7-4437-aa89-d24ff18c6cf0", "value": "T15E663B07FCA584E9C0AAE63486639123BA717C485B3523D73B90F7682F36BD06E76750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614372, "uuid": "36ebefdf-eed6-4500-a052-77ccc28382df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614372, "uuid": "f65e2318-9ee0-4a0a-8449-59afef2c4210", "value": "49152:4CfZ2xMxdVmutxaoxczff90GUqJyimicGKMAMDBWkwDmCP8gFWpjcj8+iDa8Qnuf:4s85yViXKckkwUrYuKs2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776614372, "uuid": "b9ace3de-ac0f-4141-a6e9-3a6a8b075702", "value": 6916096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776614372, "uuid": "af26c51c-3e01-453c-b75f-f20e003680e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614372, "uuid": "40aea705-4ea9-4d60-be7a-e00c38942abc", "value": "0086bd9d9053890e8ed999a4444e7b57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551b5a4b-3c4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776642537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642537, "uuid": "97e3ec91-45c0-4612-9ada-c16b5a3bb8cd", "comment": "Malware payload", "value": "cc4b9480203dbe7e4a0e1c8b54cf2d72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642537, "uuid": "9e33e01a-11b2-49fe-a656-ec768f41b8cc", "comment": "Malware payload", "value": "ee51c0d6c584da4864f4756aaa61c800bf4b3e43acc2ef1aec5c5d19f8b4c9ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642537, "uuid": "1bb5c4cc-aab5-4402-93dc-d060c68a90f3", "comment": "Malware payload", "value": "33fd9ecd51877263a044e968ba079ca89006549d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776642537, "uuid": "27451391-30f4-40aa-9e6f-d36b6262f2fd", "comment": "Malware payload", "value": "e3093e75e45b930a6760df51f1de9625a525184ec75567386b67eeb8bf013ab8372b2be30cfb6876b2ab6d22b252a003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642537, "uuid": "709bc758-a898-448c-9330-e58b3df1508f", "value": "T1A34302F1D000DE59E336EAE29A4F9DD2B7E057892C84D883F089DB40554A2B2DB568CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642537, "uuid": "e09b3687-4a96-43db-a2b4-5bcf9de3836e", "value": "1536:4argnopXHLUUYT5exY8knQZVcrmA4MAujzH4u+qgw06WXH:4j2XHnXnkQZuH4MAunH4u+qgwXWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776642537, "uuid": "4fe96a61-5916-4458-be54-6bcf4a55ec22", "value": 56112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776642537, "uuid": "40f61a6c-4b29-4f85-b416-c9185b30a56b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776642537, "uuid": "7ca96881-3d72-4737-af32-f693f40b497b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6ad9d4-3c06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776613292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613292, "uuid": "e61b4d30-71bc-4fdb-890a-b7d97edb8487", "comment": "Malware payload", "value": "bfdb7d63d4f7a336223d86f61a2989ef", "object_relation": "md5", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613292, "uuid": "e4944fff-243e-48c3-ad25-3f058f79597a", "comment": "Malware payload", "value": "f0706aa4cf60a5f2056581091bee770e69b286c2a4ba003ef1ba43cc0bcde30d", "object_relation": "sha256", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613292, "uuid": "b11efe9c-53f6-4ae3-ad31-13037e929d3e", "comment": "Malware payload", "value": "500dc83f4bca49cd6c7aa7c6881b12a3f60f0e40", "object_relation": "sha1", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776613292, "uuid": "fd13de13-06f1-4d36-b3d6-d352f646af4f", "comment": "Malware payload", "value": "7a2d654e3d7a8da478fd2d34fc1b36b7b7d25a576fbb890ae39445cfb88c7eda175c7851eb32c4a9f7e93181a08318a2", "object_relation": "sha3-384", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613292, "uuid": "f3bce570-102e-4192-a9b1-57eeccde428d", "value": "T11BF73B427742D962D4540A7B8C9ADBC82371FD96EE06631B34C6B72F2EB66C3DD03885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613292, "uuid": "d4121ab3-126d-4df8-b05c-3d9bca99198d", "value": "b53d1ba3db79ee610b915a86ebd92d2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613292, "uuid": "ba9d3038-dfca-4774-aa4b-662856e0b08e", "value": "786432:aKS0huYvglTaQvXZ0uaMROe63unQXeNL+VerXl+U:aKSV/yuaMRP63unQOiYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776613292, "uuid": "6f4038f7-3602-4491-93e8-a99dfeb29de0", "value": 76870512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776613292, "uuid": "e1197dd9-e3e9-409f-bd0d-1a243e7520f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776613292, "uuid": "6a44fbc2-85a0-4a6e-aa4e-66c7f188b979", "value": "abn.866531006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b9ccd-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598912, "uuid": "228d79e8-15cf-4957-8bf2-d909b015eed7", "comment": "Malware payload (Mirai)", "value": "c0c4222c8f35b8ac9c1469456632ac7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598912, "uuid": "c716c950-d780-47e5-86bd-b68948375c95", "comment": "Malware payload (Mirai)", "value": "f0aa0295af1c6645bb9220696162925737701d64f9a4ddd26c5af1e7d5179d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598912, "uuid": "cb913538-d807-4088-a57a-6e76ff192ae6", "comment": "Malware payload (Mirai)", "value": "4f60c3bd6e1bbe24102a8cf7b224976ce2427aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598912, "uuid": "b02177cc-fd2b-443d-a2f2-c3a2d8addf66", "comment": "Malware payload (Mirai)", "value": "f3da2dbd3c087e7306a2fdbd4ea9856dcf5768e49001c7abacbd45989797bc52734c5ed18fb33f59fc5430507ddaa899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598912, "uuid": "fd3d8c98-cf7f-43ae-83a2-38d18624d78f", "value": "T173432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598912, "uuid": "18c2ae0e-33b4-4ed4-b882-15e2d1a6601f", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw6:RqtmZPuutfbltZFBSJsBcfDSTFI+BE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598912, "uuid": "fa1d679c-cd79-4a53-be20-95ea65657585", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598912, "uuid": "8cad8449-fc23-471c-bfc5-b178e0fce16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598912, "uuid": "a1967dd0-dbca-4a26-9a42-72b107a993f7", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391e7b44-3bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578495, "uuid": "1ecb0f45-21a8-4adb-a6ce-f1edf48bdedb", "comment": "Malware payload (Mirai)", "value": "0b0765d8ccb0fb1b86bd03def878b179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578495, "uuid": "74bdf003-33a2-4102-9084-10e8503962c7", "comment": "Malware payload (Mirai)", "value": "f1954784da42fcd176fd5af97040531e4ab108cea409ac07ec42d995d257aca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578495, "uuid": "95dcb053-88fe-428a-814f-24a2898feae9", "comment": "Malware payload (Mirai)", "value": "fbc06433fa9c2dd3dfc83170b4b2b7b325932bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578495, "uuid": "c1da7643-dd70-43f1-84c5-33f516211c7f", "comment": "Malware payload (Mirai)", "value": "f6247340b49a4b7ae4f6e9f231e91bab8e1af751d278e732630845bc83fd10e4de4dcdebcb07c09ee5308cdf781de450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578495, "uuid": "0e75594d-dd2f-4e4a-9d81-82cd0e1725e4", "value": "T1B4639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578495, "uuid": "03e518f0-e6c6-43a9-a86b-90292c2eea19", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udH:DYkwfCFlugsz9xznsxrdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578495, "uuid": "199f513a-cc17-4965-ac1c-a81fd87a17a0", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578495, "uuid": "d1f8678f-1755-48c0-9eea-1dddea8b424d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578495, "uuid": "4a81fb8e-8cfc-4fca-8028-31711edbd03f", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6a8b38-3bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776586957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586957, "uuid": "2e7d1dde-2e8c-47a0-b3c5-4d150001f97f", "comment": "Malware payload (Mirai)", "value": "06de2a65d74db4fe54efbafc7aab7805", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586957, "uuid": "28e04922-42ed-4dbb-9a29-4b0bb8c27d28", "comment": "Malware payload (Mirai)", "value": "f3311435a9084e3b06a832bcbd154f1aeaf18abdca2a312640e9de4c76168a0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586957, "uuid": "956be4ba-7250-4eec-ba8c-46f4318706ae", "comment": "Malware payload (Mirai)", "value": "c93996dab9a5a033f3d8f3157bc6bc8657a3cfa1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776586957, "uuid": "87b200e8-5db2-4baf-bf63-0c710d9b223b", "comment": "Malware payload (Mirai)", "value": "b4c618b564f312193f6208373da96e52eef248da3f7eae010a95d3f465b951664b522bb7d4f0ee781c2f05d71a7167e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586957, "uuid": "9b4fd8ff-03cd-4780-8542-a614f93bc07f", "value": "T1166131070BD02F77D896DE3713575B112BCEB42B50A157126328E8A47E2F285BED3E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586957, "uuid": "fc215e5f-d245-4af8-9c7e-7ce1acba9874", "value": "48:5t2zEzruDu2si6df9ouS8TLGPkuTLLUUUG1w04FtybZq:5tOQruShf9xSYLGLTPqt0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776586957, "uuid": "d22a6ffe-493f-4b1f-b4fa-e85f01e0f722", "value": 3330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776586957, "uuid": "62f1f05d-afea-4cca-8287-ca22655b7282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776586957, "uuid": "58e2d592-632a-4756-b910-c83f2faa6a1f", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a06eeb-3c07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776614034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614034, "uuid": "4085e45d-081e-4cf3-93bd-344d5ae35253", "comment": "Malware payload", "value": "af15afba2e38cb8fc9cc0475e7937d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614034, "uuid": "96d9d6ea-b5f3-4e44-856b-ac915d16320b", "comment": "Malware payload", "value": "f463df074c6a4e6eab7d22d9947865b1cca294b46444253514cfc6ece5304c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614034, "uuid": "833897a8-33f3-4765-8259-d99a63f4eff6", "comment": "Malware payload", "value": "5ea5796354344997bf20a4e8c89c4a4f36c1a3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776614034, "uuid": "d09bbbc6-dc14-4c15-89ed-4018a136cc17", "comment": "Malware payload", "value": "a8c9de64b675e9c5e48fcaa77a1aaf00cd3cf3994c43459b4d2596650f26e0ac6f8fe75da715e2c189d663e5d0a409d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614034, "uuid": "c3480842-f96a-47bb-809a-af9872600bed", "value": "T112B68D03ECA105E9C099D23189A39253BB727C494B3663D72F90B7386F76BD06E79790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614034, "uuid": "9e453f98-df1f-4493-bca6-14032cb96628", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614034, "uuid": "e9757f9c-d5ce-46b2-8d3d-1cd17f019f5f", "value": "98304:vzpha01sRxqyeb0eQBQFUE34Esjwgev/MIbJL+IMIr4oM:vn1MxrcQOlhsjwB/MIV+I5r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776614034, "uuid": "aee6482a-b535-45bd-8c6d-5a13a5081386", "value": 10489856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776614034, "uuid": "1605d8da-f44c-4658-9015-77cb7903bbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776614034, "uuid": "e0358c6f-8d99-4625-b730-9ff4e0536ff5", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb90019b-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598901, "uuid": "0de49ef3-b8a0-47e2-adfe-ac4c0ae0e907", "comment": "Malware payload (Mirai)", "value": "402e6391dde2641ca58e5f8e88bd8660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598901, "uuid": "c05fe085-8751-437b-8481-35a2c76cc893", "comment": "Malware payload (Mirai)", "value": "f4fd4798538fdf81187394775c0a5863e25f31e362fdff538a39f1fd071169b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598901, "uuid": "8c3969a2-165b-4c5a-8640-51ed481831c0", "comment": "Malware payload (Mirai)", "value": "9ee49ffdcd6d97e00d740305c1741667d1156cdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598901, "uuid": "6655e4e3-0ca1-4505-904c-a62d2e3b3c93", "comment": "Malware payload (Mirai)", "value": "2adea9a8b8df456d141988cc787f862ae82a19e0427a38888c6928d6d99e67a5afac436e9d36fba2af5c32af64aface5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598901, "uuid": "ba24846d-e19c-4c19-9615-74ee338791c3", "value": "T12A13F796BC829A66C6E0637BFA5F418D3321A3E8D1DF3257CC112B057AC991F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598901, "uuid": "bbf71961-cbf4-420c-a0e3-7e62876201bc", "value": "768:XP7T28mUGj57T7lq1dZuhfHn41GC8saIDoCerCIcW138vYPDX/heg3OgGytZPNaI:XjHm55TZ0v8sUcWh8IDX50PyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598901, "uuid": "c1c7ae53-949e-412e-b7c1-f0b0387921c8", "value": 42880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598901, "uuid": "3464bb79-d1ca-43bd-8c36-0defadf97548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598901, "uuid": "2f2f177d-696a-47a5-beba-35020aa6e67e", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c8393f-3bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776578354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578354, "uuid": "85d566be-5f5f-41c7-985b-d0477897d6c5", "comment": "Malware payload (Mirai)", "value": "eeb76e6e1ab969d3b78faac6861f95a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578354, "uuid": "e9eba86c-235c-442d-bf93-692cb17cd49d", "comment": "Malware payload (Mirai)", "value": "f526e1d1b7a9b831a8db797c8129f86c89df434d19baf1888f03545ae1bc7930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578354, "uuid": "bc1754a4-c2eb-4f94-a6cb-566d4dfb890f", "comment": "Malware payload (Mirai)", "value": "eed7e6c592f2c8b35d6a1a1828c5f28c8924acde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776578354, "uuid": "1e55918e-b7b8-4463-870d-4c9be9c12b26", "comment": "Malware payload (Mirai)", "value": "93e7b00d00a698b0be81da312d48c624030959537d55fed7234a67e7390738085a304513eab8729ea2c87a70cc8b6239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578354, "uuid": "8b3567fa-561d-4bc5-afa4-6c8f1084bbf7", "value": "T112E2F26A51ECB12CE45E903BC32FA98E31E65D11BE17C69424C476DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578354, "uuid": "752d3f7a-d8ed-4294-af80-9f45e59e8331", "value": "768:g32bRAqg2vQzSPMjFY8AFOEPB6ZSq7xnwNQBUV:DbRAp2v4ECF+FvB6ZSonwN2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776578354, "uuid": "5d3763d2-d600-4ea5-8f16-83bee8d70061", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776578354, "uuid": "d82a927e-efdd-4b48-824d-b9771729bda9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776578354, "uuid": "b81f9d4f-43c1-40e6-bc2d-f15107b1c5ec", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e200120f-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598965, "uuid": "1bdfcff7-b3f9-4aac-8652-c8813c76e431", "comment": "Malware payload (Mirai)", "value": "725aaea41c0443cd93a7b071995dc4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598965, "uuid": "5a81eba3-b500-4f0a-9eca-1c9106a1c323", "comment": "Malware payload (Mirai)", "value": "f554d8572d4abdd4bcd9d7e8abab3dd7d6dd9f4985dd9f35e91760a70ddad7b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598965, "uuid": "7536072a-9180-41c3-9322-c983fa0bfdc2", "comment": "Malware payload (Mirai)", "value": "e81901098863def9801c0c767ae24018822e7ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598965, "uuid": "4d18d398-fc16-4fde-aae5-8d027a535f6b", "comment": "Malware payload (Mirai)", "value": "fa7414e83a3287e9e0d9cb78a57c3f405784d157d4205369839dc9a39b0bebdc6f7f3c556b0b9b6f46924b031990bfcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598965, "uuid": "1f8a8b89-d512-4483-b5d4-c69b5b573808", "value": "T1A5630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598965, "uuid": "284fb621-5825-425e-a5f8-aac8d2a55576", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598965, "uuid": "b65bb8db-5609-4bc1-b626-d7f3ad78fa94", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598965, "uuid": "a7390224-08aa-4f83-aa15-79fc1ddfd38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598965, "uuid": "033bde14-52b8-4193-a3e2-3b057b63f26a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f499e1-3c2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776631137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631137, "uuid": "cdd16b15-b64e-4c63-9555-8ec326a38bc9", "comment": "Malware payload (Mirai)", "value": "ecbe24217a7aa5767f8884900446ff14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631137, "uuid": "3bcf23cf-600c-4a81-a2ce-3e29cd52fbf8", "comment": "Malware payload (Mirai)", "value": "f68eed03af13aac9c0db3cfcaeb8fb7378e00f2ea50407a50d76cd7d478875fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631137, "uuid": "c397daf1-0646-4bda-b15f-35f5b2604d62", "comment": "Malware payload (Mirai)", "value": "dce781392ab7cb118d1a324c8bec38f4fe292a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776631137, "uuid": "17b796be-0391-483f-9b10-6cdada2a9ff7", "comment": "Malware payload (Mirai)", "value": "2712f8a4382a7b5964a8ac60d1c6f866571085be17a35e68ef63f91fb39acf7f6f8914ea7d5d5f140bae22a501e2b3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631137, "uuid": "c9a8457f-75a2-4d1d-9659-21fe99a323f4", "value": "T170040A02B9158F53C5C22BB6FBDF46593B33671897EB3301AA18BEB42F4769D1E29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631137, "uuid": "1924e5b7-3edc-4398-a8f9-657b1b18c4fb", "value": "3072:9w9nRuvQ3Fr4SztCtAbeUqFKShTSp5wsci2/NGgbrmK6C5PHJnf5a0cXl7wj:G9RuY1r4Sz0tAyUmKShTSSTrmK6C5PH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776631137, "uuid": "89f22018-b980-447d-977d-48d358d63101", "value": 188183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776631137, "uuid": "0ef41038-8cee-48fa-8602-02ed7105d48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776631137, "uuid": "8bfd3c3f-37c8-4346-8a45-e8f20d0aabf5", "value": "mynode.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f6d49a-3c43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776639472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639472, "uuid": "59a4c316-1ab2-46f4-8b4e-8a42f60f9bb7", "comment": "Malware payload (Mirai)", "value": "d38d4f48c5b488b5fa45142e3877b92b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639472, "uuid": "cf64f3c5-932a-4649-aada-97053dc40367", "comment": "Malware payload (Mirai)", "value": "f7b5018df7a10260599ede4bfd67a8d5cdddc2d9d923f59e9796e326bf43cf03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639472, "uuid": "155f8680-c18d-4d72-9e7d-fc6230889187", "comment": "Malware payload (Mirai)", "value": "1fe9eaf5c0c77d053527b87334b7d0aa42ee6956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776639472, "uuid": "871bae4b-482c-410c-9031-02e8bfe1b20d", "comment": "Malware payload (Mirai)", "value": "40abeaba0f1867356553c3a26674bc9d1833f9f4c562c5060589d7f690c9495cbc01214cb92c4f4460d0b327e7038cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639472, "uuid": "1a373ac7-5f33-4b26-8d88-ee7a6520775b", "value": "T10E735C89F783E0F0ED4B0571116BB77E9734DE120124DE5ADB94BE72AD32A12A11B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639472, "uuid": "4a74d91f-d84a-4961-a4f9-760b2e992eb5", "value": "1536:QJ4idKemJbHcLiomeHotkV4jUY31fM41iOdiAzlr:Q3EekbHcL72tZilj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776639472, "uuid": "ed765476-fa63-4282-b240-f75355587e3c", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776639472, "uuid": "668b6ee5-f670-4e1c-a488-4886cd86833a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776639472, "uuid": "cc94527e-c2f2-41c8-82fe-1da22b4b9930", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd1e6d4-3bee-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776603090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603090, "uuid": "e1aaa248-28c6-4b5a-9d50-9260f7fae42d", "comment": "Malware payload (WeedHack)", "value": "d92c4d5352a3b9da1eb83075d4ac1aae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603090, "uuid": "8850f81f-7369-4542-91db-0287a34a514b", "comment": "Malware payload (WeedHack)", "value": "f918407cf4c75dafccfd5fe4a00e31faf13d7b47d1c7cd678da5974f4f991049", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603090, "uuid": "10e3d9d8-cf41-408a-b38c-e6342cc24fd6", "comment": "Malware payload (WeedHack)", "value": "bdff1dd090e5b4c021d1c1defee845a0dce8397d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776603090, "uuid": "459e880e-6499-45b5-9d62-7f31f54e8f00", "comment": "Malware payload (WeedHack)", "value": "e043b6760f72921279a2dba40dca828370e6ca059bd0ea77a4e9c5f854be483721a8c9cc16420595ffda7dcae6f07d0a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603090, "uuid": "810a2236-2dbe-4ff7-a895-8e6f5f658f0a", "value": "T142C2CF33A6D1763DED9F43B5638818723C3D178098C2E59F9CF0562E6AA36DF8784219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603090, "uuid": "e36a0c70-29ea-464a-a3d5-3295a0a1dc73", "value": "384:O3w9gnt3864fuC1EjT8t6gLXJrmw12KNj0g04walrqpd12yHYAx:A9nB869B8t6gL5rmGtNk4FlWpd9xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776603090, "uuid": "fd39058e-a7cb-453f-b0c9-4a39f8d76b10", "value": 25757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776603090, "uuid": "1a52d8d4-c7c6-4710-922a-55509a5d4766", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776603090, "uuid": "f960c54c-2cf2-48fa-b2a1-93a04ef9b107", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b6ee0d-3be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776598882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598882, "uuid": "6ad0b070-2807-4ccc-a464-f6d3db496da0", "comment": "Malware payload (Mirai)", "value": "fcc73cb5fcf7044c2195a077321a3a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598882, "uuid": "9aefa971-c3da-4de8-b7ca-8247ccd9fc29", "comment": "Malware payload (Mirai)", "value": "fb59556ab382c6aaf5504392f81c51b6bfd6903985633a3593d6def7b6abea0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598882, "uuid": "04a683fc-55de-4468-9979-444c6a1d65db", "comment": "Malware payload (Mirai)", "value": "eb60248300738d83bfb5c962113eba2f55e625d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776598882, "uuid": "3a112bd1-aa3d-41c9-8d34-3cadd058f321", "comment": "Malware payload (Mirai)", "value": "6d56ddc6bbd48c168223021b6bb8c62f82bed8a766259a3000956043bd87f7ee5c323147a092c45fddf25121388cf21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598882, "uuid": "5edfef1b-2bc7-4151-a88f-84208ba43a62", "value": "T185639409BF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F09E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598882, "uuid": "5d4b10ad-bf0c-46e3-92c7-d9712948b9e3", "value": "768:K+xGiJEEYlDIR99LYkLUAJtw6OC5f2eaeyWecfkoN3pkavdE5tXirnM+ufp:K+xGiJxYlkTpJJOCgvjWrfgrAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776598882, "uuid": "d1aded7f-17f1-49be-9b28-c3f2d3263ad4", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776598882, "uuid": "f9c1a772-5664-4762-a392-f4c52d28c7af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776598882, "uuid": "60419f1f-4d6d-49cd-9a45-ad9f689d4e2b", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6845463-3c25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776626783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626783, "uuid": "fd630f36-d2f8-48df-975d-b6b8d7053213", "comment": "Malware payload", "value": "ac90f4040c5f70b40f7383d4fbbec6f8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626783, "uuid": "26d4ad09-65c3-4176-af82-4f5d408fa494", "comment": "Malware payload", "value": "fdfb78bea8539b00528dfbcdc02a05a178ec05d36b5abe2b926c955422a9f7c2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626783, "uuid": "2528a7df-396a-45b2-bfe2-ee284b9678b8", "comment": "Malware payload", "value": "487739408286027b928c34d4f322c617bf34c8a6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776626783, "uuid": "e9f6c74f-c015-45fb-8e28-b6eb6d88655e", "comment": "Malware payload", "value": "31c516522723693d5311d139d961aea5a97b51fbbe271610d9f6462447ba818f71ef60ff12e9cde99d2141360ad603eb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626783, "uuid": "850e1287-2109-427a-b3cb-1452898d9847", "value": "T12D0633FB31196880D9903BF961FF5A77D4E4102B5118C80A8EF5A7C3DD7897A4B8EC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626783, "uuid": "ac07c280-87b7-4f69-a434-64e632748246", "value": "98304:jWhCOzHi4CT0oEHIhI2aBSdGyaDRx408GZ+l7R:ICOzCR0oTJaBysHJNZ+dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776626783, "uuid": "06892bdc-fcaa-4919-8401-aad852601bd3", "value": 3981298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776626783, "uuid": "4fc3ff8b-3c5b-4500-ab5a-144cbeba43e6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776626783, "uuid": "5f45afd6-50ed-4617-ab1a-5e9fd9ba0496", "value": "GambleRiggerv5.65Premium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db4deb4-3b96-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776565242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565242, "uuid": "de1751ac-99c7-43d3-aacf-afc53308403d", "comment": "Malware payload (PhantomStealer)", "value": "6735a5ef2e2f2ada480d034d9607065b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565242, "uuid": "42e9c690-9fa4-47ec-b94d-ffd5ec2e6424", "comment": "Malware payload (PhantomStealer)", "value": "fed0322d96d40315310f6cde1aecd85b64903052a07f4c055ecb359cc6d0e781", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565242, "uuid": "d7fe8b0b-506b-412f-8ebe-c128a3f83593", "comment": "Malware payload (PhantomStealer)", "value": "2fa1afe2cdc33c75c12fd5794dd906a25ea9336e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776565242, "uuid": "e61fa6c1-1a8e-4743-ae4d-30b1ddf3f12e", "comment": "Malware payload (PhantomStealer)", "value": "d90e589073244ce0e863f64d0d2352f7e8c913d3f874c9fc0208c451c873a3693aa8ffaa653d5a035cd861a17661057b", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565242, "uuid": "02a3379b-2153-496e-b920-12e50ccc7436", "value": "T12D73D7168A085FF4C9BDA272299F1852E5114392A775390EBA8DD4AC3F3E361CFC11F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565242, "uuid": "b916ea67-2f8b-4863-874a-7e8057cd78f7", "value": "384:uFdOwWjveYlKCh90xfOcK8ao893Z7g0R:u/SEYSxfOc6oO3+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776565242, "uuid": "8de6f0cf-ced2-470f-ae3a-f39870ba124c", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776565242, "uuid": "662c09dd-b707-4071-99e4-457f96561294", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776565242, "uuid": "c9679875-d3ff-495d-a9cd-11737c8840d8", "value": "19042026_0158_Payment_Advice.vbs.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }