{ "Event": { "published": true, "date": "2026-08-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-06", "timestamp": 1786060982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "761bc4c7-9410-4ab1-b43c-ed9516b1f2f3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d18537f-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786048932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048932, "uuid": "174866ab-7dd2-4bd8-8d76-039e2af41336", "comment": "Malware payload", "value": "79196a9aafcec301b1a0a4d48b69552a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048932, "uuid": "7426536e-2a02-45c6-8a8a-74215bfd1cf3", "comment": "Malware payload", "value": "0003e1b00b937c928c824e0505b6dc89db80fc0530e244adef086aca4f098a58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048932, "uuid": "a2ec86c5-ab68-4c5d-b1e4-da258edda3bd", "comment": "Malware payload", "value": "c225919cd50a153131e5b60d862420f0eb6d0616", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048932, "uuid": "360ca0a7-3ad6-429c-b31f-e278d59ec58d", "comment": "Malware payload", "value": "031ad15a6203724aaad6f7bf3c66692b7837c34d8f7f379d17cf76b3b8b3adb15f8d35c6c707cf4ad0a75d5d41b35b88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048932, "uuid": "14b6647f-7a7a-4688-84ee-310a14b78f65", "value": "T13B01999B65B0AC306865893CFD9746B0504B14176805290D749F7E04EF2CA4CF2A1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048932, "uuid": "cfc48be3-8835-4cf7-b223-25f0cf98d28c", "value": "12:Izzfsx80+adiLeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TaRHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048932, "uuid": "3d3d0130-80aa-40a7-b164-c77b1a30d07e", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048932, "uuid": "200ac1f8-08c5-4d9f-884c-746617dbf7f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048932, "uuid": "45686202-80b1-4ad0-a21e-094dd754d890", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1306e-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "af8ea2e2-5292-4e16-84d6-d80a3a2b62ed", "comment": "Malware payload (Mirai)", "value": "c2cea24ffceedaa47dabb6584d5374a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "d05ade2b-4944-460a-8d39-2d8a6778b296", "comment": "Malware payload (Mirai)", "value": "0059e1ebbb9675661c4c17194260806acf61de164e1d13da8241a4b9e1c19a0b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "a5613058-7b9b-403c-b22b-24b42d26ba21", "comment": "Malware payload (Mirai)", "value": "f11c35a7ed2cec8dbb016e594c1d33816505fd20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "c00e21c5-a153-4ea7-9684-8198cbf1b08f", "comment": "Malware payload (Mirai)", "value": "955934256907e2ec0daa999bffe9581589c1d9b6095df1ff78f9d7eeb29facff884a7af87c72956c4d6c85203a530f4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "2b176440-ac7b-4a16-b5ad-d54b35be7fca", "value": "T113F32A56F9819B11C5C156BAFF0E528E33231B78D2DE72129E246B347B8A87F0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "30d415ee-e290-477b-9fc7-2d9150d6991d", "value": "3072:5o0R0M1GwDMVl4kpMsUbpnn/B/tYNuuFaQJaHnGxqfdkqfzDs6W3BVZ:5o0R0M1GwDMVKqMswtp/t+uOayaHhfd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048376, "uuid": "a700e806-c1d0-4774-8dbf-9be5e1abb067", "value": 169012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048376, "uuid": "30ca0602-fea7-4c8a-99de-ef7f16306914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "856793a8-b011-4b6a-9a05-b3f2664d7287", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369404f7-9141-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785984469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984469, "uuid": "3f6857b6-84bd-4409-ad46-1c1065c46df2", "comment": "Malware payload (Mirai)", "value": "e139d42932ebbc5c05930158692d970c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984469, "uuid": "b007a0f3-cd54-4493-ac64-a42ede86a46e", "comment": "Malware payload (Mirai)", "value": "00b0dee9cc3cb281e4a53c33fa91b41d86004fb486b6af52ab809adcc74505d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984469, "uuid": "b10f05dc-fd46-497e-b132-e8d73377cebe", "comment": "Malware payload (Mirai)", "value": "0daefbf2bef680d2027d65ccfae78b805edcb537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984469, "uuid": "0814ffda-f14d-47bc-b4ee-f1305ee43a54", "comment": "Malware payload (Mirai)", "value": "646148835043a2f0ad00e1924842f34462b757c20e307e6d4a80ea203d0ea467344cc08e1a501fe8ae83460b75baa77c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984469, "uuid": "52bc3268-1390-4f7c-b060-ea303b405e88", "value": "T1B153F21B0DB419FAE7D026FAAD7ADDDA2942B7F49CB8A65133116F2C60C418347F44E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984469, "uuid": "65779bd6-3d7e-4f4a-8701-1ef4abff70ce", "value": "1536:t40V6Uke19LNL+n5tlGUShWkgshrx7muLjUEb9pzL+tk:tzR1dknZGzhosv7jLjUKLzLkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984469, "uuid": "8d69b726-9d91-4bb9-92fe-c2af0693ed29", "value": 63748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984469, "uuid": "56201707-8f04-48f6-b4cd-475b8109f803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984469, "uuid": "2b97a599-d855-4445-96cd-8937c8a83ef3", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517085e0-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005560, "uuid": "8d95ccc5-8ec1-44b5-abe7-62728aba8c4b", "comment": "Malware payload", "value": "1e67adec4c97e7e0c5ae845c3043948e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005560, "uuid": "de286935-5b2a-41e7-ac0f-3b8403bb8fbf", "comment": "Malware payload", "value": "00bd5139c999eb52f586b15621e306b48de4c5aac3db318fcfbc14af32802677", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005560, "uuid": "a084cb71-424a-4e77-b107-6b8533197ef6", "comment": "Malware payload", "value": "4fa2cfbac9b8b3e02f0d8caed810869991e86930", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005560, "uuid": "03ec681f-7e9d-4823-8e4a-ce5c4c0e666b", "comment": "Malware payload", "value": "8eb81ea77c38e3075943e415b5d3f484ef98081a30afee36b7a841c382b2ebfd6229262ed1f7907d79c914c24d0f9c61", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005560, "uuid": "2219d372-7acb-47b4-a4a4-32338c0c6c1a", "value": "T1C2410E1C638DA3B2E3F346334699B325CB62BC07E9A1AB1724E4178D5C136107A24D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005560, "uuid": "76c6c436-335a-4c6c-862f-55e9c20e4f6c", "value": "24:8EGFMSEzogW1P8wJB3c+/F1tEQJ5l4o0F1EC5gqyDOF1tlB5Cv/MRht1d/5zm:8LrEZW13JhxXEQeoSl5gqyDq1/Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005560, "uuid": "0b1b0433-557e-45f4-a65d-cf42591cd59a", "value": 2328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005560, "uuid": "c5841fcf-b940-4633-b668-9dbe8b44c091", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005560, "uuid": "643976d3-0f85-4e83-857e-c45429d4b936", "value": "Sales Authorization.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ec93f2-913a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981672, "uuid": "809feaa6-b64b-4413-a6c3-1aab76d11d43", "comment": "Malware payload (Mirai)", "value": "29e9fd70333a3096cfee71550538978e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981672, "uuid": "f8711a12-16ed-48ae-93c9-3c93b668aa2c", "comment": "Malware payload (Mirai)", "value": "00c19ed8f175ed2d4ac9381b892bd96a403e9d823a6f7d89a312c678b54a4b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981672, "uuid": "3c6cb662-999f-4600-9e74-96ffa2f5d47e", "comment": "Malware payload (Mirai)", "value": "c540db47b0cb5711ca3f7d7e119c40d6851dffc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981672, "uuid": "9061ba6d-8998-4402-9289-a3a3e87f52fa", "comment": "Malware payload (Mirai)", "value": "e9b250353038470ff561c22f960f146378db2084910c515b23a08d273cea0774de7d00e549c38977f69beeaffc6a07b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981672, "uuid": "d0153dc0-2c14-4a13-807e-3f2d7b4a5f0d", "value": "T10D637C07B68180BEC4D9C2B557AFD235E433B4AB6238B36927C4EE113E1ED116E9DB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981672, "uuid": "f7c43c3d-722c-4139-8621-6344f7085099", "value": "1536:TLQ6PXdgByEhzgpYnGPxKDGzp4Q2NGmjw3dQsKRu:46PXdsyKWK20GzmNGmjkEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981672, "uuid": "254b0565-9cec-4067-80dc-6f8a991103c7", "value": 71816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981672, "uuid": "1563c15c-3a98-4405-b723-90b777c5a9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981672, "uuid": "5b4dca29-55d1-4ef8-8aa8-1c775663f52a", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c489f0-913d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982837, "uuid": "469d9b77-1612-406c-9265-e4ce18c11713", "comment": "Malware payload (Mirai)", "value": "cb67e34f3ab7458e5ed30bb6bfa9fb69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982837, "uuid": "d724beff-ff16-4f31-b6ec-b12770794f6a", "comment": "Malware payload (Mirai)", "value": "024ee12e5b892c7bbb2baa1376f8b85c7c382e0c513071d0ed54b1187da73584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982837, "uuid": "05630718-5d2a-43f2-89d4-67ac6fbdd59b", "comment": "Malware payload (Mirai)", "value": "ac391f683252698a00d5c6ae31961a7bc5367f7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982837, "uuid": "93e1d47e-b9fc-48c1-aed6-ef1d6d2741d5", "comment": "Malware payload (Mirai)", "value": "cbe7bb7ad30f4d6e3e76356c42b5469d001965f0043b50e34d1e6f5398fb1d54e2a517511533851b38a644d53ed2861f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982837, "uuid": "db45bae6-93b3-4180-b4da-75833f76d3b0", "value": "T1216301AC2178052BEBC630B5319743992E330BD2B83ACC9EFDA5E28705F645EA4D75C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982837, "uuid": "5285ab9c-0198-40ff-9905-416dfdf6495e", "value": "1536:x/0wEgHjcX4IdsAcgoih/J4NE/ixFgp4gpXLrscvVEWOF:WwEgDgdZkGeE/iQOgBNvVE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982837, "uuid": "37c591c6-49c2-46f0-8773-f3d65900ceef", "value": 71796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982837, "uuid": "724ccfe9-0c2f-4f8e-ad71-d4311c1df177", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982837, "uuid": "d00a4561-9510-4f1e-bdba-ef95b8da7750", "value": "killbotx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089eb74b-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047958, "uuid": "8c2a2702-e9c1-496a-82a0-8af1e7d5638b", "comment": "Malware payload (Mirai)", "value": "554e7697ef055118924f1f6c75341d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047958, "uuid": "15c3fda1-ff92-4e08-a312-6a5595b9edff", "comment": "Malware payload (Mirai)", "value": "029a9fe07922bdb1b3c6652664fa18db3fd67f6ee154231f7836f3d3ade99821", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047958, "uuid": "e766b4c1-26ec-4ef5-9f75-41d0b4176b62", "comment": "Malware payload (Mirai)", "value": "efc6cd35344c5946eb7d9ff978564b026189edd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047958, "uuid": "21a22bde-5da3-497e-a826-cdcadda67d3f", "comment": "Malware payload (Mirai)", "value": "eefe95063876310074a0e8ae11c88b1676fcb5a1ac821117c3d6fa15071b6f4c8cf2dfe4fcb418f259a5a40fa22d6c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047958, "uuid": "8ebd06d8-fb20-4a0e-bfdf-63390ceeda9b", "value": "T1E3F309C7F900D9BAF80EE7374853040AB130BBA114825A776257357EED7E199187BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047958, "uuid": "aab7fb13-16b8-4c47-b68d-344f83b926a4", "value": "3072:To3vHXAFBLbA+Dn5yzaP3Vx82OykPP4A+rs1nVKjbiiLrwyWv65uT:Mv01lyzY3Vx8PyBXs1oLk/WuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047958, "uuid": "b0d75402-b210-4537-aa49-bb837b06c69a", "value": 168536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047958, "uuid": "6458997a-52c7-464f-af37-6141c5544ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047958, "uuid": "c3fd148f-1fd2-480e-b6ee-6e731cc31284", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230f0418-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057451, "uuid": "8763ed81-be36-46d2-b5fe-86b4df77422a", "comment": "Malware payload (Mirai)", "value": "89baf2d890053bca95badcf9dd11be7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057451, "uuid": "93f80240-1481-445d-9eb2-a9534f974c10", "comment": "Malware payload (Mirai)", "value": "02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057451, "uuid": "7c3a2bf6-a5d2-4ce1-8ac4-40c1da995306", "comment": "Malware payload (Mirai)", "value": "544037e43ac570cc596b28b8fbef19c3af70e154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057451, "uuid": "206cf9a5-56e3-4ef9-ab64-c3fc80bf6a60", "comment": "Malware payload (Mirai)", "value": "c8f313d22fb887ae921788bb0150374d7845cc55cbd10a0aa654ea83b84de3d15d4d0ed05aa7cc33919d736bc6105caa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057451, "uuid": "d90ddf4b-5bff-40c5-a844-dd01e8c9129e", "value": "T1A54301DD9712EC48F53419F7DB318093C71BA7798EAB94743560122EEA800E56EF48DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057451, "uuid": "4ca59371-7d8a-43d5-9e22-465571a4d854", "value": "1536:1ULjqNXTXZwRjSoSPBuiq/8qdqalRH+5OZQAiyfc:AjqBD9aq5Ogyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057451, "uuid": "eae113ef-7b36-4c9a-abfe-f53fddfd4032", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057451, "uuid": "c8b4892f-be45-4580-b2d6-e10a33898c76", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057451, "uuid": "e0ade03a-339b-4817-9dab-4654d3d7bb44", "value": "02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac8923-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786026896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026896, "uuid": "dcc9f40e-27dc-4c68-b27b-613eed6e8f8a", "comment": "Malware payload (LxBaseRAT)", "value": "5b468ba31686cfbcfec1a01304418317", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026896, "uuid": "559ef428-5e50-48b2-a9fe-76bb011a4c7d", "comment": "Malware payload (LxBaseRAT)", "value": "030c3104e36b6bdb5838a195543eb1b6c06b1c91602d9779d83636df48cb6e79", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026896, "uuid": "c4463e58-a37d-430f-888c-d42aff5124d1", "comment": "Malware payload (LxBaseRAT)", "value": "4b7bd0efccd0d8bd7ff20ef8035c788d5cf7de23", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026896, "uuid": "ef2997ec-cbeb-4502-b3f5-778e6e52a99b", "comment": "Malware payload (LxBaseRAT)", "value": "4e6665c57a320fd0487a9a77856ef0af188413f9b844fe9363bf550e4ef1bef8478eee5de3faaa03b78f5e070ccf64c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026896, "uuid": "0e3d5923-61d7-4121-9fc2-e9af92dfc616", "value": "T184A5C778E87B6EA02D95E51E8BC6D8661A729F434DB3F7DD405FC3E609323309AB1850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026896, "uuid": "4406aa4c-1914-4a3c-9760-8f2b0f58b5d4", "value": "24576:V5k/3Wk5xAJLxog+4DhWNP01ZG/2yrP6k95Xbn5D+7/l0n898vi/u+LKQUoOc8B+:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026896, "uuid": "78bee93d-b74c-49b7-b787-b5ddd489763f", "value": 2066934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026896, "uuid": "7b9669f1-0d37-412f-8100-83448818dbc7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026896, "uuid": "ed5a2d1e-7791-4f8b-b980-892a3f1b456e", "value": "Project_PYLD_EF38B843.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6343b36e-91ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059277, "uuid": "e49db6b0-b923-4df0-8ed9-531baaf877fe", "comment": "Malware payload (Mirai)", "value": "7ffd140909c5ca6c7f14d86f79ce0911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059277, "uuid": "efac5130-6a97-495c-a459-0e7c6e1ee470", "comment": "Malware payload (Mirai)", "value": "032f7dd5999ef63685afcf7040a3cde9fbf010efa507fdfe3f17d7630ce128de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059277, "uuid": "b10dfe66-1cfd-4631-883f-394616f8b1c7", "comment": "Malware payload (Mirai)", "value": "91c1de174e5c968a0e009e09f605f97f888e6a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059277, "uuid": "55946d94-b3bf-4c1a-b9cc-647247286385", "comment": "Malware payload (Mirai)", "value": "0c74b4a6eff2f6b2853577991793bfb07b1d0bf7bc6f631fa9dd89a95def850d6d747db3a93bfe4bab8c3b9d4c9a48e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059277, "uuid": "730e8fcc-1f32-4e5f-842f-c188721cdbfb", "value": "T176148D01FB081913D0935EB45B3B0766E379D88318B9E019190E7F569733AFB9AC7B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059277, "uuid": "4ed51674-b2ad-4780-918f-98b648e53273", "value": "6144:/hyVd80rgY0BpUrmIQGAIOiYqQdn8l6uN1S:5N0GUyViok1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059277, "uuid": "b6d95417-7ee9-4400-ac67-a8be3a16e130", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059277, "uuid": "a118c59a-639d-4a4a-8dcd-244c096ec608", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059277, "uuid": "b8ed6387-fc49-4c16-944e-a43b57c2ef0c", "value": "b82828da08e4b971257f6091161f0dbcbd350e000f99bf40c967b7348e9045d4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bc35aa-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786045000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "64b31465-806a-4444-b92b-c0bce480fecb", "comment": "Malware payload", "value": "1ddb465a9a90da8264aea3161eeaa72b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "d49b3fa9-7df5-425b-8455-812bbdc41bcc", "comment": "Malware payload", "value": "03fd0b0dbd4829ab826f8d58c63274ff84075c4bf45f092b32040ec71a30478f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "fd90a098-a157-40ea-9fc6-855a4c526ccf", "comment": "Malware payload", "value": "c8e1d956c5865f5cfc19780e2ba9723119c2bd8c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "12063bb0-1a6d-4b27-8ca8-fa5076d5f5eb", "comment": "Malware payload", "value": "db3d8f5ed620eb9d100d83798cc492b20c803e81357eb934c46db6243e58ec25741383e1c68b12b87919bdc0fbc9a5a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "a9351bf8-7e3a-48bb-9c5d-eae90a88e6f0", "value": "T1E5D0A9A152312F12AF008B0A327AC9612843398B804A208CF0E4CD545F8884CAAA2B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "bf4be16a-9785-48ea-81d1-1ca31cf13f43", "value": "3:QFKIaM3BFDzCLftN5FaNYLftN5FOaOOdhHNJ+vyIRwC21LaUnnyVtNJx4nudFc0s:QOSB1IdAYdUaZ+TRwC0WvPdAFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045000, "uuid": "90758e72-cbc0-456c-8c89-397b50f8e129", "value": 208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045000, "uuid": "b291c9d0-03f2-4d35-925e-3423dab7ece0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "410e9e3b-9173-4073-aa00-ceaa4b10b32b", "value": "traff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec67d81-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045552, "uuid": "a6b7a637-d006-448b-9df2-c3a5e2ab6465", "comment": "Malware payload (Mirai)", "value": "5942f094b71d73df6ef83b79cc2270fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045552, "uuid": "880dc812-594d-4db9-aa9b-e0ee291abd8a", "comment": "Malware payload (Mirai)", "value": "0445fd6c053aada9ce891e8b1a8e7e7e274760aacbdb5fede88b7dfd763f3158", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045552, "uuid": "7978abeb-fd97-4519-872b-c9a37271a078", "comment": "Malware payload (Mirai)", "value": "b664084ac0ea9eaa5a73f430a88af05c4acfea28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045552, "uuid": "bda18b36-3dd0-4f8e-9ab9-cac2ef208602", "comment": "Malware payload (Mirai)", "value": "95a9d14caf0c7fdad9261543d274cb8e35f4462f62a8cf11b260ffee2fa88ebf35de728fade948f5a0115bf8b8619d83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045552, "uuid": "d1bcae4f-2f58-416d-a047-2fdf5f98e01e", "value": "T1E2B3C506BFA11FFBE89BDD374AE9174528CD541A25983B75BA30C418F68B60F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045552, "uuid": "4e7d8a53-005e-4160-aa19-22348b217109", "value": "1536:DzavJr98UhFtRgnUUTMO2yWEBbDjyZvLBohUov7vv:DzSH8ytRgcOHDjy7Kjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045552, "uuid": "6192d070-4937-4347-b5e9-fb3573e58d0d", "value": 109252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045552, "uuid": "6af0d4e8-0876-4f10-afd1-00128e128fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045552, "uuid": "56f92b0f-59d8-41ab-aec2-e48e90d7edae", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a259eaf6-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786026741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026741, "uuid": "ec1098e8-bd15-4cd0-bc16-e63afd5b70c1", "comment": "Malware payload (MassLogger)", "value": "2238353c440f5b5f0481553b80198ff4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026741, "uuid": "d80cd8da-84e0-41ae-a294-fdebccc5a9a1", "comment": "Malware payload (MassLogger)", "value": "0466815759a6b6ab8ead1eecfa7e55ddf3463f48a38566088ca46e8d280c3d6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026741, "uuid": "f2328597-449f-490b-ae1f-9d9e9c2cdfcf", "comment": "Malware payload (MassLogger)", "value": "60839d4eac0ecd5659dc28e8c5b3c32cdae85df8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026741, "uuid": "7d6f12f4-0cdc-4307-a98a-279933eac6a3", "comment": "Malware payload (MassLogger)", "value": "36403795d68cb3a7496f3433a93e826e4c2a2a1e24396d63a1d2cc8b6cff1290b20d196c7ca10b260c4425eda0b14608", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026741, "uuid": "2191002f-9d0d-4007-bba1-8ef1e5a63013", "value": "T196C5F99233AD9D065A6A3B9898D514484F6E563C2BD369C4B2DF0EC6970F44F3AD0C3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026741, "uuid": "13384758-8c42-43d0-9d1d-6ec66864832e", "value": "24576:hNEn+9UrtOCRJ2mTzJ7mJ8clRUXS4ejk2iao2CUwIyu0Jn5:YxVSk2iao2CUwIsJn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026741, "uuid": "7fcccc15-0e34-4c93-a8db-5f7866e2d2e9", "value": 2518094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026741, "uuid": "0619aa78-3867-492a-a90c-3af56447e4ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026741, "uuid": "e1b56005-c40c-46c7-9f18-eff1b03cc22b", "value": "Quotation items.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51797777-9134-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978931, "uuid": "e858b103-aa08-4caf-a4bd-c8210874e2ec", "comment": "Malware payload (Mirai)", "value": "e9e12b3a8affedf5d9e92b40ca3f1e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978931, "uuid": "d67cc81d-f90d-4fa3-a804-b02ad8542c9e", "comment": "Malware payload (Mirai)", "value": "049768ce81f1310f8bab20dc015e9dc515c390e53ad3479858292c4f68fdc3f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978931, "uuid": "7ba00c8b-ff3d-4cac-8403-f1b0aee10c59", "comment": "Malware payload (Mirai)", "value": "7f4a938db3abbb33d3958759fa3dc2b87787e49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978931, "uuid": "53bb9a73-83e7-4bc5-86b1-223a2954a20a", "comment": "Malware payload (Mirai)", "value": "cda8d80e387a5162ea7e7fb09b7e94c2db7846c8f74fcc84d4bfb9a9f1fcc6d237732c1e1c53887c17c2e486a680f482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978931, "uuid": "2414519c-9798-42cb-8a0f-1931ab412527", "value": "T19743F29003C2BD92D4C5B27E8B62D151BE85FCBB34E0E1BD2825DB8CB59C974B13E819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978931, "uuid": "862fbcf5-bcf7-4e5b-8745-0d1c73cbc1d1", "value": "1536:BbqIvgFeFmU0CrjGQULacdEZ2OVw4mNDLYNDrTSOQ6y:B2IYFiIKjnAatZe16NDrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978931, "uuid": "44e61ffb-74ba-46c2-89b5-ec54b7d4a305", "value": 56356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978931, "uuid": "8faf7c21-5c3f-485a-b1ab-70e2caab65c4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978931, "uuid": "ade45766-b0ea-4482-9fe0-93b5db2fe26d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257fc8bd-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786045000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "78c4ba09-672e-4fc7-bccd-d07625d8db50", "comment": "Malware payload", "value": "ad52f8863d9d45a44eca0b89f0a0520f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "13106c55-a2d0-4675-9c24-bbc5cebb88d9", "comment": "Malware payload", "value": "049f300e4ff0f302f770fade35b547dd8ec8ad1e1ef44f2bb879dae917cd2dfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "f95ee613-5ec0-4ed8-979f-43120b195dcb", "comment": "Malware payload", "value": "de30c096850f9eb048514265e72dc893fee4c845", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "5a91e85f-d2aa-4569-bfcd-fed87cf354c9", "comment": "Malware payload", "value": "572f4bb9e8c89cd9a75f7911f8445cb87d256173fafa11096a6c5e6c5a6feab699946ebef6774132a009892acc2f3d10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "26ee5f1a-3e60-4454-a794-c52e8e00f36c", "value": "T187F0249307267F7C388335D0E06A4091A2A5A24951FB6A706184AFFAB449044D7BDE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "47c99a67-2efe-4729-a774-8a31e3c28765", "value": "12:geKc6VSCom0vUiRoy1v0QOnrMziaXuaqRHwntawSD/rgVHxJNxhIJlztHKw:g260mOD+nl72tg8rrIJLHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045000, "uuid": "e0af0b8f-62a2-4fae-80c4-365e59066e9f", "value": 627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045000, "uuid": "ae1d939d-d650-41c7-8439-1a06cd6d6669", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "1415680e-87c4-49b2-8641-0813b2b8bf42", "value": "oldercheck.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910411dd-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "64ec3363-e25b-4175-9032-de19ac2743a1", "comment": "Malware payload (Mirai)", "value": "85348e8a0e04e44a50f37df1e59aa03d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "2802a355-ccb0-4cb6-bd5c-38b807cc76d2", "comment": "Malware payload (Mirai)", "value": "05ac0fb18867806efaa264b1f01deff14a978c38a4849b78dbb05206b299b620", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "738f58d8-264c-49f4-8233-306a6521f1bd", "comment": "Malware payload (Mirai)", "value": "8dd3f9e820d672fdc18d45d1e6cd67ca532a13d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "67916aa2-89f6-4fb8-864e-e273190eb52c", "comment": "Malware payload (Mirai)", "value": "44e85a153a74fadf66ed8d0a0e54f438e8b1d49c65c95dc2a5df2a3e3aba1e03b61ca0a7ae9c8a364625e1ac312e5613", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "06c1668c-4d71-4ae7-8a85-0822af0873a1", "value": "T18A742988D2F1E3DEE158EA7563207C1A5C72463B3097B28A719EB97713A71844AFDD30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "910d13d0-52c4-4bb8-828c-67566f44ee4e", "value": "3072:o+WD5Ud5TTCa8U2cn+xaSpkLgzNUZE+gYOyfFR7aPGDkEs43IIuBZ1POfyvgw0+t:o+OiPl8R6+xXogL+eyPaQkE7+a9ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046469, "uuid": "f4c0b2de-79a8-4d7f-a2f0-b4f885d15ad5", "value": 349808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046469, "uuid": "48f1c065-bd1f-4f7a-bc18-f76c78af293b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "b34446e2-f9b1-4c85-8b50-b3dce5131314", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5471ae2c-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996116, "uuid": "a2d44b4d-5dc8-4fb1-aa56-91cfb082c4f7", "comment": "Malware payload (Mirai)", "value": "945ea1f8013b8327c99941f4f3d279bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996116, "uuid": "dbb694ab-db06-4826-8f38-193b9c4892e7", "comment": "Malware payload (Mirai)", "value": "061c95f6e18dc10f64c5bc442084e7333fc56462bb0da197dd15f9ef2efbd0c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996116, "uuid": "ab901989-48e3-4d64-a506-ea61b095f8e2", "comment": "Malware payload (Mirai)", "value": "740a50c6415a31b631f8c8e63c5cc3a03802f6e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996116, "uuid": "38eeea94-ba53-438f-84ed-c1bb57f8433f", "comment": "Malware payload (Mirai)", "value": "71089b636cf81804779fbd5efdad69e7337ce1d8f3a51f43063cea7b7c0f9920efb7858b1e242ae0356d7da7943d1e13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996116, "uuid": "6bf80a3c-1dfc-4d7d-aeda-2b6da626204e", "value": "T12BD34B13A48080FDC49BD2708B9FD137EB32F89912347B1E2B947E612D36F616B5A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996116, "uuid": "08ef0259-a5d4-4916-a7a0-ba68b37488b4", "value": "1536:9tKyoeXKPXUv7lRa9Q6tBgqEZriZmgD8jUmcb0Va+3UHoMRZJMy28eNqgRM/+sIp:91osKPXUvHqhjZPxnLd+4OsIPIiXbDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996116, "uuid": "28f85b30-a643-4804-b8f3-b99f85aea7a0", "value": 137344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996116, "uuid": "053831be-498c-4ea3-9a8f-a0145a9b9378", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996116, "uuid": "4711ab22-95ea-4b5d-b77b-c435f30659c5", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6623948f-91d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786047256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047256, "uuid": "5f9127d8-81e7-4ef3-9214-fefd65d41494", "comment": "Malware payload", "value": "3ee030af42ffb6bbad6511bbecaebd53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047256, "uuid": "74b9eb91-06e8-4552-96d3-6d5b94d7aace", "comment": "Malware payload", "value": "0641048b566138dcf16a7e27227d99ae1d81d3017ad1b2c97deae27f0376637a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047256, "uuid": "b558d5d2-5f7f-4f3a-8c29-65bf90b24835", "comment": "Malware payload", "value": "217244615b5ffcf76e0293e591dacb6d39a90337", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047256, "uuid": "c70707e0-e4b6-440f-9f87-d5ee4922d0bb", "comment": "Malware payload", "value": "b4a94c95571b53036e350c8ea29c157b969874932a595a6e393f1bd0748f58b27f9bdfdd429304041e3e9edbcf11fb72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047256, "uuid": "7ec7ef26-192f-4500-98dd-a87d791735d6", "value": "T14C4101DA66A20D336FECA9EB33A748847DC5A2DE40C79F456ADC7CDA40DDF186404683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047256, "uuid": "08567a48-0299-4801-878a-1b0cc03d0a17", "value": "12:Gn0F5nsi0FJe5M0F3T0u0F4Zgv0FnNIrFS0F/30Fj7G4Pv0FgO0FWOv0FRLTL/i+:15CJC3wr0rnNIVknU8Q23UwZKxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047256, "uuid": "d5778202-5846-4356-aad2-14dae82c2c26", "value": 2145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047256, "uuid": "794a13b5-aa5f-477b-9338-fafe09cb5f71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047256, "uuid": "431fe521-ad93-4a49-a856-37df06754de9", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bff7f9-9170-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004977, "uuid": "c6dc5ee2-2288-4e79-93c6-4a894c0de544", "comment": "Malware payload (Mirai)", "value": "7aa0913b2a06f24e717d88d8b2ebf734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004977, "uuid": "a2253b52-c8fa-4967-836b-a687cad3a0bc", "comment": "Malware payload (Mirai)", "value": "0663605009e6a08c531bd44d9d8b0f5272526562d7401e4c209ab69e1af18497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004977, "uuid": "b9279955-b581-4bc7-a2af-df3687d3530d", "comment": "Malware payload (Mirai)", "value": "e475afdaa6c8735c043b91847bcb0413d7e4d9d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004977, "uuid": "ff64c770-2e85-40d9-8d95-448d5f695281", "comment": "Malware payload (Mirai)", "value": "745198f8ba3f446e4a48c28404ac79987f71adbf85489369c3949f9d72bc0b833e969e3aa91adebfb1f35a4d4380b5fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004977, "uuid": "83a714ea-9b66-45c5-9f97-1d0383d390f7", "value": "T13F6302CD5B5AA0ADC7C08934AACBC4B9532179B1F01D9A9E1B843FEFF744495BC13A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004977, "uuid": "be21a9ca-5449-4876-b9ce-2ddb0d6189dc", "value": "1536:iMr/STC1gklUiBVFsf5/tv8kxrdN4okKmtLfPYEYeA7vyl6Vspfyh16oSOQ/:iMrF2kpBcf5/tv8kvPT7y8s5m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004977, "uuid": "d20c75a8-5769-48f7-9c2e-11bbcee1ea99", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004977, "uuid": "bc0da6c4-940b-4ceb-80ea-e8ad6623c7e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004977, "uuid": "e364793f-ad92-43f7-86e2-44a2bba211d0", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.4217.5597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef0eaf6-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005421, "uuid": "87c3f98b-f9a3-4c91-80f7-9398905b6a6b", "comment": "Malware payload (AgentTesla)", "value": "d0d04dbf67eab4f4c012162d61f24506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005421, "uuid": "efbcd4a7-1d14-4669-8515-d986818fd106", "comment": "Malware payload (AgentTesla)", "value": "06794e18354508e7947328b6592347a0a813a062bf3510204dab94af03dc4ea9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005421, "uuid": "adc48705-e6e1-4215-a13f-72c43cb5e475", "comment": "Malware payload (AgentTesla)", "value": "7dcd07ab741622a867437a544ec2b3e40647a611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005421, "uuid": "de8b1df5-9fff-47dc-9f7a-e990597498fb", "comment": "Malware payload (AgentTesla)", "value": "96f37cc568b3405dcd7398ea21899110300da0a26b3f4a1d63dfe9221853d5f84cbcc9b8718bb295969ae6cf2eb4ad5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005421, "uuid": "6df887a7-ad10-477d-8a37-406b4be256c0", "value": "T13255D8B8BCC57491A99FD773E3C5ED7C762316E7060F5A08029D43E9165BB8AEF0480A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005421, "uuid": "829d8ec4-6739-461b-81f3-09b5def8fb55", "value": "6144:r0XQXNVUeCo+kRWZmuWtuW4KwlJFgY9mdMZwb2wnk/MY1c+whbRG+TzN:rqdkqmVfYEYodjkkY1cVhM+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005421, "uuid": "2ae0efcc-5f80-4dba-949e-ea3563178791", "value": 1318945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005421, "uuid": "503d2c35-204a-4cf3-84ea-bd80a1109f8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005421, "uuid": "482a231b-42fd-4e80-b14b-150397e82cbf", "value": "Payment Plan - UNITEX SOA JUN-AUG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b119b-9140-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983977, "uuid": "d7da756a-6443-4fad-b40a-a939d681046c", "comment": "Malware payload (Mirai)", "value": "295f892ac5feb6333dc52ae20eae8a85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983977, "uuid": "54bc102a-35ed-40b8-b4f2-4c8b1299d07f", "comment": "Malware payload (Mirai)", "value": "07310b71a33cb76729daed760d08efb079b4591db5b62c647e4deeacb2556e2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983977, "uuid": "8dcb221f-48ee-466c-a42a-9582b54b2e05", "comment": "Malware payload (Mirai)", "value": "7b34ace5b1a37aef96f8cc99570051af7bfc4f96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983977, "uuid": "1280dcf1-48e9-4044-9e57-65eefa131cf5", "comment": "Malware payload (Mirai)", "value": "6f8a5df45fe6a3ee6c45f780184d8568ef0bef4824ef1d2b339e51977ab18c139f656ba13a0ae9806db66b71e779c247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983977, "uuid": "52ea26ee-25e5-47bc-854b-c7f1c185cd7e", "value": "T1FAA34D02B49180FED49AD174879FD137EB32F98512347B5F2B847E312E36F222B5A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983977, "uuid": "171ce7f4-2e83-4afe-98f0-31c95d3b7eed", "value": "1536:CxAXe0QXW3LFgkogUKqfVKl1KkzS916LKtZWw+6ppxd9iZrQbInyNLor:y0SW3WFs3wkmOhC98Ubmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983977, "uuid": "8f4585df-ce4b-4686-b65a-169c572313d7", "value": 104568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983977, "uuid": "e59f4013-4c7e-4233-b994-bdeecda59051", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983977, "uuid": "cad32846-caae-4aa5-913a-ff4584f99d01", "value": "killbotx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd36c0aa-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "6b3abcdd-eab1-4053-a9f6-598242118347", "comment": "Malware payload (Mirai)", "value": "6921eaf7296eb63829723ded939425c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "b77d4a75-75ce-4ebb-be22-cd46fae770d1", "comment": "Malware payload (Mirai)", "value": "073fefb795856bdf667afdf377302d94198f09f25e64d05d337603fed1092456", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "d2a1d341-c239-4369-93a4-3f28ead0d324", "comment": "Malware payload (Mirai)", "value": "ce256fefb2182ab04094d819f53354ab88402bb2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "684c120e-e870-44a6-9d4d-a956d97cb7af", "comment": "Malware payload (Mirai)", "value": "ea12092737f4fef0b91bc7c6e15ba41e391604010266c3b92ce7d71d4cd312d21a8ca5f6a9885440c82cdac87b7918ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "8150604d-33bd-488f-8b3f-82992227b2fd", "value": "T1F0344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "b4da9e26-c319-42a3-b94f-ad2a0f5e0f5d", "value": "6144:W8tTPA0OBzabKacEK1dAnJd7rLfdfM/9hWfAU:W8RAVBzabKacE62JFp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045738, "uuid": "ac18df29-f577-40f8-9780-5a68f1e6d066", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045738, "uuid": "342a2088-9fad-44a3-ba44-9fb2c33bba67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "94829fc4-2b1a-4ffc-8879-81d459c57d1d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd121ac7-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004076, "uuid": "76f93be1-c142-4a2f-949d-3b252a9c9ee9", "comment": "Malware payload (Mirai)", "value": "dcb2ae8987fc4ac6dcc3c338d4fa4743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004076, "uuid": "8f5eca5c-d80e-4945-b617-80c6a2013405", "comment": "Malware payload (Mirai)", "value": "0843c782ce8eba71b3a1791ccaa33d88bc05a3e337097a6e7522c907c161b5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004076, "uuid": "6f23f1c3-bb51-4246-b06b-7c1036cfe94f", "comment": "Malware payload (Mirai)", "value": "2ebce79cbaa4fef8a31ee9fbeef23ebeb2cce1de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004076, "uuid": "d8b5cdd9-28a9-4545-b362-82dc81f72287", "comment": "Malware payload (Mirai)", "value": "82bd488e4e8b6a5c473a1fb834e57171c7ca101457f3407d678c6f0e45c8747d4ef530034f7224783460910718f785a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004076, "uuid": "7ea9d855-43a7-49c3-99d3-4a74a442d899", "value": "T10253A50E3E629FBCFB6C873547B79E319688339226E1D545E15CEA005E7030E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004076, "uuid": "9a663afc-2eca-4570-b2bf-f15f18596c17", "value": "768:e59JMKPW6Dc9uZ5kVralD1ZGrzEA//EADewOERap9kgRmWfDM2XZom0YBSweVsgE:aWIOelD1ZGrpILpw2Isg1ej9xnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004076, "uuid": "705facb3-6bac-4776-af1b-25daa9032c2c", "value": 63332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004076, "uuid": "f96f2b32-20b5-4971-b5de-8bffbe2ca0cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004076, "uuid": "bf9dafea-aab2-4b71-b955-4d89ce60390f", "value": "ca05d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53294a1d-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996114, "uuid": "7dc81075-48d5-4909-a35c-fdc9115005e0", "comment": "Malware payload (Mirai)", "value": "71b12a487e178a65bf3319277c334c8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996114, "uuid": "940fba16-0d7f-441e-a65d-f8b6dff3b54d", "comment": "Malware payload (Mirai)", "value": "08809a33519e6446e8f0c6a3bf7464a601a88c6ed995f88918c0a7b9c4048e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996114, "uuid": "17dfe0d8-21b2-44b8-8d0e-5ec3aaa41a5c", "comment": "Malware payload (Mirai)", "value": "1b21d521dcc0433e2fa395efd1d6e5ac3a3f6d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996114, "uuid": "6132df7f-d139-4204-945c-c4b1c6911ac3", "comment": "Malware payload (Mirai)", "value": "433680afc0b69f8279e1e90f99c86eef15d584bb479c3152361a52ab12c418cf641cda735f3062b340259e03513a34d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996114, "uuid": "e421e837-d007-4ae0-9dc0-4c583ecd683a", "value": "T1B1243A4B77508FA1E375D67006F34BA7AAB9228216D39545E36DEE107F2034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996114, "uuid": "24b9fe38-1555-408b-afce-3074791631e9", "value": "6144:RJt7IbIjBXxFD8QvcBcTEcSr1nSs8aOre:RztBPXvocMr4zre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996114, "uuid": "26b8b839-4743-418b-9f0b-1905e83dbf91", "value": 217580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996114, "uuid": "1aa5d76f-f7cc-42d1-9e83-4363cf483aae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996114, "uuid": "f536bc7d-826b-481e-bb57-879548dfcbda", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2dca4e-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005714, "uuid": "d3917e83-08e2-411c-9040-9dc9858c1853", "comment": "Malware payload", "value": "99ac10e6fcc9d5b925544afd016946b0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005714, "uuid": "38274812-8239-4109-a31b-1cee28bf756a", "comment": "Malware payload", "value": "08db2e7df8672de7bb3ac6db1445378d79d2b86de7339894908d204cea65befc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005714, "uuid": "569f2754-95d3-4850-a353-0ee3a76809af", "comment": "Malware payload", "value": "932b92751a004d73db9576c62cf11b166b37215c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005714, "uuid": "ea67c65b-c21c-431b-bcaa-5568e406ecf2", "comment": "Malware payload", "value": "48e1c90189e858cac9a1f30aebfbec822d9b3bbbbedae093c9cf5c389085aa29ef57f897ac8a8a62831190ffa0098651", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005714, "uuid": "0d1ae7c4-e296-4c0f-b862-f64601ad60c2", "value": "T12C374F97CBC784A9182F5FF4E9C850A5AB05E223F22F87714D50AB009D346361FAB5ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005714, "uuid": "d481eba3-8f1d-430b-9cf5-a3fc64689a04", "value": "768:E8UuUXXrn2Dj0CH5yZulDzQvoVDN6L1EK9KKYUk7+tsRUt4gOLHtYKqpTpHh8gBy:yYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005714, "uuid": "3ac89d0b-5a23-4085-aab8-4dfca4eee165", "value": 24468314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005714, "uuid": "bcdded0f-b731-4f27-90c7-2bef91df73d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005714, "uuid": "74c0b40d-5bc9-4a97-a026-2f5048492c97", "value": "Invoice Bank details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06616164-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785993408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993408, "uuid": "5cf8c29c-8f29-4e50-9b0e-77f398435be4", "comment": "Malware payload", "value": "331ae9970c2a7fe496c86c1d05799dfd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993408, "uuid": "d1e658c4-7298-4077-827f-b7614df7b3aa", "comment": "Malware payload", "value": "09b34cab4e24a3886d2528d2899fc6ad24ff4db4c7578c6a1cbfc86acfbd4ce9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993408, "uuid": "e6679654-f0a6-47f2-a0f0-d65dfcf0e3c6", "comment": "Malware payload", "value": "f82aa6ac049a234803d04247f625ed45348703a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993408, "uuid": "cba895c4-4978-4cb7-95a0-bc1fdf68d02c", "comment": "Malware payload", "value": "d5b0727bb94e106784e72a8779935712de0f8cea6b26eb1d488cf77794120c4a9e34e10469b1e33c316d7fdf43d8ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993408, "uuid": "ba372cc6-adcd-4f3b-93d0-f3218745ce5d", "value": "T106236C6516857C25EA99C4361C7E2F0CBDAD43E6320852DE7FCE3CF28C4A69DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993408, "uuid": "67320266-8e92-4e94-a6c4-ade7a62621cf", "value": "768:hcsr0a1ld19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:lhmcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993408, "uuid": "bf292ba2-64f2-4fa6-b00f-8bdfb4779d08", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993408, "uuid": "ba3ed383-c7a3-4744-a223-a8ce5cfe07c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993408, "uuid": "120550e3-cad2-49c4-b719-838563054758", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac26e416-916b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786002706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002706, "uuid": "5ada5248-b8d4-4ec4-bf9c-bc8954a27d90", "comment": "Malware payload", "value": "2cd30b5413652e9c8820d63a7a18ae3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002706, "uuid": "960de3f1-c4e4-4a2f-8766-c70622b7d9a1", "comment": "Malware payload", "value": "09fa1e083cb809575a36b9d8cc90163d8c6d989b0f53db6f36c4742bfeb10e12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002706, "uuid": "4718a359-1c89-4488-ae88-35de54331865", "comment": "Malware payload", "value": "fb2b28621a3777e27683d7db1339e4b74da6cd96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002706, "uuid": "966d385f-1bdb-4e4d-993a-80923c84c60d", "comment": "Malware payload", "value": "f33dfa6044a68aa5295896e71840fad832e89d229b25b93134a4bce40af1e88d61ff5451ee8c9704905cd6b934fb458d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002706, "uuid": "5dcaa9ef-3289-48f1-8924-cc193eb7d054", "value": "T1E3869D27AA4154A4C489EE39C87B4289B67F788D873433D31E227E716F327D25E79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002706, "uuid": "6228b45c-5c10-4066-aa17-7a13a7b007a1", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002706, "uuid": "d35932ff-1474-434c-a68f-c1b1836a207b", "value": "98304:nGLMWXAXr6XLDnkcuYfxTQHTXlk7gBdXjUHZSOeLBE01KME0Tohh:nSNj8HDhFUHkOetw8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786002706, "uuid": "1b6a1bf9-3da6-469e-9639-6dd85f2e4013", "value": 7847048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786002706, "uuid": "edd63aa9-fc64-4fcf-b245-b7f0cfbb78c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002706, "uuid": "dc71999a-ed3c-40ff-809b-6da83bab7718", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca84e50e-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785993308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993308, "uuid": "3df5a2c4-e274-4a7b-b99a-e26090fcd76f", "comment": "Malware payload (WannaCry)", "value": "69dfd99e5a06a3f4b39c9767234cb765", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993308, "uuid": "aeb28bca-f367-43a0-a8cc-d15ff8962bdf", "comment": "Malware payload (WannaCry)", "value": "0af4cc65ed6ed2cffe30bc883348ee443ee26541792ee394b379fc2ceae3f88b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993308, "uuid": "74b946a5-6790-4862-83e3-4a0ea11d59b9", "comment": "Malware payload (WannaCry)", "value": "19bbb5b2d519c7729975b2a8c3cbdd6943cbd731", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993308, "uuid": "6689818b-6a87-4a81-bcb2-248b060a7bc7", "comment": "Malware payload (WannaCry)", "value": "57e6337d7aab1a7a5496a9de420db5ccdd9963bd8fafae6f767748a67ad5b15348e2990bed5482a70ab57ee9313922f4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993308, "uuid": "5b831e04-3b12-4820-8dd0-7c874597c5da", "value": "T12C36234522ACA0BCE0AA4374E4B30D26F7B37C6A6375870F97D4876A0D13781BE78756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993308, "uuid": "0ef88743-9eea-4640-9a28-3958d84c9d45", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993308, "uuid": "5be14ca9-09bc-4264-8cc9-0d22c8a24179", "value": "24576:jbLg1bLgdeQhfdmMSirYbcMNgef0QeQKcL7nEm8uME7A4kqAH1pNZtA0p+9XEk:jnYnjQqMSPbcBVQemE4R8yAH1plAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993308, "uuid": "e7a1d3cb-4cfa-44ed-8538-60d1a3ccf57f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993308, "uuid": "ceb63d95-b4f9-435c-9bc1-c09984307ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993308, "uuid": "74eb5ce3-36a0-45f4-8233-921ba77825d1", "value": "0af4cc65ed6ed2cffe30bc883348ee443ee26541792ee394b379fc2ceae3f88b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdcdfb0-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045547, "uuid": "3cc4342b-4104-438d-a62c-74cabdebbc20", "comment": "Malware payload (Mirai)", "value": "d01b18e680172c1e20b8a8ee8c5f44db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045547, "uuid": "57a1a0a3-2fdf-4a5c-9a48-14e2438026c0", "comment": "Malware payload (Mirai)", "value": "0c77ac1f5415cb58f9f56dd29e58580bc72e3769f1184945d7acf0455e3c583f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045547, "uuid": "a2e81ce2-1c5f-4db1-8564-337189787773", "comment": "Malware payload (Mirai)", "value": "7920073445f97d6e2989602e4170e2deb6d26ef2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045547, "uuid": "dd3b28c4-7b70-402f-a77b-f2162ca31273", "comment": "Malware payload (Mirai)", "value": "d369111b8f8ea65abb3fe41e1eee2b49506d7797b4a199ee6aee40e82537655846f00b2eaa72fc7119d9791e4a48462e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045547, "uuid": "91b66c66-f1f0-46cc-98b4-34902e1ce568", "value": "T18B83F7C1E98744F1C507483450ABF33FCB32E9B640719BADEF9A9E36DA37B419122259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045547, "uuid": "1439b698-7a08-4efc-9e61-a0e7909330c1", "value": "1536:KwGKIufwGNTEDS5nY9lmdPWtY0aV/tqWGCZTdq/T3fg3SZJz:KtKIufnT6S5Y9lGPD0aV5Fx4/bf6eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045547, "uuid": "049238f2-b02b-4a77-9d3f-3e4cbad98b74", "value": 83152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045547, "uuid": "425fe655-567b-4be3-98c1-66106b3d9722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045547, "uuid": "907970f0-063e-49d4-89fe-a197a7b1f27e", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aec1beb-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005522, "uuid": "29e05562-947c-4309-8cc0-1f88b691761b", "comment": "Malware payload (AgentTesla)", "value": "ccfd76c991af0cadc1fdc394972b22cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005522, "uuid": "18a4504c-6a40-4e08-ba17-6eb5e02ea94b", "comment": "Malware payload (AgentTesla)", "value": "0d69fb6ecc1ccb82222aeff6263f597f5a59b98674997e3b34bf6c4253bd529a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005522, "uuid": "9d2c47c5-d559-4056-8aeb-9d1439ac22f8", "comment": "Malware payload (AgentTesla)", "value": "4d2da49e94c3693579af67a335cc05a93fadd1ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005522, "uuid": "8077bca8-a575-4981-bce7-b399159270d0", "comment": "Malware payload (AgentTesla)", "value": "1f43adbd2d6543c81ec07b0ea3f5bc942ee9ab468611cb73143b38ade664c3ed66383160d615787e9fa09745a5bc0730", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005522, "uuid": "09a7aa20-cda0-4a6c-8025-5a95980ea2fb", "value": "T10A57624E4FEA9E1D19F15900F1D8824BE4CBF69364AD9F62F942BD464D33318D9EB202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005522, "uuid": "6abafdc0-8fbe-417c-9b0c-0c051ba0c906", "value": "1536:zmHnHK61+uo96nZ23oH66ZMP1hlZaOyt8I83cIhdGfceMhc314QLNNkmjOEzLXGL:pumP52Im+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005522, "uuid": "327578c3-c493-40ca-b8d4-2b57605efee2", "value": 29075706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005522, "uuid": "e2924705-d63e-4517-b49f-908566aab82b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005522, "uuid": "5560e007-124e-44d2-b3d5-80513a3e6065", "value": "transferencia-98758.001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284ef55a-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786026536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026536, "uuid": "d130970c-7602-42eb-b466-5e0fc004cf9d", "comment": "Malware payload (PureLogsStealer)", "value": "3cf60017c3b4fcfb39149f18fcaf3338", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026536, "uuid": "b6e7ed20-776e-4ac8-8296-33d9eac268b4", "comment": "Malware payload (PureLogsStealer)", "value": "0d71bedbee7358b2ef19cff4d8293749caba871a6470983f1f07e3901aeb2398", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026536, "uuid": "8f1a83d9-0748-47a1-a9ba-e9196c02d8b8", "comment": "Malware payload (PureLogsStealer)", "value": "e8647de3d8d683f202fee4ce7988aa748438695a", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026536, "uuid": "ff59a55a-05fe-4f5e-ba64-6afa20451506", "comment": "Malware payload (PureLogsStealer)", "value": "4877660f3633abb6232e3fc93b73964010b83fc9eeebad511f1edab7af9ac994d1fdf51ea5e28aeab834bba06ba7e644", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026536, "uuid": "fce904b3-5026-405f-8cf0-b0d0ee0261c0", "value": "T174D5A6EEE024BE500FB6B30FDB80D8650175BE168B97F68B7C2EA1E30553A70ADB1455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026536, "uuid": "d448a9f6-ae9c-4683-b561-88865dbb00b5", "value": "24576:ejOeMTl6HMiniC/AfGMiQbmhXH702K+50VA1tdQLHTb/nIfgyVd:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026536, "uuid": "ac6dd14c-ba3d-45c0-bd90-31165051c921", "value": 2895029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026536, "uuid": "727ea094-0ffc-46ff-a32f-4a667942092b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026536, "uuid": "1af98ea4-8562-4304-aa80-a849b5cef222", "value": "SOA & INVOICES.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9aff3c-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026810, "uuid": "3a071ce5-749b-40b6-8f41-497a75407c25", "comment": "Malware payload (Formbook)", "value": "2760c642f4afa4f40dab2e63c42ee6d9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026810, "uuid": "a5b25ee7-eb83-45f6-ba6b-d7bb807bf7e1", "comment": "Malware payload (Formbook)", "value": "0e9789bcef41a88ad38dd66c35cf9526770b50f0c44526caff71054c4427bc54", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026810, "uuid": "582cab27-8fab-4a33-b308-4be44740804d", "comment": "Malware payload (Formbook)", "value": "c565544dd7c3e971799b7cadb4c33d8c7af85685", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026810, "uuid": "28f9653c-74ee-494a-9006-42aac1615b4f", "comment": "Malware payload (Formbook)", "value": "79f9e353df5eac0d0469bcc58731325fd90b5153f517000b7b87df209ef45a5b93e7c55f8e41b17ea0f4b9b67184a7c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026810, "uuid": "6d443994-b4fd-40e5-8e6e-ca9dd2c45c45", "value": "T106A31F0499827480633A6B7FB22AD8E5F3760B6B01805917B87C7880DFF6D09DDE5DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026810, "uuid": "4c95ce65-4a3b-4d58-a155-1d339a954fd7", "value": "1536:JF6K/2oLcKcUyFj7eVbsZJQsmdEPY7HXMSO9:JUKcUKUEPS3M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026810, "uuid": "1c47db49-19e8-4ff7-8477-2cbc57c23bfa", "value": 98757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026810, "uuid": "f85c89b7-0ad5-4a8d-a355-a86dcc8bff74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026810, "uuid": "af3e08d1-cc32-472e-a85e-f834aac4b3c3", "value": "Teklif Talep TRC2600508 - 10107161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a7095c-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786047953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047953, "uuid": "75d0582a-cabb-4be7-8686-609ed6ba1784", "comment": "Malware payload", "value": "d45a1dc48c961d13d5b590d5d32d7205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047953, "uuid": "916e2ce6-c69d-45f9-9c5a-39edae354d64", "comment": "Malware payload", "value": "101ba5aab790d1b6d0d129563d0617e557dbed12120ba4146d0898fdc1c45ab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047953, "uuid": "afbb3be9-5cd6-423a-9bc9-cbbf13da8054", "comment": "Malware payload", "value": "0a4921ecb1296182ccbd910637f44959c62d0c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047953, "uuid": "244d2f11-3ffa-4cd2-b279-0aaa41bdb32d", "comment": "Malware payload", "value": "a10629979e81f8f18157d3761a3151493a08550517d916f3291fa8d50cacb9537634fecc404a6a6dd2111f070511d9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047953, "uuid": "8def52ed-180e-497c-810f-60cab7e37e99", "value": "T184E30749BC819B1599D922BEFE0E118D33575BACE3EE7112DE205F2123CAA1B0F77506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047953, "uuid": "1182bcf4-4e95-4e00-8ece-5e90042ea673", "value": "3072:qOeXXLSi6ycRQFTFj10dqPk3ZgnIaaR8guAUc6KRLTB3kicqk2:+XLSdtiFh6dkCZILaR8guAUc6Yfdkxv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047953, "uuid": "adc7f2f3-f78d-42ee-b7e7-213dacf28a20", "value": 144024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047953, "uuid": "bf7c2207-ac77-4523-b4b4-6a59765ff8d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047953, "uuid": "b671d7a7-101a-4d6d-83de-607f73708d54", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f745d4-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048062, "uuid": "44967216-9a8f-4cfd-b632-84f941fe7987", "comment": "Malware payload (Mirai)", "value": "5dee2bf7afcc9356a6f5638412ad6c8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048062, "uuid": "87fce1ac-24b5-490a-96fe-fc5d719054af", "comment": "Malware payload (Mirai)", "value": "103565b6c042e4888057d8c7f7d4428a4c12a7b8be43568e2732da9039b8257f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048062, "uuid": "5ac85060-d4b3-4999-ac3c-cc0e044f2819", "comment": "Malware payload (Mirai)", "value": "9365244e93bb79b712aff7823c8419f53b825cb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048062, "uuid": "c3d65ec1-e087-4b0c-a20b-5a4f7039800f", "comment": "Malware payload (Mirai)", "value": "d82c927d827de0932198bd5bbc1cd8f6b03b5989f475e498d922cfe82c0893e33a9f9e6f43ec3f93956843442a8c056f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048062, "uuid": "c9c581d4-2925-44f9-aa1a-65111ff60445", "value": "T19634398ADFA50FEFC46FCE31066E431715ED988B93E07736957CCC54B68A2094AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048062, "uuid": "355a74d7-1b2d-4243-b979-dc2908cb2509", "value": "6144:STsg5g++Uc6qrbpMtabdnD8MjKAM6T97hS8Cov:ST+++Ubq5MwbFC6JLCov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048062, "uuid": "0105a88c-aaac-4f55-ac1d-cfe518dafaee", "value": 249372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048062, "uuid": "65b35a0a-a17a-4586-83b3-d5d7f0a3e32b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048062, "uuid": "f0509f23-6106-47a7-a63e-2fc524959a5d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24345f02-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044998, "uuid": "d213e3a1-019c-4354-a342-9d96d0c90053", "comment": "Malware payload", "value": "bd3137f504f562937493fcec2cf02656", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044998, "uuid": "b52a9340-e1a9-4ced-bab5-626ce02dfb72", "comment": "Malware payload", "value": "103f19778bfa7b47ee749efed2580f335f687a418099dbaa5a98d240dac90089", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044998, "uuid": "391f932d-4c43-411e-9633-444db8c80c9f", "comment": "Malware payload", "value": "09c38bdb0d2a803ab5d147b38e9cf54535404162", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044998, "uuid": "1b680e25-8000-4a57-b5aa-1d498021180a", "comment": "Malware payload", "value": "0dd83782acb3052c87cc688be0c3ce326587bfbccbefabe79001b88758b07524e3bbe07fcea33167a12678acf4b01011", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044998, "uuid": "d5857399-df4e-4e6f-ac7d-9efdcdb1d73b", "value": "T157C08CB53A303C093884460C326A452140833C83505E50DCB0A58A000F8A882B145A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044998, "uuid": "8ddd3bdb-d385-4221-bb15-e466582d9bd0", "value": "3:QFKIaM3BFDzCLftNtY0YLftNtYROOdoJFTG0sF/XK4vn:QOSB1IBYTBYR8LTAFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044998, "uuid": "3c1971d4-102e-4a4f-bfa3-6fda20ec7ae7", "value": 144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044998, "uuid": "2a102f45-c387-4c94-8979-4dd075b9e015", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044998, "uuid": "98fa010d-e798-40e1-ae68-2c616f02f9b7", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55187556-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026182, "uuid": "4b0ee650-f60f-4c21-b74a-44d147249aaf", "comment": "Malware payload", "value": "a1558afb365682b96554d41cf3b227c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026182, "uuid": "bf6a4c23-0fd8-465e-9100-68146e97858f", "comment": "Malware payload", "value": "105cf4a05bcce8dcd10a1288b6e2310ad27860153676d7dae3839f03ca388493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026182, "uuid": "0ceb1f5a-a239-4042-a4b8-28f49dd6ced0", "comment": "Malware payload", "value": "77b2cd4eb02f09a3383ab12a496a385d2e96e9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026182, "uuid": "11a0beea-2f5d-4eed-87a6-ffc93bf23bee", "comment": "Malware payload", "value": "8bff4354b2d9128ac7dd4be6d38b8c6f7e5d08845c1e3998bb98d6b71ce8d0d38082502a600cf866c5f2da3934048bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026182, "uuid": "b24fa6f4-224d-4e48-9a7f-b92b7ca713c1", "value": "T1F9D523DAA9F22B74D87AC7B68F43F06DB07A7B844BB18E4BB6CC25019C265544C36731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026182, "uuid": "733f9806-d416-471c-a0ca-a2009925f2b3", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026182, "uuid": "2cdfec51-b8f6-4cce-9478-15fa87f23bb7", "value": "49152:HbeS1Lf3KOot2X9xMifXOTdijO2IZgiDmi3dIWgQuSufv8iBPeNLshyXFL:HbRTKK9x1WYO2uekg/T9PeOhyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026182, "uuid": "788afe76-a7ac-4d1c-9143-124d31a6ba0f", "value": 2939392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026182, "uuid": "0cae7442-3a12-4b33-b2aa-d6cc3eca96f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026182, "uuid": "e5ba80a9-9def-452c-b8c2-4e92c0eedfd4", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d8a4d3-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996063, "uuid": "1a659e0a-eaa4-4280-b90d-65c62bf48b52", "comment": "Malware payload (Mirai)", "value": "5caf63986ccaf64775762a00a5706e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996063, "uuid": "652f5c8e-6eb5-4f1b-b810-6a1fae3dc927", "comment": "Malware payload (Mirai)", "value": "10c50b17ba9a8cfc7f2b57768f3357bd8777f3fc6c9e84a79524f1ce1e86ec0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996063, "uuid": "782f6b54-a812-4657-b26b-6a659cbb2f7a", "comment": "Malware payload (Mirai)", "value": "1c9cfdb27c51838beb3fee11e91acd5267048ce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996063, "uuid": "fbb64001-84fe-4d4e-bdcc-5f3ff7ba128b", "comment": "Malware payload (Mirai)", "value": "30fb23d3f3028a2ae47a1ac64a250acb6de9d3fe807610d4d5b52c7d31c74c81c52ec4c9b504e2f40a4c58b81d0f775d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996063, "uuid": "64b425fc-3eff-4090-a4f1-9848660f0928", "value": "T1EF630113036E6D94D7C4AA3D2D060B8A77F497BF7A03916C2313826AD40582EBA4DF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996063, "uuid": "f8ce8b33-cfe1-4c77-a630-852d71c08618", "value": "1536:oX1y2lzB63kAcRNTjOVpi/vcY6NOCQLW3nmMGCfVw2SOQH:oXYcM3oNTjOvi/v36NOCP3mOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996063, "uuid": "b21570d8-787a-4f58-a6d1-0ef48af78196", "value": 69160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996063, "uuid": "15b21654-19bc-4209-a060-16360119da64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996063, "uuid": "fa9dcb4c-f512-4157-9231-2bfd61a8fb3c", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2966be7-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994126, "uuid": "1a09a7fd-19df-4db0-93d8-ce0b62c27234", "comment": "Malware payload", "value": "2490269b10a873a34cc910b8f00604f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994126, "uuid": "9d695b25-9449-4235-b184-333292575ce6", "comment": "Malware payload", "value": "10d70c37b96b76b15e379358151bbd65216b9409e5fb9aefe2561afa40e73e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994126, "uuid": "9fd2e725-8d75-46ea-b89c-fef18e7373d5", "comment": "Malware payload", "value": "39691ca4c3053285ba18dde261f486fb41cec73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994126, "uuid": "c43b7620-e556-413c-801c-6fb9af21a5dd", "comment": "Malware payload", "value": "2d4a64b04241f1b80a48124836b140acd064db7298ada31026ca0bb090ae5f99daa587496799f16c5b00ba467e505af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994126, "uuid": "2af6c6ae-da3a-4751-a2cb-a867976c7a7f", "value": "T138165B03BDA448F9C0E9E73988776256B670B809473173D32E61BA792F367D09E39784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994126, "uuid": "3017f22a-6233-4a74-994e-3893033ad830", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994126, "uuid": "7fe05d9c-e981-481b-8b57-f806d86a4d47", "value": "24576:11/YrsBZBXWJlzEaQdSOKP6iEWhk8MaY5SpRdaS3IX1ymzloJBeletr9DX7iawu:11/0UNWbrQkOKP6j8kjaY5+P13IYp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994126, "uuid": "1e8f9988-f67f-410b-ab60-3397fec93d37", "value": 4278640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994126, "uuid": "a7a1ad28-dbbd-45be-950f-467700305c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994126, "uuid": "496f8468-7893-4bde-bd79-699340791afc", "value": "2490269b10a873a34cc910b8f00604f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d1d367-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1786026936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026936, "uuid": "fd36f874-8379-4690-86f2-b83b7791f8a4", "comment": "Malware payload (STRRAT)", "value": "7e1e26dadc9e0ec86cf6582f74d81cff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026936, "uuid": "16b3afe3-b9c2-48f5-bf19-8b8e9382a506", "comment": "Malware payload (STRRAT)", "value": "1162b0a85a471b942f594b6707c79652b49d0d349e4aca2e0779c42577291ec3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026936, "uuid": "bab8ce60-d468-4693-b59d-f4e62a6d2b7b", "comment": "Malware payload (STRRAT)", "value": "557d97abbf730b6516818d84310dfc6900dfc509", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026936, "uuid": "c73c6cb5-e1aa-49fe-87c2-e1042bf06413", "comment": "Malware payload (STRRAT)", "value": "5c9a3551492a56c84d23b91a7763ce760a969699db068c3efda2656e0005512d48e386d3cbf89d6ca329a6a56e490730", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026936, "uuid": "3544bc86-58d2-404c-a68f-5a5b4994a862", "value": "T13E050F55B36A498B1B0BEE34341A1D6377B80B60EFCC49C49257EE998C5EFC70259E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026936, "uuid": "e3932d93-ade7-4ced-8dc2-aad141105747", "value": "3072:OJE/CjUjmaVFYlMcMpWsbkCd4xTbJPC6btm47CKhNFTc1xdu2vbt3XaE4Uj1piJW:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026936, "uuid": "0e8e32da-79b6-40f1-afec-e63b85c3ea5a", "value": 849496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026936, "uuid": "049ba3f7-3448-400e-993f-029da68aa0f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026936, "uuid": "5796fa20-a96f-4b8c-ace0-5b19417d06e9", "value": "Request For Quotation(RFQ).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc91415-917b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009553, "uuid": "d07d6cde-ff53-466c-b00b-456b105b6054", "comment": "Malware payload (Mirai)", "value": "0d0ff98684043f4a190d0e084efd4b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009553, "uuid": "dddb66b4-4fa9-4975-8598-cdb93b7dbab4", "comment": "Malware payload (Mirai)", "value": "11f14d6270f713437c36e92de64afa6f3149ff35e11f3a6f59346ffde45e8328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009553, "uuid": "fa80e645-811c-41cc-9627-5c2eb0860fba", "comment": "Malware payload (Mirai)", "value": "fa328b70cddb1f1dd2cec5f2d84fd0e244c5aa87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009553, "uuid": "92479d19-8eec-40f8-ba25-b89493a5df92", "comment": "Malware payload (Mirai)", "value": "74cc94aa1de0d02cc7ab2d17076cafa112b5b68ea434448d580c866eb2a96d6c9512223abe3ed1ef1323d8fab3c7205f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009553, "uuid": "b4300eae-eb42-41c8-8d4b-f35ac6ad7715", "value": "T1B113D652F882572AC6D013BAF6AE568D3720B7E9D2CF72279D611B113BC911F0C67E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009553, "uuid": "a20a12bc-9f0d-4b9e-80e6-1c6f88fa45f5", "value": "768:uaoDPn+NVp98QGktJe3hkAz9bg748MiFAT//Vk+JarWyz2oH+wu:ADP+NlJW9K8iFAT/dksarD3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009553, "uuid": "eb67c4c9-c9df-4ef9-8f4f-1b0daa99d1cf", "value": 42320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009553, "uuid": "c5f48aad-9182-40a5-ab4f-de3370773843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009553, "uuid": "b2c22e4a-34e1-40e3-85ff-d8b8ca5ded57", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee73806-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049552, "uuid": "67917231-821f-45ee-8155-9ff55238bb13", "comment": "Malware payload (ConnectWise)", "value": "8fdc8eb2b0739cdea9e5559342cf9152", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049552, "uuid": "2a1c522b-9eda-4859-af31-0baf806f0fe9", "comment": "Malware payload (ConnectWise)", "value": "12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049552, "uuid": "67cd2026-fde6-4efe-b180-8700d1a4b091", "comment": "Malware payload (ConnectWise)", "value": "0f5f0b2d7a359dd8cb35a8dd4abc31fff4ac6d5e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049552, "uuid": "4b8f0074-8e3d-4bde-bca1-a8015f9f7c80", "comment": "Malware payload (ConnectWise)", "value": "77eb9252b22c35f185379cdfc89f972605dab882d17314ad55f2867a44e990ec19067ebb57636e632af0b0dbc9d981f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049552, "uuid": "bea2ae53-a872-47cf-83e7-f1639183e79b", "value": "T122646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049552, "uuid": "b9b21062-4673-47fb-9bb5-e68152a448cd", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049552, "uuid": "64d063bf-bcc4-4073-9b4c-7c46d1522204", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9g:41iw7gryNkSV1hy1Z1u2JLu9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049552, "uuid": "7d9a8d71-eb1b-4e26-a1c8-7f87e12a0400", "value": 312600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049552, "uuid": "7d97553f-34cc-4dcd-b1e7-9bcb0142f49a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049552, "uuid": "b52487d5-2810-41cd-a90f-73f31d1c69ce", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbc3a2c-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785994632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994632, "uuid": "0dc64dad-8766-409b-9a05-1130df8ae7db", "comment": "Malware payload (Stealc)", "value": "ff1b216b6ef02dceda621ca45ed4f0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994632, "uuid": "10386c5f-a5f3-41c8-806d-b7512022acab", "comment": "Malware payload (Stealc)", "value": "124cf79f222ef8b88f4d0e2e474378c5a7ab8a3c513d2434037ef0acfd79c984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994632, "uuid": "b53feb68-e60f-401a-a37a-c14b6a38aee8", "comment": "Malware payload (Stealc)", "value": "c23d33b86e22f305fd600145f27f6a9522e29cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994632, "uuid": "ee641f3a-4f68-4ca9-990e-da0beb72e3e7", "comment": "Malware payload (Stealc)", "value": "263f09d9f6341be2ba32fa0515394e04f20d650c17f583a6e7c95693dfb0e66b3130d9db8a9ce35336900fc0baedf7e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994632, "uuid": "e6bdcd02-01b1-42ba-8b0a-14dec5cc5a76", "value": "T132E57C877CA108F6C4AA95318932E6667B61BC480F2153D72ED0BE3A3FB6BE05D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994632, "uuid": "9447e320-0a6a-457a-8a0d-27b24764cd88", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994632, "uuid": "6e6334c8-69c1-40c6-bc40-6d431a9927a2", "value": "49152:VbXJAziaUp62zIVATR/jSu7UR4Sh9YQd1u2oiVK/:VbZaFwTUu7UOPQdUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994632, "uuid": "d0f992b5-6256-447f-a51b-5f4fa90236a2", "value": 3242496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994632, "uuid": "126b65b1-e8a3-4576-83ed-4f0096b59b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994632, "uuid": "f135c8fc-ce43-41ed-a131-d67688ad50bf", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f36a9e-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040194, "uuid": "9f7e0b97-ac18-4ca3-b9d3-8b0c4f2e1957", "comment": "Malware payload (Mirai)", "value": "26c3312e1ded643b772a65917c7281bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040194, "uuid": "9560301b-5345-4090-b2dd-59a0874b2c97", "comment": "Malware payload (Mirai)", "value": "125170468dfcb7d0e61e324499a7f9f38a6586a1534b740da8989fc00c8a6fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040194, "uuid": "4d70d16e-efb5-46aa-bb41-26f49aef3c5b", "comment": "Malware payload (Mirai)", "value": "32254cfe55a860710dfe8e3bbbc1fd074b7d931e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040194, "uuid": "450ecf53-cae6-4bea-a055-baa99a722440", "comment": "Malware payload (Mirai)", "value": "2c55ac5a0febad1666e5ec71502bc245c4fa7ba105d42d40c494dd12c1d6131e5d9210cca57a5dee632365c6e6c070dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040194, "uuid": "8155ff3b-207e-45ff-af55-42d1c7f6c63f", "value": "T107549F68B90E6C51D29ED37CE9675FB2702634F48299C0F27F11828C9DB7ED8DAE0511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040194, "uuid": "27c0f2a0-b0e6-42c0-be29-37a12b6b85c9", "value": "6144:C6Xo4xFR0o+I56X6h7GoXrY7qAPJxeDKsuJ:DVxgoZ5k6h7/bs5Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040194, "uuid": "c3d30e17-3ce6-4d99-9a09-f127f1a109a9", "value": 304872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040194, "uuid": "b69f512c-0976-480f-b64b-68eb568f344b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040194, "uuid": "88d3937f-5776-493a-9529-2cff180a8502", "value": "pope.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fa4798-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "d0458be7-821c-4290-959f-504235769513", "comment": "Malware payload (Mirai)", "value": "d6e090bd531fc5f87fb6490596404fdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "d52796fe-3389-4468-82d5-8bf54a437f99", "comment": "Malware payload (Mirai)", "value": "1262bf0a9a17b3c0d332f3e93589305c3f60d1942ec6f4ff633ccf872e80e2e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "da358cc4-3782-450c-8999-5019784d096d", "comment": "Malware payload (Mirai)", "value": "16d80b8427ef31ae773014564ec66c3f4c2ba9b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "e900b727-a2c7-4b69-b5bf-3e27b0677080", "comment": "Malware payload (Mirai)", "value": "8d59bc324665280c1a681a8fb99dafd232456a3518d43ac32ee2cd78d9a22784613549e97cfa008c77a038b8438d5a79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "046caefe-0cc0-4499-98af-d2ff504d2cd2", "value": "T1B3D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "f2929907-2c22-422f-b270-6501798bd832", "value": "3072:oWGIf1/UwfhJdU80rntbYUaDGMsMA9TKet:oWxN/UUDGtbYUaiMsMApKet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034397, "uuid": "92f0b45f-4bb4-4c4a-b128-5017d8607577", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034397, "uuid": "83d6952c-f27b-4a07-a966-e002033564f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "508967a1-b378-4f78-87c2-60f7180eb160", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbaffad-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786026678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026678, "uuid": "6e0909ea-b55e-4e70-89fc-d1c190ed157d", "comment": "Malware payload (AsyncRAT)", "value": "907b5ab7a4be975a23e5b6aae595dbee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026678, "uuid": "38297bd9-6405-49a3-9278-75b49e676bee", "comment": "Malware payload (AsyncRAT)", "value": "12fb4616c7acde29a061b969182728d99e736cf158c7dfa250d381f7b4515129", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026678, "uuid": "4109d721-f4da-4a79-9e6f-f71d6000d97d", "comment": "Malware payload (AsyncRAT)", "value": "018583473dbb5be8be339e3c237d7085b27abf00", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026678, "uuid": "8065a763-5b00-44c0-8222-43e9268db6cc", "comment": "Malware payload (AsyncRAT)", "value": "7ae7532fcd00b71611be17415d68cf23064b834a825a2e886cbb5671b1aa8f22603dba6d868b83d91d37f3857090d5cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026678, "uuid": "34231f9f-dc04-4372-b528-c46c979bcd43", "value": "T16134AF0050E5496096EFC377722F3B9ABB66396BBFC8F4C1A499D5E097C4E89C8B1131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026678, "uuid": "b42b1e8e-dc27-4ea0-a122-04c95c0629ba", "value": "6144:c0wVtyUersYHRVqwiegGvQqD9bADGYrZmQ2SQzlv1o:c0+tkLVNjwGYrQFlv1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026678, "uuid": "64c8fffc-dd93-4141-b7e6-6ea1b7d382da", "value": 231653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026678, "uuid": "6a32a252-dc35-4dc9-9e0a-80c8edb7324a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026678, "uuid": "c0dded77-278d-45bf-8f82-63344c8b1f06", "value": "especificaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5eb6ef-91b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786033548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786033548, "uuid": "1ba02b84-b698-4095-87dc-a95b60308717", "comment": "Malware payload (njrat)", "value": "ac061db892ad8cd21a565996bdb33d5c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786033548, "uuid": "876c0271-6523-4bdb-bc53-f4f73381d031", "comment": "Malware payload (njrat)", "value": "135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786033548, "uuid": "832da1f1-117d-4409-bce6-89a4b73073cc", "comment": "Malware payload (njrat)", "value": "70c24a2bb97c0b995bce9c7cee42d1cc856d177b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786033548, "uuid": "26cef771-996b-47b0-a185-c6402a18c6a8", "comment": "Malware payload (njrat)", "value": "5d0413d257d16a9de4ee08bb1c4521fd09157325872a09ad98846318eb75703b75edb024ca03e6999e5d740b67080bb4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786033548, "uuid": "e4629cbc-9214-4426-b323-2e73d2d0161e", "value": "T1C4631D8D765071DFC85BC876DEA82C74EA607877430B9207A0932AAD9E1D98BCF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786033548, "uuid": "65444408-b300-4c94-956c-6a0c4c969186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786033548, "uuid": "29c77353-bab5-405c-b6b7-d89b3d23c4d0", "value": "1536:gD7E0aMik6/7mMnusnQ6jmMckf/p0OEDn7NElC+qj7i:i7E0aMikpMntnQ3Mckf/p0OEDn7NF+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786033548, "uuid": "9467e951-0527-42b3-9c2d-468601ccbc12", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786033548, "uuid": "f3346343-3cce-4829-9d79-af49e3642dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786033548, "uuid": "c2cb6da5-7b06-44b8-aac6-35e5d469987b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5688fa6-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004090, "uuid": "103cb0f6-0b34-4c65-b6c5-c45bcd258fce", "comment": "Malware payload (Mirai)", "value": "14e602b149fd3def4cf44a436b83fc19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004090, "uuid": "4a99f557-c0b5-451e-a13d-6285a36de6cb", "comment": "Malware payload (Mirai)", "value": "1395c255c3ed300b2b0a3f7ae87799fe75f65c7cf2f1cad709c7d8193d068449", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004090, "uuid": "be44db18-d560-4319-91c3-fb1d03d0375f", "comment": "Malware payload (Mirai)", "value": "6d95dc8f42d0598ba3de0240791e603dba345bc0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004090, "uuid": "3416af69-ab52-4a99-a8f2-e7aca77f923c", "comment": "Malware payload (Mirai)", "value": "1ae54b17c49af779275f12b5ea5142e315469646e585f3aaf84677b3de40a16c0c2e306e6be8b431fdf0ed0f7a266a51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004090, "uuid": "78831660-439f-4f85-baa5-c4e73f44381c", "value": "T1C531239A40141E391202CAAE73733548725E95FB6D9FC7D0DD880EE9828DBDCF1A2B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004090, "uuid": "2d6b9c19-e5ce-4f47-986f-93af2be10fc9", "value": "12:UI6av5XrI6raqxq9m6l976xNFUi6FUhWMpSS6Na76Ns/s76MV/9No6NAe6nFGWxG:Fb7Zq9uk4hHv63pQi/7zyzjcHihw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004090, "uuid": "cf347b4f-e079-44ac-ad01-31c31507ea79", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004090, "uuid": "655a7442-e782-4de6-8b2d-47ab62fdd62d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004090, "uuid": "6f8b8789-90ec-4ecc-813f-34d9c68555db", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aea18f-9160-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785997756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997756, "uuid": "78c43b7d-703b-472e-86e3-cdc48d9cb337", "comment": "Malware payload (RemcosRAT)", "value": "a2fe9b0cae4da9d807f5407bb57951af", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997756, "uuid": "51b1967e-476f-480f-ac6c-94b1365ef47b", "comment": "Malware payload (RemcosRAT)", "value": "140aca6ee1b19a24e5056fbf3049e5fdd54b1b84cb4390fcb3cec785ac0c9c93", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997756, "uuid": "f333c2d7-7728-43f8-a431-fba5c230a1aa", "comment": "Malware payload (RemcosRAT)", "value": "3b04441da8fb4ccf9a3ba20e2a7f61640cb25473", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997756, "uuid": "fddf5bdc-5224-47aa-bea7-e487cbf12338", "comment": "Malware payload (RemcosRAT)", "value": "6d2c3e15d9032d3c2e396237e78f851418dc73a8dda56a1c588f1c11c3b6e6deed3cce9ce015979cf6212a7ac9bc9387", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997756, "uuid": "b8f96f06-7ffa-4835-998f-8e04578c51c0", "value": "T16962313CCBE46FA4C3BBB3F8454A651248849B6B7240AE2C7C4C9053C34C60EA95A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997756, "uuid": "40c7d0c3-7167-4afe-a3a8-ded028943817", "value": "48:3Tk1Gd84Pk1Jd84VYeyXuuuug5uuuuuuEkwpdPuuuuufINVQ/ZpWLk1Zk1PoKd80:jk1G64Pk1J64yeRStk1Zk1Pp64Ck1c+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785997756, "uuid": "07dd183d-8a3e-4096-a1b1-bf4d24ea1313", "value": 14860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785997756, "uuid": "685ea5ad-4eb4-4d7e-90c1-e79216e75720", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997756, "uuid": "933db711-320c-4264-9e8c-2265b8e36b69", "value": "goodthingswforbestfeelingsfromtheheartsesion.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35078d06-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057481, "uuid": "8f0fa02a-d068-46d7-8fc2-eb1280d7c698", "comment": "Malware payload (Mirai)", "value": "3d0f00b10d08b71a845b397ab3bcafca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057481, "uuid": "f5e62ef9-df06-4154-af7f-e5625954c1e7", "comment": "Malware payload (Mirai)", "value": "148cf20cd54364532ab66886d91149757827727145fcb4abf8569c14ad3775e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057481, "uuid": "71de68a4-eb44-4dfd-9a0c-f6f3e6f14290", "comment": "Malware payload (Mirai)", "value": "f3994d4b195901d06719eda12975768057037b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057481, "uuid": "a32242e1-88ee-4b19-ae0f-d1162b97bd2f", "comment": "Malware payload (Mirai)", "value": "a208bd6ff2050ab224b876d0ae882c945dd98c0a474107ac1664b362ac635e67325b32265b9a72fdb92f74284b504040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057481, "uuid": "d8eb61d9-0a2e-4408-b8ab-924c8462329a", "value": "T1F8044B49BE746AFBC06FCE30052E930612DD945FE2F6B3796278CD4CB99A20859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057481, "uuid": "8a28d7b5-8562-4b78-8b7d-027f9684db8e", "value": "3072:1v8J3LK+PiaM1k6XWntKSG11lRm5WFvJv7nmQVq30UK7n4fVYYOev1DG7n:h8J3e2iaM1k6XytKSG11lRm5WFvNJVq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057481, "uuid": "0edacda3-5a71-4c29-9aef-4662b1fd2ec3", "value": 181816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057481, "uuid": "2935dbdc-e87d-4206-80d3-78d0e613926e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057481, "uuid": "a7927e08-ba28-4219-b2dd-fe5e8aacc1c3", "value": "fd720b19a62efa97b733d8f816a8a1e49867e50b042d6353d23ef8d8ad54458a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071f3781-9175-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786006724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786006724, "uuid": "65546039-c8f1-43f3-913b-dab39f7f57f0", "comment": "Malware payload (Mirai)", "value": "9affab02e4fb97836f778c5bb2e8b3d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786006724, "uuid": "80c48783-c9bf-4d55-a005-8791bdbd446f", "comment": "Malware payload (Mirai)", "value": "15e7ed72b583b5963afd09be21fa1c43c1634de711e97af81d30deb6ce7097eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786006724, "uuid": "bff44d78-80e4-4162-a489-88fd3e8cb268", "comment": "Malware payload (Mirai)", "value": "cdf1d1664b006948daaafc3ae3e1180159371a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786006724, "uuid": "5c598944-2a12-4c12-a00c-9e3f54f6a51b", "comment": "Malware payload (Mirai)", "value": "0f8cc6b2f40760eb9a50081f3b8705c21d276fedfaf250eab37c6fdc1aed4dcb10c7607c3fa98f8a1a1c29a664b19e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786006724, "uuid": "860e6d65-a09a-49ac-a5d8-cac80e1ddb70", "value": "T169E30755F880DF62C6D1267ABB9E428D33131778D3EA7102CD205F3977EF95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786006724, "uuid": "9af21d67-54b8-4e2a-976c-a26031c84d8e", "value": "3072:sTJGuh72hFH3cn0v6hjCQYYA0KHz+Yigy8lOCQ1hCDVSzretHM:sTF2hFXcn0ChjCRZ0KHigy8lOCQ1rfqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786006724, "uuid": "478606bd-49f6-42f1-9d5c-35dfbc8c8345", "value": 153152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786006724, "uuid": "3d699746-3136-44cf-9505-1fa19186c017", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786006724, "uuid": "9e27a483-9271-467a-9032-a1c4d1de6a6d", "value": "disconnectraw.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98743e54-915d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785996660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996660, "uuid": "a4bf07ae-ada9-4646-a09f-9a8ac081004e", "comment": "Malware payload (AsyncRAT)", "value": "a122d3856d069fcf34009dc5187a2425", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996660, "uuid": "a9e151c0-571b-461b-956c-5fe6441f01c9", "comment": "Malware payload (AsyncRAT)", "value": "16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996660, "uuid": "9f11a3e0-186f-47a9-819c-fdae07de0910", "comment": "Malware payload (AsyncRAT)", "value": "96394a0a2d12d52ccef98d6c568b735a1020d25b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996660, "uuid": "19504d95-6e91-4bff-b28b-001ee8669bcd", "comment": "Malware payload (AsyncRAT)", "value": "d8549d918052ba6cacea9fb055d8e8991017f8d04def3c88883b88803637782363b209ba7a077f4ad065f2a332d61ec4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996660, "uuid": "606d64ae-dcc2-46f9-a3c1-52bc8f3f4e6b", "value": "T1D4247C16B76951FDD1A7C9B4C9434942EA32388A4B60BEDF07904BB77E226E49F3C701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996660, "uuid": "4be44e03-f0f2-4c0d-8abe-1b13f5355e39", "value": "183388b096f04db8679b00d085f87f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996660, "uuid": "4e85ba9a-5951-49e7-baee-f226762b3176", "value": "3072:IkY8yckIfPJWifvyA3yP+ITv57bbOb6Wt1dNYVO9YHhi331erEMEs9Hb:6cVp/3yrTNbbObbfme31erNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996660, "uuid": "2771f297-f921-42fd-9824-3095cc37a96c", "value": 225831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996660, "uuid": "f74db962-3bfc-4026-83ac-5e98be034d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996660, "uuid": "7773c9dd-c6e8-489d-bcef-63a591cf09c9", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de5ecd0-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005527, "uuid": "a9851bae-f2b9-4474-afaa-6841b1fe9c3b", "comment": "Malware payload (RemcosRAT)", "value": "a9cac565d713e6ae8fb3c22b2d8268d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005527, "uuid": "24987d87-1063-4a38-a58a-b7850da9bfa9", "comment": "Malware payload (RemcosRAT)", "value": "1785db0cee90d76004983b741c8a059d9e1b3811765723ec38bff1da10c4e5f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005527, "uuid": "0cfa677a-ffab-4eab-bc9f-5624f6c93e03", "comment": "Malware payload (RemcosRAT)", "value": "fa4d8242e0b4e634bcc9171ca79c9203f41f3a16", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005527, "uuid": "f9e90fd8-80f0-46c3-a826-af4cdeddeeb7", "comment": "Malware payload (RemcosRAT)", "value": "e5d524dd9c70e85fd583bfc99fcc1627c1537b29b49052219c1bda0394a53af2caba6bd936ae728ceddb6f8633b22c12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005527, "uuid": "520c1534-3bd4-4d8a-81ed-75ec414ed596", "value": "T16235ECDB9F76D69906287E6EC43CBE9D248BCDA004D0AA5BFDB84147F70E64901C4B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005527, "uuid": "7dfb5d80-1a07-4b17-af03-67109e10213a", "value": "12288:ZJ38AX31uPb4yNEECHL2NYpKGYRegk3RPpOrrNYpZBSq5pCs09UlJP66/xwhuLSA:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005527, "uuid": "dd2a8aa0-6bfa-4a20-896b-15b7cd2d5e96", "value": 1060839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005527, "uuid": "85197e6c-a8bb-4b08-8494-708b234ac541", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005527, "uuid": "7d366a3b-b5f7-45ea-baa6-7485dc5b7585", "value": "Swift copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9dde61-9130-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785977260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977260, "uuid": "37a36701-d000-4ca5-9f86-71ce00a7581e", "comment": "Malware payload (Mirai)", "value": "16d86d1b5b2c6a06cc21d942faacece3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977260, "uuid": "4c154b57-3ff1-470c-98bd-ec7134bef86f", "comment": "Malware payload (Mirai)", "value": "17cfbd25034b29242d00aa52257b7edccae959cfc3cc8534d0515e5d4fadf165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977260, "uuid": "50c0b1ef-62aa-4882-ad3e-5004b16aea79", "comment": "Malware payload (Mirai)", "value": "3db4c949578b5ee2fba3ba653373116cc64fcf0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977260, "uuid": "1a8c5ae3-6920-4e58-9556-da2da8b9f9a9", "comment": "Malware payload (Mirai)", "value": "a42778df37249c381aace967fb1cc3ec43e5947c0d0d559601c2ef468397036583c1b1f2bad22c75bdf650d5ef5b3b90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977260, "uuid": "f61948ae-21ee-4783-8a09-a8289fabf671", "value": "T10C43F2AB9284BB38C2263B771C35434FF72264BE99751F5317EBF299C899B542C30821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977260, "uuid": "8ab5a1ff-000a-47df-8eda-b30e38dab3b1", "value": "1536:07hPV608wtwklGUaDeRPSvULZNMALmVuTIq:0JV6itwk4rDTINMAzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977260, "uuid": "bcf2519f-bd22-47d5-8f58-621131ef06a3", "value": 60440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977260, "uuid": "a5b6959d-2bdf-4423-a388-f09f1136b238", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977260, "uuid": "3d6c23e9-4968-4953-af68-ff2e47674ecb", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c382939-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022006, "uuid": "0b991ab5-ec12-4fad-844f-f55f227dbc69", "comment": "Malware payload (Mirai)", "value": "49d2e4cc1be71693d61a2f7c1faafdf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022006, "uuid": "ae02a5e5-799e-45b2-b168-d18f61d975ed", "comment": "Malware payload (Mirai)", "value": "17d30c6e0d88661e9ebed465c517245c82c32f981d86b507d7ad46449b8af259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022006, "uuid": "7e29c0b6-931b-491e-a823-e579ac02326d", "comment": "Malware payload (Mirai)", "value": "48636c8ca08fc4a891bd8b5b5ba9a0774027420b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022006, "uuid": "4c274650-a0eb-4bf1-a755-983ab6957492", "comment": "Malware payload (Mirai)", "value": "7351bb9c6fab3e266980d82e8421b3bac55d174126b0703e2715550536080c30fc25c26dde02e898b33b58b846f86b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022006, "uuid": "9ec5f56e-5229-4730-a428-12b00a6d5e7d", "value": "T1DB230AD4F844D635CBD075FAF50E43DD33034FA8E6E671119E21AA312BBB909493B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022006, "uuid": "b14ecd34-5e25-4563-b7ac-fa141f6b9883", "value": "768:A9m9eBeyJz07mrNptGDkchakKcWkXU3UfuvJhVftlBZ4+LutFPv9OD:A9m4BvJz07mrNpobwkckgUfCnlfvLuXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022006, "uuid": "f974a369-f558-47f7-a860-b1851efa5919", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022006, "uuid": "35522967-6d30-43ad-bd0d-37a96ea3ab6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022006, "uuid": "9e046bcf-b9e6-4a77-a9ec-3fe0e0fc941c", "value": "main.armebv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a87771-9140-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785984280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984280, "uuid": "aadfce65-44d6-416b-b186-29546e08d0e5", "comment": "Malware payload", "value": "efb3aa9cc287d928def315c48f599d96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984280, "uuid": "d83d23ba-eff5-47b1-85f5-a25b3fbb501e", "comment": "Malware payload", "value": "189af4f4616bc74e5aa2e39dcd8d33c668cd792ff84bbe63adaa57fbfc448294", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984280, "uuid": "cc4ed90a-a94b-4786-991a-28d049498993", "comment": "Malware payload", "value": "05907891bb00e27669d25e9da23212f04fdc6535", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984280, "uuid": "a4f9e648-5c0c-4ea2-b930-9ded098583c3", "comment": "Malware payload", "value": "21fbd64f2d90d809646ae241446be1e54834d86833ccb99590ee5ae8144c0ff9392e1a009e600dd1d2a6b47fbde50aa0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984280, "uuid": "3eaf6ca8-e815-41e6-8b4a-4bb41bcad6d0", "value": "T149236D6516857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984280, "uuid": "2123c4d1-b876-46ab-addd-58d43d9cc3cb", "value": "768:pXRWNGxVa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jlxBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984280, "uuid": "0ccafd67-3e94-4eb3-8227-4eceecb071f5", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984280, "uuid": "faf3c63b-81b7-4b71-bb0b-c356a86b05a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984280, "uuid": "d8cd4375-9341-4275-9ad9-44fe197707c2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cb7e41-9164-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785999501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999501, "uuid": "76ca1a7f-1280-4fb7-8af6-b44348dd2204", "comment": "Malware payload (Stealc)", "value": "eff677e44d0f001884e2982bb451d1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999501, "uuid": "6d90e9e0-d725-456c-bbb9-4abfc289c166", "comment": "Malware payload (Stealc)", "value": "18df0ec2efba162d1774b1bf2233c2c24934d2bda49769e814f24d530a795c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999501, "uuid": "294dfda7-c2d6-47c2-9fe2-419cad173d8e", "comment": "Malware payload (Stealc)", "value": "01eadc4c72792e9f3aa96f3bff5c2f56f2a04081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999501, "uuid": "751192db-b138-4085-a629-a02ea6e723c3", "comment": "Malware payload (Stealc)", "value": "5bd8fe31320c8b5e169c971cc06f11d3a397acb52ded0c82e83b03bbaaaa7303d808689eb90e6a95379acfd755ef97cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999501, "uuid": "a4e729cd-dc48-485b-b8c3-423083596916", "value": "T15D069D57FCE208F5C56A9272897265A67B60BC880F2253D72E50F6382FB3ED09D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999501, "uuid": "9c8f3ef9-b65d-4644-a946-57c1cb81956a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999501, "uuid": "33c1f061-612d-4fc2-971d-46adab9522ca", "value": "49152:LnK2vd/w6rbYTJfh7/jrh+wMa7uhRrRpCg7nFPLiVKB8R3:LnX1YJLh+la7MnB/Ba3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785999501, "uuid": "32faf967-0e68-495a-a2c8-dddc1de71e16", "value": 3930624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785999501, "uuid": "46b644a3-70bb-494a-b4af-2cdd9d702fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999501, "uuid": "2825db31-bb22-4198-bdbe-f0e87f9b6602", "value": "SecuriteInfo.com.Win64.Malware-gen.47428979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2d9ad0-915b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785995569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995569, "uuid": "e146fab2-723b-4f50-9123-75428860d01e", "comment": "Malware payload (Mirai)", "value": "303bb43e6023b842f61a1c5033a1d46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995569, "uuid": "05f819b9-21d7-4d70-9428-ad9a2d138e0a", "comment": "Malware payload (Mirai)", "value": "19faa034721fc7d109fb352f4ca82977987e892fb1f9fe27d6f6c12d186223f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995569, "uuid": "e99e9a8f-96c5-4c7a-bf72-a70e28f8fdb1", "comment": "Malware payload (Mirai)", "value": "71d7dc768c244d7fd8ae9af963170c7f5add807d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995569, "uuid": "01b4129d-0a7b-42cd-b6db-c9dc2a38b1c6", "comment": "Malware payload (Mirai)", "value": "ac231a7a9e65aecc203f2109e9b53a858c67ccdf5c71128d01fd94bd42f178e05cc720a76e6f2d2cd36a822606f0e6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995569, "uuid": "8638249d-076a-485c-84e8-8d0ab5e1646b", "value": "T1DBC30A427E528F13C6C321F6FBAE42583B136BBCD7EA3102E9247F5127478DA0E66951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995569, "uuid": "d138aa63-24e0-4096-8c56-2b2201baff85", "value": "3072:t3fPdN8S2MiD0+LvmBnKS7Eid6snnh6uK:PN8SziD3vgKS7Dlh6uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785995569, "uuid": "b98701dd-6a3f-46cd-bdd3-268726bf849c", "value": 125524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785995569, "uuid": "1136044a-b652-410b-a012-07b88767e327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995569, "uuid": "9e79f091-1e86-45c0-a939-e2c43ee3f245", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264a8599-912f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785976711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976711, "uuid": "8ade832e-3915-4a17-8cc0-9ea8bffeef29", "comment": "Malware payload (Mirai)", "value": "e400dab0d2d5f341cb0ed60e4d388501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976711, "uuid": "c19d5603-bcfa-42cb-a266-965c5cf82388", "comment": "Malware payload (Mirai)", "value": "1af0e29181b7839de6d941ce7751a93832b5b07f891157972d8369888f8931bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976711, "uuid": "56a3ab4c-bb08-4baa-8c6c-fba15afe198b", "comment": "Malware payload (Mirai)", "value": "83c96128d0a00c628ca6df6ad4b3c242aa3e8d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976711, "uuid": "7aaf96f2-b71e-408d-9054-fa0fa03e60f9", "comment": "Malware payload (Mirai)", "value": "37ea8c41cca768e2b5f7cee65baa7939c48eef3b9e81ab68942082a879e189eb7a4b5bb790bcce4c44cb7f932c75d2b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976711, "uuid": "48c89a6a-c662-4df7-a382-3bf6ed62e947", "value": "T102043B49BE642BFBC06FCE70052D834621DDA44BA2F5A73D6278DD4CB9AA2485CF3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976711, "uuid": "c088c6e4-19f8-4b94-b279-0ac55efdb585", "value": "3072:VyZHgiHkvSyKkUXY7cgkESG5CwKo6Z06bHr17P/JZfrE13lF1DA4:8ZHjHkqyKkUX+cgkESG5CwKo6Z06bHr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785976711, "uuid": "1d7155e9-243c-4339-a318-0751cac2f22e", "value": 180904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785976711, "uuid": "da7669a0-40cc-4d45-98cb-7dc6236e6984", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976711, "uuid": "bea29784-b659-4176-a630-fa2ff904d144", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa496e44-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994247, "uuid": "98a8b69b-9218-438e-b678-7a8ed88cf74f", "comment": "Malware payload (Mirai)", "value": "39cf163fdeecec2d57a3f7b39efa6c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994247, "uuid": "15b2c3f2-024e-497e-9d04-60f3986cdb04", "comment": "Malware payload (Mirai)", "value": "1b036da980d67eb67ee1bfb458d3cfd198a7573ca0f392ec3715d2c9629ed363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994247, "uuid": "07c06777-e696-423e-958c-34c646e6396b", "comment": "Malware payload (Mirai)", "value": "d76798e3c6b2fec0024a68d5da86b3665a78c8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994247, "uuid": "7906f583-2797-4fa4-8e57-0e8d60c1e23d", "comment": "Malware payload (Mirai)", "value": "4277111d79be09229b7fdc7dfbe75eae8dffa270ed0bda51b4934757cacb726038cc17b9d1cc16d317bdf09f34ede438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994247, "uuid": "b4657a08-29c2-4c49-9d98-2992de4dcf5c", "value": "T15543F16419C62D1AD3E21131C6FDE681A90037F53B763324A619AFA9834740FBEF920F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994247, "uuid": "8ba1c2bc-be20-4907-b293-18bf14ddadfd", "value": "1536:Tn47cia83jYUfGzO574bMR1/j7PvVUBLEOcbf9:zTx4Mu1rrOZEpbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994247, "uuid": "ca02c26f-0db2-4fe5-8632-f2d56bdeeee5", "value": 56436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994247, "uuid": "6f81069c-4995-45d7-86fe-3b16fa333b3f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994247, "uuid": "861aaebe-cd84-41f7-8f39-302b854dd3ba", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e9bf2f-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786005455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005455, "uuid": "05cac3f4-caa4-411c-873c-b9a1679c2c5c", "comment": "Malware payload (DarkCloud)", "value": "6ab606828698e53ab67ae8f4929660cb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005455, "uuid": "bc4bca8a-36ff-4065-b688-4720340a74df", "comment": "Malware payload (DarkCloud)", "value": "1b4b340e5f010c154cedfcdd43679d603fea760521c5f007172cea0d76509a7d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005455, "uuid": "a7dac678-fc95-4ebd-b332-06e55742537b", "comment": "Malware payload (DarkCloud)", "value": "968409480259d43e2aa67a07171d4d23a555fc75", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005455, "uuid": "bc771b90-e352-43c9-85ae-3d38cbe178c7", "comment": "Malware payload (DarkCloud)", "value": "af6e65a369e823d89e1bfd7faf7572a4add745b3ebd412d76003ac4fdaa44ac9f23af3465851b3fe8c1e520eea9a2c50", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005455, "uuid": "42077f87-3bca-4182-a4bc-9f13f7be2686", "value": "T1413546860AAE13B6E7414059EF55A52CBD1A144EB91C08DF3C226CC7C7632AF866F7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005455, "uuid": "07ae7cef-c14a-4847-a5e3-4b4c063a8046", "value": "96:KEGvSuRTZ4Gzfjz8fuLKlTGyIGQujR06HfE/QVX6+n3NJmyeEq9zPRcRJbk:6X4GzfjzPKlGyIG1ycX6+3/myR+zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005455, "uuid": "f4d0065b-4117-42c5-a152-3d88813d6d63", "value": 1067093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005455, "uuid": "5e65d6ae-d312-447a-b0ed-99e4e3ea9006", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005455, "uuid": "e471a7b3-ed0d-43cd-a62e-b4aead2fb1c4", "value": "Datos_Bancarios_ZencoExports.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642c4623-91b6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786034797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "c7a8f1b9-0a22-4e4a-820d-2f05a65ba470", "comment": "Malware payload", "value": "90a10eaed184ba00b429a8a399898c65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "d4829b71-a438-4cfd-a92e-405bfed24bed", "comment": "Malware payload", "value": "1b873c981db25d16bd539aef3952a2e869dd55c27e0937064cafc5dafb70c79a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "408a4f3d-fd17-40c5-a823-2a0f48e240d8", "comment": "Malware payload", "value": "bc9b14eaf9172cd065fb932bfd76732a9e79a43f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "0ecebcba-2e27-4cf0-aee6-f214d565a283", "comment": "Malware payload", "value": "241f0851ef78151a01e876732af990b2ea3cbd335f570cfc784db35abbaf1da63867f6674c135d7344a354fe7109280b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "537985f3-a6cd-4241-a620-e0d69bc94721", "value": "T1F2F4F2B579ED0C5EEBB2DD56F4D2C103FB3481D2062451CE9EEE0276C74E68A837642A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "64c7cef5-7c7d-4bd5-b99d-7426ce511bd8", "value": "12288:lwj+e5IutXeiuykpPNCLowCQU+GrrCXhhHxyXJ2WDvsx2RzDEz8yYB:lwj+itXeiuzwCfR8PQXoWsxSDEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034797, "uuid": "987719e7-1b14-4cd7-85e3-feba6c59a987", "value": 731153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034797, "uuid": "05d4bb70-d374-4411-b602-cf1acd437317", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "0e57b4f0-9012-44f6-8e04-3a1aa6c8af6d", "value": "purev2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21afd8dc-91a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786027384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027384, "uuid": "0a79136e-5f18-4e31-bf7d-296d99db6448", "comment": "Malware payload (Mirai)", "value": "6f5519ea2a61b205ef01dd5f93d99bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027384, "uuid": "5e1f90a6-a5f0-49fb-8968-8ffc3eceb318", "comment": "Malware payload (Mirai)", "value": "1bbf6bd62161b07322b059b9cd964d28e3e019e777bb57edaf476b3430675c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027384, "uuid": "5a9c59da-398c-49c5-8225-d99e00b64271", "comment": "Malware payload (Mirai)", "value": "d929139733cc4a336d54858a1c06c11f0478ce3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027384, "uuid": "6c4e9393-5e75-4e1c-a3eb-728526e9dc7b", "comment": "Malware payload (Mirai)", "value": "05bec1396bb970e7d73e2d1cd2319c362bc9b4125cde90941df4df28eddf5fb8c4dea8beee39ec06eebc8f4509d9c58d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027384, "uuid": "3635b726-4192-4baf-9682-1da37a24ca62", "value": "T118E4E80B6E328F7DF67587314BF70A249BAD23D627E1C581D1ADD5141F2028E582FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027384, "uuid": "fcfbf6b8-1617-4d04-b51e-d764e8e581a0", "value": "6144:FxPvFx1p3SNwbefImS+Kk5XIE2PMF4fTq/7jya+qDGM20y4K70DOht1iR6RdsdSc:FVvFoa6LePMiphEgfaQPoWqnwHLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027384, "uuid": "3485d0e9-12d7-4220-bc80-448e2b0821a1", "value": 672068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027384, "uuid": "e2d6f364-22d1-4af6-b284-20874beeb678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027384, "uuid": "72407eef-4df4-4ffd-8f9d-899e92dabbeb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88423a59-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994485, "uuid": "cd1affdc-8a87-41ee-9e2f-0e4c56a120ea", "comment": "Malware payload", "value": "a9fef4337a5742929e948fbcf100f733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994485, "uuid": "49e695be-a481-4b31-a053-2bd7300f067b", "comment": "Malware payload", "value": "1bcc7b001a6f2aa432fe718147fdf91c3d8a59662ca7fc7bf0cbca5e98ab014d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994485, "uuid": "96caa051-86e8-4ed4-b25d-7817c1acf4db", "comment": "Malware payload", "value": "6cd79fef0d8af307e63edd287b33f2ebc4bffc36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994485, "uuid": "000b06f0-0134-48c2-a9b9-a80b4aae90e9", "comment": "Malware payload", "value": "a24cb8842b79bd2026d5263433d165eb99678e43de16274f3541b5ba9818a2e9cc836e3733f8c834bcc5708710230496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994485, "uuid": "8a4946e0-cd2a-4eb9-a98e-ad59edf5dd95", "value": "T118A3F806BF600EFBE82FDD3706B9074635CC655612B93B367674C92CBA5A14B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994485, "uuid": "2deb6508-bca8-43bb-85c0-cda267ef1cd7", "value": "1536:K4XkcEqhPm6hYr3Ie5oigAVt9+hTD7GJCFP2omg05O+1Cw7vKihpLLXSowk:KxqRm6Y3r9+kA+wSTvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994485, "uuid": "eaddf879-30ee-41e5-8c50-aadbe3472458", "value": 105244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994485, "uuid": "36953cce-d6c3-420e-b2a6-eab2f2f2c521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994485, "uuid": "32762c7f-cdc2-459f-b1e8-b94c8590ffa0", "value": "lul.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13044ad4-9140-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983980, "uuid": "2625ac1d-d959-4c93-b9db-1ebbf39c4d56", "comment": "Malware payload (Mirai)", "value": "b539134199dfe15bb52c8dcfd47df01e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983980, "uuid": "9b09d04e-071f-4fd4-9fdd-b913a74cfd43", "comment": "Malware payload (Mirai)", "value": "1c246410593a1d5bc31cf4d58c6905df5e30fa7948c23e82ed424d6c9e2198ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983980, "uuid": "fd4f63b8-8b9f-4ea7-9e6e-706d6d07eaba", "comment": "Malware payload (Mirai)", "value": "7e59d22ff7754f05f155d0eefe19cfc4d3aa9d67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983980, "uuid": "09667080-0dfc-4eec-8f20-09c74b757e00", "comment": "Malware payload (Mirai)", "value": "3698834449d689fba13dc2e7e862719df26df3abeca66508105e1cd77b790ee9dbf6478e8a9038b62316203900ed0e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983980, "uuid": "d747ded2-63e2-42e4-a85b-1f50ce15986b", "value": "T1A3F32989EFA60FDFD46FCE30021E131719DD589B92F16336867CDD48769E6088AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983980, "uuid": "78973353-aa00-48ae-9171-52879935fa54", "value": "3072:JgK/zPOoLvWIav3+RRMgtOzfd7V2eFBl8f5omb2kYubOQ8Magf8VX4bgy11lS6mF:qK/zPOoLvW1v3+RRMgtOzfd7A5omb2kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983980, "uuid": "8f3fb122-45cf-4c44-a09c-529b84753ba7", "value": 167204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983980, "uuid": "a4e43174-b1ee-4559-9eaf-745c905e694f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983980, "uuid": "0d978b23-327c-4a44-8e88-b303499fe543", "value": "killbotx.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898110ab-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021975, "uuid": "b7bf479d-6a5f-4421-b0f4-689205ac0894", "comment": "Malware payload (Mirai)", "value": "f4aa700a4f0bc5d0a71a06186d5251a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021975, "uuid": "e65dbbd5-fb27-4672-9582-85b6a42eef25", "comment": "Malware payload (Mirai)", "value": "1c479b17d535928324765344297c6db41d144187130e411a950899c27ffb645c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021975, "uuid": "6270a27f-87ec-4aee-81ad-07c5bca61222", "comment": "Malware payload (Mirai)", "value": "8527551b619d3df538249413f5de641bca25231c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021975, "uuid": "1ad1d37f-0e6a-40ca-854e-2250eb407fb7", "comment": "Malware payload (Mirai)", "value": "d724e7bc7c2f01e027a35f7b99587c73202c83d7c6b2f372648c26f819ec31a10ddf1118cfaea212c228d63da835a0ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021975, "uuid": "49650f72-8d32-4c7e-9f9d-57648bd1d7fa", "value": "T16E132BBBDE0E3901D3D4E334EB590BE1A02FB924D29640B77E02718DC4ED9DD8DA2256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021975, "uuid": "2c4a17c2-c987-46e8-bdf3-7a03dd507fed", "value": "768:RVzsLZfKV3xENebAaPHXkjHANYfAWp6VxL4VoCw9aBJ:RN4fKVyOAGkMNCAXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021975, "uuid": "9a8befdb-dcb6-451b-a02b-6ac8741506b6", "value": 42040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021975, "uuid": "7865a20f-d713-43fa-988f-e9133fb6d448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021975, "uuid": "273252ac-2a93-4d9a-a70c-fab7184833d3", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587cccd3-91a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786028335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028335, "uuid": "bcc69248-d813-413b-89a5-368f623733b5", "comment": "Malware payload (Mirai)", "value": "8e2bc2ea6a4a092411036d610e14b79a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028335, "uuid": "093db35d-2dae-49f7-807f-b04964c4b8f3", "comment": "Malware payload (Mirai)", "value": "1c64899131d6e59c20a7523f9fe301fb09e6c3c0cf98453e17932ee074bf8162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028335, "uuid": "10b34439-611a-48e0-886c-b43288446fd7", "comment": "Malware payload (Mirai)", "value": "4dcb87954fd08fc22587d9369eb5b9546bedc87b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028335, "uuid": "e344fbee-c5e5-481f-9b27-fa5cc5bc1c6c", "comment": "Malware payload (Mirai)", "value": "f7f77e085d15bb3e98f687268481733be0c04773cbf600eb1668654700dab33da6cd9c77b62535db1e2eb341985dcc67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028335, "uuid": "f5945fe8-b097-43de-b402-4174f7d9db6b", "value": "T1B314C71AAF510FFBD8AFDE3702E90A0235CD951722B43B353674D528F54A94B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028335, "uuid": "2e688f6c-c753-46fa-89d7-a1f613b4f000", "value": "1536:MEy/YSqbKe3ViSl9fAAEKSyCIXawljSaSm+9vVUeZD8wLZg7Os1m4xxSTPi0efNi:ME6vqecY2qw9+MeLN3mAPiVay7eE/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786028335, "uuid": "dd29dc3c-abe2-45f5-8d89-2aea3445c5ca", "value": 192804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786028335, "uuid": "4c2bbc53-5f2f-4c8f-a6f1-14b6521b73d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028335, "uuid": "39f8363d-d992-4741-86ec-e6c68ccafa88", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b3222e-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994851, "uuid": "3229cb3d-5aec-407a-b34b-15e881bdc427", "comment": "Malware payload", "value": "2647d7b7d542bcacb104413b17294bc5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994851, "uuid": "9226e227-1032-450d-9d25-c006f4268fe7", "comment": "Malware payload", "value": "1c70291705d788ab2af26368b487414d4a8462eee1dacf7b8c3732bfa2704409", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994851, "uuid": "bc14d87a-70ab-4df3-9669-41cf3e5aaa91", "comment": "Malware payload", "value": "cf4f984b8b73e45582bd515e642d75af807247db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994851, "uuid": "d9300f6d-1abf-4704-afd8-473bb0176d06", "comment": "Malware payload", "value": "50acbf3bcc8967a69e7d9b82819f29b56783dd2a71c782e63676ab597b3d45a2fe148a73e05a023745dc8630ebb92b67", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994851, "uuid": "2a942a9e-e61f-4192-9f07-102b773787d2", "value": "T146C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994851, "uuid": "00c121a6-2026-42c8-96d9-b915b1a5f52b", "value": "768:m8vCB+25j6es8RJg09FYpMSUpi+20qUpi+20YQX:m8l25JJBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994851, "uuid": "9c27514d-6a87-4129-a190-a3a5f35f2d1d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994851, "uuid": "30f8c586-96a9-4d5e-9567-47bc7ffd7eb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994851, "uuid": "0c508f2e-579d-467a-9b6d-5d538efa35e5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b12af6b-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786049009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049009, "uuid": "72c9ef12-5bfd-46da-a6c6-15d8a306bdbc", "comment": "Malware payload (Mirai)", "value": "9103a6151d6319be54394010674a91f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049009, "uuid": "846a6848-9ea5-4660-8cb3-aa6ea77235d6", "comment": "Malware payload (Mirai)", "value": "1c9a02a4b88bde482803f79a2e7f0fd2498dc7361c2263d67c684b6b12dfcc5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049009, "uuid": "b46dd585-26ad-4589-8fa5-bd944a519088", "comment": "Malware payload (Mirai)", "value": "ce74af00017f693f44918abbbc9969c3f6213279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049009, "uuid": "ef499db9-a994-4665-a3c8-09928518e6a3", "comment": "Malware payload (Mirai)", "value": "6a863c823dac5354ca9135c6da2fb05556268f8a253cf6ed89a86a7d3c64e10506e7e340152d7bcdc83cfdba9b9cca61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049009, "uuid": "b739eeb6-8d67-4947-8d38-5a505cddaf1b", "value": "T1EAF33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049009, "uuid": "e4a60fb2-beda-421a-9e20-b88e54300d31", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHffam:9FJMgWPZr8IaCWReS1WpPeA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049009, "uuid": "8ee4cbc7-17f7-46d8-b7ea-04792e8078ce", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049009, "uuid": "3578249f-2c91-48e9-b2d5-e47d61980e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049009, "uuid": "969bce9d-51bb-460c-ba4b-6086ffca54c2", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4898cebf-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vjw0rm)", "timestamp": 1786026590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026590, "uuid": "d6656ae2-d8b1-4eb3-997f-19230e5d1603", "comment": "Malware payload (Vjw0rm)", "value": "b4a88013850afaf9adf89e3d0077451b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026590, "uuid": "45793f69-7ecd-45dd-ac4d-37c6333124dc", "comment": "Malware payload (Vjw0rm)", "value": "1cc5e6cd1203b4bc40ba3ab4400d602e6a16251868455684f200b2903dbdbdd6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026590, "uuid": "1d0398a6-ae54-47c3-b198-8f3be05b22e7", "comment": "Malware payload (Vjw0rm)", "value": "2d2b98642ae8b832a859bde4a5a7b33cbf09c389", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026590, "uuid": "8de733a3-7af2-4f86-8ef1-9243ca175d57", "comment": "Malware payload (Vjw0rm)", "value": "f2e3695d8bb97c548e888eebbee4273e1967476d60dfacc70bb5595c268222fad1ed738a895e9e8e95d1cfef020c3449", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026590, "uuid": "079f5907-fe2a-4763-8652-27e81abc59cd", "value": "T198949C4E416E683BA4F13713B7F63C09520590E71C30948A615AF8ADAFCB1797EEC729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026590, "uuid": "570c0c14-8b83-4eb7-913b-fd52ea615644", "value": "768:zdRijSoK3lmvZlJr7lNEk9gpJkD3vC7zIyQuMT7+tje+IzjTamunda2C4:nUTaHdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026590, "uuid": "d80a0572-f175-40ad-8b2d-c3cb300bde29", "value": 430113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026590, "uuid": "738460a8-0933-4948-af65-e1d9f338f021", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026590, "uuid": "bccae904-0c65-492a-be5b-8504d566a537", "value": "ORDER-268609-78969PT.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a9afc6-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022002, "uuid": "88721936-10c4-4d11-8947-e36dd6620881", "comment": "Malware payload (Mirai)", "value": "64ca0bb2817865d12f7cdecfe722e674", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022002, "uuid": "d9329066-1817-432b-a1ca-8fd399c75556", "comment": "Malware payload (Mirai)", "value": "1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022002, "uuid": "8e6dffa0-b59b-4953-ba03-c8a86adf5f46", "comment": "Malware payload (Mirai)", "value": "99b86b29507686e411efde833a466927524b7c5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022002, "uuid": "472c15a5-79c1-497d-a12c-a5266b2e227f", "comment": "Malware payload (Mirai)", "value": "d6fd2e691fc495a8e90747167b0c0a822dd995e890389ad4c2d62e5d62dbe2972c60e6319c1ded741a924ba888ee3679", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022002, "uuid": "af19d3cb-ece1-43a4-a22f-0ca5c40c77e5", "value": "T1D551648E14A0563DA4BFDC9C76F74600E84887E175B23B289EB41C639CC7A34B369E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022002, "uuid": "d0d37760-ce59-42fe-ae3e-1fb2effe837d", "value": "48:7CDU1aT8GWAxqcF6EFGOe9GGGVUBSA65Xr8DYXO8GmIHbQjfZbMPf9JSXLcTYleN:7CDU1aAyxpF6EFGOe9GGGVUBSAyr84Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022002, "uuid": "c98867e5-c9e6-4271-a321-e42aa8948f3c", "value": 2704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022002, "uuid": "7103f691-93e0-494c-a650-061120e661ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022002, "uuid": "a47c8491-ef83-4e22-8ff9-d289251ab9e3", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa332be-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050511, "uuid": "d4791e30-f7bf-449b-8c70-0c95158d221e", "comment": "Malware payload (ConnectWise)", "value": "1c3de5d59d0d41f5c593c4ecf152cfc0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050511, "uuid": "8e63bd06-d67b-46bc-b728-e0ec02b9aa8c", "comment": "Malware payload (ConnectWise)", "value": "1d9a1b096c4ae71f9c0403802667ea0b3492de2d57281a6d4145ba5758e74bad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050511, "uuid": "b69b8248-54b4-4ea3-a8ab-08963224cf07", "comment": "Malware payload (ConnectWise)", "value": "3d927f1e53fcb9d1873527fd760e6910eccd8b21", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050511, "uuid": "d736cacc-cd1c-41ba-a0a4-31adaca6b7d4", "comment": "Malware payload (ConnectWise)", "value": "a501998d16bdb02ff0cf6491f814550d5113d4475591afd357fed0bbe73d1cf9f96f5362ab86ad1044f6bbd20d2dfd05", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050511, "uuid": "149bf1ad-0ade-4a04-8fcf-b2664031c349", "value": "T198646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050511, "uuid": "5342f55b-5b61-4067-9405-b4cb684968e3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050511, "uuid": "e32d0ba2-00a4-4c48-8a10-158d6802312e", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050511, "uuid": "f22c68f4-33f2-4b90-91f0-471580814b00", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050511, "uuid": "594b3bf9-f41b-47c7-8676-e42e292c4db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050511, "uuid": "fe4bdfdd-6849-4e9f-81fc-990171a59c3b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3f9d7e-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786026221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026221, "uuid": "ea785274-1670-42a5-aa6a-b418f0e662c2", "comment": "Malware payload (ConnectWise)", "value": "3c3cb5457de640745a61405ee4f157a7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026221, "uuid": "10da4f12-69ab-4411-bff3-61340aa33a74", "comment": "Malware payload (ConnectWise)", "value": "1e3dd6caa009c9eac37fe6ab54fb27f84e34c48d1c28b2bd93612ba44ae14b93", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026221, "uuid": "3f65b444-0f9f-4408-9779-72848dc840c5", "comment": "Malware payload (ConnectWise)", "value": "a1b692780d5727be7643316df9ac66b2e841f288", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026221, "uuid": "113c1aaa-d59f-4404-b7fc-ff172b347ff4", "comment": "Malware payload (ConnectWise)", "value": "ca47106d18e7f76b81d7377c59fe38301c8e95c8b650ed7aee176adb1996c4de349870ded6d02e55ad9a105c0e5721cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026221, "uuid": "37bfd062-7496-4848-8b4f-7097aa8eeb36", "value": "T116C61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026221, "uuid": "95dfeaa1-33c2-4898-8290-6970b890e592", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026221, "uuid": "bf67060b-6257-4b3a-bd45-7327eebc1f47", "value": "196608:B1TfefPqfQyiixtMjGZ1jhlrwUNQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMjA:BwPnjGrrGPnj5PnjgPnjqPnjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026221, "uuid": "c89b010d-3dee-4bae-83f7-a1f7b95d8130", "value": 11624136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026221, "uuid": "ea051c27-f305-47f2-b6c5-055dae3da4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026221, "uuid": "1a5d7901-a595-40cc-aaad-54c821e7ee0c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026609a0-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "4bc02f2a-124f-4290-b708-f9c9e39dce45", "comment": "Malware payload (Mirai)", "value": "3db795cdba32c4002ce7a4cfcf625bc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "e34c5414-e540-47e9-93bf-cf4035c2d055", "comment": "Malware payload (Mirai)", "value": "1e688435e004462b2c4291ca3e691f7543d59bb83a665b6d85e3a9cecab92249", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "4ee86119-fe6f-429d-b199-61d1137f7dbc", "comment": "Malware payload (Mirai)", "value": "5861cd035e679931edbec106a3fed9f9de8c9473", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "67fcd340-0d34-473f-be15-564889588610", "comment": "Malware payload (Mirai)", "value": "e4fe39ef6d9014d6baf9d642d9848efb4545adae7395e341973ed038530b9a60747959426082f06ab073d87db08c29d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "cb81cc6b-3fcb-4886-99d2-aa8a80d412f4", "value": "T1B4D35BB3D825AF58C564E5B1B0318F781B93996082471FBE19BBC6748087DCDF61A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "ba6e6b2f-45dd-4d66-a316-02fe5155e12f", "value": "3072:ZWbCJgC2++9dLrmjCEZKgdkFRk9WZTIphjb1D:ZW9Z+2dLrmW7geYIZTsjpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048377, "uuid": "013992ca-72c1-4803-a400-87ee001abc8b", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048377, "uuid": "ac385f09-98c0-4ca4-ac17-96905915c78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "969f4ad0-3bab-4070-a3e7-5f46b702acd6", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48658036-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005545, "uuid": "ce220b35-f431-425e-878f-fb30bc5e4fba", "comment": "Malware payload (AgentTesla)", "value": "51950b1f62f3866ed707d406e49974ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005545, "uuid": "fa11fcee-2a4b-439e-aaa4-d3a0c17414f8", "comment": "Malware payload (AgentTesla)", "value": "1e9fba96624c720a156751feee1820de1bb63cdb231c0fb19c29cf782240c83a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005545, "uuid": "756512c4-7a3f-460f-be67-3d4aa692fc6e", "comment": "Malware payload (AgentTesla)", "value": "d2cc070ffc5362b2e16749b065d599dc80dda8ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005545, "uuid": "047c8a4d-7443-454c-a1c4-79b36556c473", "comment": "Malware payload (AgentTesla)", "value": "456e7a0365fec5930bbbb3f8b312b405e72224de854741240edb3dca067500433d1d3252a781b8a6ace78129cadd2dd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005545, "uuid": "545ff501-8a43-4a8a-9c04-4f366960a063", "value": "T1A7D5F6912744D172BB20BBAC553ACE359A0EA04354C2EF05316EE704776DE5FA39CEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005545, "uuid": "b73f0bc1-dd31-4073-a9af-48b853805282", "value": "49152:mgDoeqjxR28zoCHXlZHTJyspHjF4XX0hyH1JB6ZjDFjsap+C1botXmB7Zt4xHqA4:eeF8zoCH11TcERGDH1JB6ZjDFjsap+C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005545, "uuid": "f776a85e-2b79-4d80-9cc7-1e9673a5dc77", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005545, "uuid": "10462b9c-1102-4313-a0ba-9d8a0434fe99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005545, "uuid": "ab280965-675c-4151-9f73-db78ab05aa8d", "value": "ORDER RFQ 1180.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613869dd-919d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786024055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024055, "uuid": "caf1d129-2e9f-4e4e-b846-f1bfdbbf0fa6", "comment": "Malware payload", "value": "dc4434554caa0ae389968efa3a931d4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024055, "uuid": "c9dbe442-083a-4220-8885-cfd93080f81a", "comment": "Malware payload", "value": "1eb79334959c8af6e706f1dc863e713c6596d736ad75094dda9624f5e9f32b03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024055, "uuid": "9345d376-ab2e-40fa-873e-a5207bcabd8d", "comment": "Malware payload", "value": "296673c84a3e1362b5c10f6a308097c84638fb98", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024055, "uuid": "1dfec496-61ec-4ebc-b2d3-8fcebf7e7afe", "comment": "Malware payload", "value": "ba4bc0ef31d126aa696d7f84539b5d85d8eae8dd0cbcb8429ff0f1dc535de49393f0cce9014de7eec761ad357c58e21d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024055, "uuid": "08328589-020a-426a-be60-7eff35523301", "value": "T17BC27D956A96BC44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024055, "uuid": "4426da57-b0ce-4f9e-a338-a7707ee67265", "value": "768:+e8vCB+25j6es8Rj9FYpMSUpi+20qUpi+20YQX:t8l25Jld2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024055, "uuid": "a585f39d-eb05-4212-bcc1-e37d5864147a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024055, "uuid": "d8c7aaa9-604a-4b40-b66a-30865e72fb2e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024055, "uuid": "72059736-6d13-40b4-acdc-6518568f3198", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb66d9b7-91b7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786035453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035453, "uuid": "a6e6eac1-6346-40a9-8081-ea7b32a718a6", "comment": "Malware payload", "value": "2d39a10f1e7880256e0734624e3b9e63", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035453, "uuid": "f6a75040-f496-4381-8426-5fac31047d1f", "comment": "Malware payload", "value": "1ebe448239c0ce1a085496842a85e6824a8f746e3057564c3cc7af895c371474", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035453, "uuid": "35748038-01bf-4200-945a-1f047fbaf4ee", "comment": "Malware payload", "value": "c1ca9e1b886a4fcc040fc5ec9d09f72599819d1b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035453, "uuid": "d913247b-b683-4b28-ba67-a27073d21deb", "comment": "Malware payload", "value": "f5b9c879cffe4616ae9d35958f6a1dcc3efb9b49249fa3f81819d40ad81ba493f39dc7d0eb12c3abf7f841d2e9e27bb1", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035453, "uuid": "3f9fd6fd-7cca-47a3-8e73-b24aaa318888", "value": "T19C059DCE633986D5C83DEBF884318C8129BD9A54949686AC76D078F4E188C5F31AC7F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035453, "uuid": "c95d6e9e-7641-4940-aeaf-1dd6680da4e1", "value": "0481dde48f496cbf90713f18a1bcff37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035453, "uuid": "f72b85b8-3bca-4760-bfa7-23eaa4a11b8e", "value": "12288:V2/FDOpmOW7e5N4AO6cquuDs6fLtfI4HsyqparPf:W8m44zhxuDtLtfxMbif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786035453, "uuid": "54e132ca-4989-4ebd-9bfe-ccbd63eaeb2e", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786035453, "uuid": "bf6be263-836e-470e-93ac-a0e3682f0b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035453, "uuid": "bfa9e717-6460-4cb8-b315-fb09ad3dc4f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6ed581-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786008962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008962, "uuid": "90a0c5fc-48cb-4d26-aa69-2f4a7e362a01", "comment": "Malware payload (Mirai)", "value": "4a492670d875bdd10f4fbd29a842e162", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008962, "uuid": "82ed7952-f990-49b7-94b9-108485f5ca84", "comment": "Malware payload (Mirai)", "value": "1f8f8352a5cc7597bb82da52ac8d80d2ee4ede12ea8cb5114d47d2222bcead0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008962, "uuid": "d08a5e99-ac35-4c5b-a4c6-a6ca79506920", "comment": "Malware payload (Mirai)", "value": "ccca01c634025ca5f7a64effd224373d348c9541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008962, "uuid": "cb7bad13-17b0-4e8d-8736-ee1c23737448", "comment": "Malware payload (Mirai)", "value": "c1ff378b2e594d0bc67a4abaac7a32760d4ef62c56ce79cbb7667b16cb12cee0b8cc01bd6f10436d30c919706032ebda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008962, "uuid": "5867083c-0a9c-44e1-90c7-12cb7831655f", "value": "T19C6302B04EF9A23CD858793C4920EC096444E87F39641E86B0E0DB9B6BECD3565E6C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008962, "uuid": "740ad0d4-3d00-49fb-935a-aa9b6bd5ab7a", "value": "1536:pLToIwAMvx7LTG/MB2hhzCX5gPes/3FyKFJ9faEHGSOQZ:hWAMvx7LKxnzlesUK71aE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008962, "uuid": "1ca6fd91-61fd-4380-89df-73651ee52747", "value": 71928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008962, "uuid": "9a819d0c-5d58-48d0-ae18-b3fd277ea022", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008962, "uuid": "bd019b0f-4d7d-43f0-aeb4-a15b671b24b6", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.17163.25947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224a3f1e-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994314, "uuid": "ad4e8083-a9bb-4f99-86f0-ed019da57ab5", "comment": "Malware payload", "value": "44ea1629f406b0436737242d5b552a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994314, "uuid": "197d0934-2fa5-444b-a7eb-9815127efb6e", "comment": "Malware payload", "value": "20083bc9cf0d3cb222b40a80ba78af6e6479cf3c5b2d610e2c611b995a57388f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994314, "uuid": "1169dfa1-dd1b-4f78-bcb2-8c87f3647835", "comment": "Malware payload", "value": "48c05d13ba14ed35ab6e478f51427ecc11b1d337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994314, "uuid": "f9ecceca-97e7-4f1f-ad8b-4895591c6f6c", "comment": "Malware payload", "value": "149f37f9a92970ac39d1f6efad03ead9495f5ddb6f70d9a9c3f6a81ed14ce085732d1737dac9cbee3c7d669a5c2271a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994314, "uuid": "f083ce7d-db81-43b6-871b-fce661255a2e", "value": "T1FC476D13B385D42BD0671A76882B86E4993F7F206A25885B3FF43E4C6F35B807D16A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994314, "uuid": "c22bbbdb-522c-4743-9e9f-0089be028aa6", "value": "d16a823f7e40c23f28b4fd39a1c3237d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994314, "uuid": "44c79a57-b50c-46c1-bf51-f770b5f278c0", "value": "393216:1ji61xGgpRovb1BLIOxaX194qXfcozFbLOj6/kDWwP5igJe5+F/c2+bUDhjhaXT/:YaOxaX194qXfcozFbLz/kDWwP5igJe5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994314, "uuid": "b0479d6a-fa5f-4cd4-8f40-7eb62d05b0cd", "value": 25028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994314, "uuid": "ac12362b-97d0-4fc0-ac98-b97a6c7d5595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994314, "uuid": "74315bbb-d87a-40f8-b847-a4f25684faf4", "value": "44ea1629f406b0436737242d5b552a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b8480b-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021994, "uuid": "609a8baa-e2d9-4870-a839-1ff7b051644f", "comment": "Malware payload (Mirai)", "value": "790d5092427b2e2718af47fd485389f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021994, "uuid": "1698ce03-3bae-4fd0-8ccb-15cecdfbd4e9", "comment": "Malware payload (Mirai)", "value": "20153f76d585aaf1896d3b0689770bab3ec9fdd829121b5f4d0fc1e5c39ee686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021994, "uuid": "e9e9c9dc-cee7-4e8f-b8b9-eac09df4ab5f", "comment": "Malware payload (Mirai)", "value": "e561822d7d9ba641139d270cae7fa4a4100e7ba4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021994, "uuid": "3099d868-d966-4574-b74b-b10b09e752a6", "comment": "Malware payload (Mirai)", "value": "883f963fe1e82e3d7fda46f12fdfefbe8f743cf6e3cbbc35b063d61feb9d04a7e4d077bdc6c907a835ef9ef37d3c2762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021994, "uuid": "aa462e99-4b63-4e6d-bd15-6755179126fa", "value": "T1CA03D747631D0697C0672AF43A73ABF297BABD6102E49140661ABFC053319F02593FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021994, "uuid": "173805bf-d4e4-49da-88bc-3f6af55fd069", "value": "768:30wwfNvitv49QN1Ulbr1IxkiIPes2utw1ze:kwAQUvIKiRu2xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021994, "uuid": "aba26738-7b3d-451a-b225-f9f23fc6011e", "value": 40180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021994, "uuid": "b25f239f-7145-4631-bed4-ce195e17191d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021994, "uuid": "f5a0265d-9b1a-4c43-bdbc-35196fc3893d", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6daab03-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040197, "uuid": "8c0bf521-14a9-4987-9b82-7f6b32759fa1", "comment": "Malware payload (Mirai)", "value": "4b2037be98e30778ff7863e6705dba56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040197, "uuid": "72c9fb57-23df-468d-86a5-8c0f66714193", "comment": "Malware payload (Mirai)", "value": "2041c7cd9bb82f27e85f3f0ed3a69f07ee702a9f09b5a5005fb70e53893694bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040197, "uuid": "91620093-f79a-4400-911d-738e7c4d612d", "comment": "Malware payload (Mirai)", "value": "fb2bdfab2caede276b4f9ef504f4890bd3dc1055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040197, "uuid": "8bf3c813-23ce-4f7d-9624-704863f9f698", "comment": "Malware payload (Mirai)", "value": "31b20a62d24ea0c42d1cd5c491a54831e78d64f9fb0c548a6bdafe9df0b36185ae79d60c757f5e00438b41135c82e774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040197, "uuid": "57e1776d-9753-4697-8ba2-5c476ec15bd9", "value": "T1A2542965ED41EA15C2C116B9FE9E418C33036FF8D2EBB113DD247FA4368A56F0E2A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040197, "uuid": "9d676b31-cb37-4daf-8f9d-349a7861c8b9", "value": "6144:bs00bE9dwh7KQYO+E/AJJIPxRvGA/wRd3Sr9an3/JCHUhRg8yzEy:Y04qwh7KQYO+E/ALIPxRvGuwRS9anhCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040197, "uuid": "b31a3dc2-c638-42aa-9959-d4304d5946f1", "value": 297728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040197, "uuid": "d98d8f65-bc11-4625-b5d1-64cb2f97fbb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040197, "uuid": "3c7db374-54a3-4f43-a69e-34ce21e28c9e", "value": "pope.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db544fa-91ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786058704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058704, "uuid": "07ae0501-69e5-4054-8385-204000b5771b", "comment": "Malware payload (NanoCore)", "value": "a0ebe1250b23cb60d919aa4e7dbd7e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058704, "uuid": "f7d8ab26-01da-40cc-a054-c634b3d34510", "comment": "Malware payload (NanoCore)", "value": "2055a6d22f882f79211a9209556b9d2e14498da87a112007e5fe0d3bf5cbd2fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058704, "uuid": "a882a935-3a85-4a76-a7ca-53e35a8a0218", "comment": "Malware payload (NanoCore)", "value": "0465401a1bc1b5efbf9d8bd8c3db20a3cc571111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058704, "uuid": "84f29ad7-c1b3-4b1a-be54-b5d2135b19db", "comment": "Malware payload (NanoCore)", "value": "1fce72747a39ca1388cbdb6cc62c6847ae523b3a3d96965ba415df239ba3f3b98a55f086bcc20a166e0fab926de14e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058704, "uuid": "13f83ba0-8c3a-48ef-a4d1-2ca607971256", "value": "T16014CF2677A84A2FE2DE86B9701212039778C2E2A8D3F3DF58D454B75F263E4060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058704, "uuid": "5f37eeda-280c-40b6-8bf6-4a667d19c317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058704, "uuid": "be665179-78cf-46aa-8da6-51467308898b", "value": "6144:sLV6Bta6dtJmakIM5titzMM3/mpjxE7pzpTVv:sLV6BtpmkGitoxizpZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058704, "uuid": "341feee6-d92f-4c27-94e7-e8cf26bd2234", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058704, "uuid": "40f0a0dd-ef2e-47e6-af16-66a65df3e430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058704, "uuid": "4fcf329d-dd40-44c6-876e-75edc5abc3c5", "value": "A0EBE1250B23CB60D919AA4E7DBD7E40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8e69e7-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026547, "uuid": "ac7823ca-bb2d-428b-9545-30603aa94dbd", "comment": "Malware payload (RemcosRAT)", "value": "1c0a2a83e6554423407498ca149ed70a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026547, "uuid": "965ffa24-e5c0-46ba-9061-3a086a9d5ea6", "comment": "Malware payload (RemcosRAT)", "value": "211da6838b46bd9cb8361f420589373edaeaa2b5c47a12d0d4c9424af7a1f070", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026547, "uuid": "908b8f71-c9c8-4ba5-bab9-c642a3ab3943", "comment": "Malware payload (RemcosRAT)", "value": "ae4a31c2350ef20d19975326ef8a39948e4b2284", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026547, "uuid": "e01d33e4-ecec-4456-b47d-2b3d5bb2625a", "comment": "Malware payload (RemcosRAT)", "value": "d592e782578c891c9c336aee5d00698833a95ce3320da3ced3a3839f07aee28a1f3c8e3715d2959617eab318f906796a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026547, "uuid": "7633de6e-2f2b-4d48-9b27-03b51f25bdee", "value": "T15A156A6A27466EFD6B2CB256C443F1F48B0913C1274EABEF035BADB44446B3221F56C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026547, "uuid": "d3055e0f-6ec8-409e-96d6-53207cf599e2", "value": "768:RZlznBcgS1tzBM3eIbvivub2vVKXS09WaLw3gbXeMOpgEXg8aALKU0DQfAKnPgke:gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026547, "uuid": "573646fd-e695-4f99-b059-48a1bce2fe70", "value": 934256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026547, "uuid": "a2d45eee-ca8d-4844-8e7e-c1fcb4de1540", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026547, "uuid": "6d84469c-0641-4547-b985-0afc8f145060", "value": "Whatsapp IMG- 2026- 06 -08 at 11.32,26 AM.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d152de2-91a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786027967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027967, "uuid": "c78d17f4-4ecb-426e-b614-6e74aa4f4e49", "comment": "Malware payload (Stealc)", "value": "3082ed63bb7d87f051c6a167d371b20b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027967, "uuid": "0de3d9c3-5cf0-48dc-98d5-f302fc5b5301", "comment": "Malware payload (Stealc)", "value": "212199a413252df5ad9be87d8070083d74a9f3e7919b3c005db2ed7fe6793343", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027967, "uuid": "c7dc96be-241a-4f61-927a-70f42052c28f", "comment": "Malware payload (Stealc)", "value": "594c0f31ddffd8007e579d3757a7e93482b67ca7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027967, "uuid": "993d8af7-a1ab-4304-a5f4-0e8af3ac6d9b", "comment": "Malware payload (Stealc)", "value": "41dec707734fe2103c714a70b1e65550d1d1a86563b48011d485937e8553ddd410b2a50e5d4e7cb72ab1dec644d4008c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027967, "uuid": "8f37a58e-0d4e-4bdf-a384-93102487698e", "value": "T12DC67C03BCA548FAC0E5A33189B76252B775BC081B3623D72E60ABB82F767D05D75B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027967, "uuid": "41775277-cdc0-40f9-b38d-069a8bb8bd6f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027967, "uuid": "5215ddff-e3e6-4673-8bd5-dffd3407d944", "value": "49152:xDHO9kjZYJgcwUF+FZaVi/o4GaTfr8/C4AaXqVVyJcl:xSd2aViA4GaTDQCcXqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027967, "uuid": "7a76e11d-a75b-484b-ac05-0498bb86f089", "value": 12397448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027967, "uuid": "d36c8d98-7f50-4dbd-856a-61c6cd4a3fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027967, "uuid": "487ff29b-cc28-4e5f-adfa-8b30fcbe0ded", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dae1dc-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005299, "uuid": "368eb8ff-8b05-48ad-a674-4cfe9ef774c2", "comment": "Malware payload (Formbook)", "value": "86b0f516e722f3d930714875cbd5e5ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005299, "uuid": "324470e9-886b-4164-8f17-070496c0f370", "comment": "Malware payload (Formbook)", "value": "21b023d38875a3c3cb1e406c33a9d927556feb53e232ffc39f9ac17e2976b803", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005299, "uuid": "37e2b45e-b011-4885-b2e3-db678a006a6a", "comment": "Malware payload (Formbook)", "value": "a822e15ae05aa901d2622b3a423c1f7a6e99c990", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005299, "uuid": "1ed24425-1c30-4053-a527-1917df3333d8", "comment": "Malware payload (Formbook)", "value": "156806f755c624cfe4d0d2b77d21df5ffa64fa377803e140432096299a2f448d7bc5024036c59cd3b4f1cb8cde91a044", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005299, "uuid": "a5f4d054-87c2-4b70-8c77-b2997b1b5e61", "value": "T18683EC4559967080A3776BBFA22B98D4E777076702841857B87C7880EFF1D09EEE0CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005299, "uuid": "01233767-2f4f-4efd-9ae4-37b1e478873a", "value": "768:YcrSPg4w185ip6/buzwqF//oSh+BXPtMnsSoxpPk6U42w40M1p3XaLCljf3ZFak3:Xgkp6/owPDDBDgDFtId+kE7z+XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005299, "uuid": "1cd05028-cc53-492b-9bc3-fd65fe8593bc", "value": 87235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005299, "uuid": "17945671-9ee2-462d-abc4-cbdf9bd5e9b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005299, "uuid": "901ae6bb-92b7-4a0c-9146-211b72a4b017", "value": "PI #68140024_02797268970802796529299668_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d3c03-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786003840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003840, "uuid": "612aaf72-7bfa-42ab-9318-c773fe239e5e", "comment": "Malware payload", "value": "54ae4e1d71a6f067ff0102fbd698c41c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003840, "uuid": "1c0fbf79-51f0-473f-a2ac-9d185601fe32", "comment": "Malware payload", "value": "22efe67928b79deb9da8d002652ae74d89222bf737aa00e916e689a15a968bbb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003840, "uuid": "6f0636bb-b3f1-41ac-8188-4a1c77b44457", "comment": "Malware payload", "value": "2761c3a149427219d9a2805e2e7d8930ef252b35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003840, "uuid": "b3ecfc32-d3da-4c46-936a-9d86ae51614c", "comment": "Malware payload", "value": "e290ba900a4b26ad582294e3bbefc60eabb59914b2685f727abfc6c2e3c2e0e41162f39204814502c4a9ab846499d1ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003840, "uuid": "8cebd736-9107-4659-8764-13691ed9795f", "value": "T139236C6516857C14AE98C4365C7F2F0CBDAD43E6314492EE7FCA3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003840, "uuid": "7d1a0a1c-772d-4ad9-8dc4-3e3d87c93f5d", "value": "768:7r9NyXsZztCRB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:vHusZdcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003840, "uuid": "bd13a550-d37a-4770-9dab-f3674958c167", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003840, "uuid": "dd0e448e-06b9-4c4e-8240-6299c29ebd67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003840, "uuid": "6c7feabd-0862-4072-8b52-76c9eba0c78b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980f461f-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021999, "uuid": "1ed26848-6504-4821-a433-7567cfd01c60", "comment": "Malware payload (Mirai)", "value": "915d263fda696cea331955e349b9e4d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021999, "uuid": "a95f60ed-0094-4306-9760-f90173bfa079", "comment": "Malware payload (Mirai)", "value": "2382ed9a5978527dc5a0eb0cde51737a513e46b944c084debf9eed19dc3eb4d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021999, "uuid": "ae71b0e2-b6db-4844-a38b-f3702a9dec03", "comment": "Malware payload (Mirai)", "value": "1c8f6eea9147958e8c0bbfce69b00e1751efecf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021999, "uuid": "f084a40a-025b-4ae7-93eb-0cbeeee51633", "comment": "Malware payload (Mirai)", "value": "1c556bc84ce6e8bd6520259a821977f94aa4dedd358be34f11422543ec7c28d74f8d9e1aae3898301ea0960889fd304d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021999, "uuid": "7e0d6d72-c6d8-41d6-8a3d-1020752a65a8", "value": "T16E43672A6A21AFFEE16E423047F39F70975526E23BA0C640E67CD7484F7028D185F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021999, "uuid": "c3424ede-0e81-4121-96be-a4c35e6ca9d4", "value": "1536:QPy6FOqmtcuV8rr2Rnq50hUOhSKiUp7ekUVfHUd:cUokmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021999, "uuid": "08706d55-c3fb-47c0-bec6-c58e1f52cbf5", "value": 59056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021999, "uuid": "2c8e64b4-47b7-4248-b24a-c3ea25ee38b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021999, "uuid": "da10ecdc-a7c1-4f76-8ef3-1c9863dfdb5f", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a81315-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "45dfe177-1377-4554-bea9-0b95d5086269", "comment": "Malware payload (Mirai)", "value": "08183758c6842eddb8cbf4a061fb8d4d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "08c88742-2ebb-4e7b-877d-408e4a300944", "comment": "Malware payload (Mirai)", "value": "23c9b1fdb362bddf552731300024eccfbfc742e7e13f3a609ad45903bf8e23b7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "6ff9fa6c-b270-4f89-b5b6-3777226bfd4b", "comment": "Malware payload (Mirai)", "value": "8c4681f0352ece5969a99488dd5e3badddd8dce7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "b46dea8d-0886-4ec3-8159-3d4a253dd0b9", "comment": "Malware payload (Mirai)", "value": "e5c12f4632de3e6fcf0247f146bbfad21dccd43baa5c5efc9510a33082850108599ceb758460c86926c005d4a1cd93c6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "195d8505-e71f-4cf3-9e89-83c3618e18f0", "value": "T169F43A55F880DFA2C6C125B6F65D46AC33174779C2E772068A258B343BEB86B0F3A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "ceeed77c-9b8d-492b-b182-d995032afea3", "value": "12288:DNLhllrbxgxm3FYvTu68dU5oCUNaj5XmfCMC7cldX6pKT7g8f:NhFySOL+NS5Xmf6Al9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030959, "uuid": "b0994d59-434e-4173-8105-62e5e7c1a5b9", "value": 726416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030959, "uuid": "e9b8a264-3217-4ce4-87bd-748094cf9e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "1823dbdf-94e4-4ea3-bbb0-e79aa8cb72a2", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ade2f44-913d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785982839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982839, "uuid": "c119ddcf-381e-4259-9307-571ba259e80c", "comment": "Malware payload", "value": "e3991bfeb38bc3ec59c1d2ed26439406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982839, "uuid": "4ae7d97b-5086-4552-8783-6155d4d82614", "comment": "Malware payload", "value": "23cb10bd16bcc36e97e538e6d6d7271cbed14e49f535dc535c2c4859dbd56c25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982839, "uuid": "a21849a4-02b5-45cf-833e-7a477562d4b2", "comment": "Malware payload", "value": "9ac2d1d689c1f25fc7aec50919baf88f73d3d917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982839, "uuid": "4006d830-b74e-4174-8172-d374f16194a6", "comment": "Malware payload", "value": "c08d4a6cdbd6fd7f9bb78eb9b9e04e4fcc4c893d11b6a6d88d3248f1754ecd14857fbae454963ab7fb5fefb738a1b309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982839, "uuid": "d9bf448f-a78b-409f-918c-2d61a62975c1", "value": "T149B3122471AFE57D1B072CB0EE781FC20F68AD2A569F2591602937E187924FB31354EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982839, "uuid": "94ae9927-348f-4e16-8213-a049ec5df768", "value": "3072:RM0Fk5sjvQXtte6Pgb/cxVDm2sysv/y0q+emJN:e0Fk5sUtte6POAVJsvq07JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982839, "uuid": "ba475e67-d160-4fc7-978d-1de6adcbe290", "value": 118160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982839, "uuid": "ade157b7-bcd6-494d-986b-3cbea3ec2994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982839, "uuid": "137de1c5-58a4-40fd-8924-a1f01e8d8482", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ef04b1-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026101, "uuid": "664a3970-1ada-449c-917c-07eefa120f72", "comment": "Malware payload (RemcosRAT)", "value": "b16a3339eae93888b97f266ad0c1b0fc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026101, "uuid": "65d8cb63-231a-4b2c-acac-610d3d5ab890", "comment": "Malware payload (RemcosRAT)", "value": "24a13d4a670d42aae40168fbde79f28b5d280b5a9a5483831201a8aff83467a0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026101, "uuid": "8f25278d-9fc6-4768-a9f9-6a26f72600f9", "comment": "Malware payload (RemcosRAT)", "value": "3c0f4672f480528e0b09b5aebeeed81ef1a545c6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026101, "uuid": "6845ae8c-0494-422c-a2eb-cedca10c9bf7", "comment": "Malware payload (RemcosRAT)", "value": "6f9cda7a722457340dbd4be061a57bf13d25baba57d235583e2029d1fce55f5e5cecd45b5dd59d894d2cd624516e1373", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026101, "uuid": "9c3dff23-ab27-42b7-b21e-4f0ff4e3cade", "value": "T17A151206FE808837C8929B380F9362D5D61DFC5B9E264A0E5785733DB83B6F4D961D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026101, "uuid": "e97c0ead-8ec2-4dc1-99e0-c57823ffbf0f", "value": "24576:lKYt1QRT/64rmKu1UiVNILwbGknLzseZw4HY:lKYtmB6gu19vIezsYHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026101, "uuid": "fd52e13c-651c-4c4d-aeca-0698a2ae037a", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026101, "uuid": "72b217ab-a955-4130-8d1d-5a8445daeebf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026101, "uuid": "1197388c-f633-473c-b3b6-a0e7e3367753", "value": "SWIFT Remittance Notice .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34721b25-91d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045884, "uuid": "f495a273-2bfb-4e38-9ad4-ef4d289e54bc", "comment": "Malware payload (Mirai)", "value": "d48660cec68660d12bd78d3f83b60c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045884, "uuid": "e537efde-d55c-469e-873b-65031299ba8c", "comment": "Malware payload (Mirai)", "value": "24c89b78d072525ed6dc9b3ccdeacc4bfca600fca52d3711f9b46305636ffe8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045884, "uuid": "5393e709-5a91-4154-ad2b-c64778632ea0", "comment": "Malware payload (Mirai)", "value": "4d9c9c4abad6887a4ae71e615860ccd6513a381e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045884, "uuid": "2c5169e6-4755-4665-9112-cb519bbf9e8c", "comment": "Malware payload (Mirai)", "value": "c1182f388f534ed03147c4e89bf8b54d3c8bfcfa18cfa171e7363e30d52f77d60d76531b8f84db259e5d5a6cc9ba87ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045884, "uuid": "c6c75ba5-6684-4570-b2b6-be932a3a2eec", "value": "T122D31855FD459F53C6C255BBFF4E428C7B2A0768D3EE720399266F20378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045884, "uuid": "8f78fd0f-8bd6-4d80-a2e8-fb028c94d74d", "value": "1536:SHzZMxG/SgoY5kmYe3ahLknpgPD3wfJaTFWtm92eMjNO7ODTjTTsxaMBrlYewywO:ENMxGoWb3ahLk6zws5W0QtNlHQtTN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045884, "uuid": "c6ea5ea5-2242-4e77-a65b-03ff647971df", "value": 141880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045884, "uuid": "1e62f48a-8cca-4795-a36a-f455c7ff2911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045884, "uuid": "db7f56df-29f4-4fcc-9fe5-05814ba9c0ff", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b30b99-91c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786041113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041113, "uuid": "249d37a7-bcfd-4904-b061-294b054e7f8a", "comment": "Malware payload", "value": "f9027fdfc472f1f34d4127d7fa8f088e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041113, "uuid": "4376354a-aa7e-466e-bfc5-3141a5805d06", "comment": "Malware payload", "value": "2556da51d1b4d0fd2616df8d77a1c557095bd0b41b76432039ed9ebca058a2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041113, "uuid": "e3b5cbf9-8346-46a3-8b4a-0191ddc9f98d", "comment": "Malware payload", "value": "d24ba81d137d8c217d0db1182a66070609ed7786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041113, "uuid": "c3e0d403-d5b4-4bf8-b425-4d31e88876c8", "comment": "Malware payload", "value": "62b6d9849c3cdb395181339a8d8f26ddef9e55b2fe332ba36dda9a85f94be1dbdf45dc934c6b2279db4bd3da6dd5f6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041113, "uuid": "ddfd12df-32bd-470e-b260-309cadb37e2e", "value": "T1A4648D5827ED8A26E6FE62B5E83D040D47F6B51A612EFB4F19A020FD6C13F8449017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041113, "uuid": "2331388e-070d-4101-a4c3-8ac8933bc9cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041113, "uuid": "06f69c24-07ad-4e5f-bbf7-e6255718beb9", "value": "6144:3wTJXtCXxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:ATpMwu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786041113, "uuid": "e2026c27-d04e-4902-b982-e576ae18af65", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786041113, "uuid": "faef8335-f6ad-482f-a58d-4213623c9464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041113, "uuid": "dd83ed95-42ab-4c62-b6ff-0ed090f179b7", "value": "stage1_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5aec33-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047962, "uuid": "786db4d8-f445-4be8-854f-dac5aca18c20", "comment": "Malware payload (Mirai)", "value": "5d5058ce9e1c0758cbf2e131edd1d28f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047962, "uuid": "1ffbc3b6-fce0-4a38-b2cb-71bba505b283", "comment": "Malware payload (Mirai)", "value": "257ef3a12aec4299d6fd7db871f535675b07a2309cc73c9948bb476754935c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047962, "uuid": "492f9e2f-fca9-4bcf-9051-d4ff15c208eb", "comment": "Malware payload (Mirai)", "value": "d9a833e587bb02e7145664edaa6ef24c9ced95ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047962, "uuid": "5ca91ade-4fb6-4153-95ae-247d8f219a64", "comment": "Malware payload (Mirai)", "value": "44f72040ae9d247d9d25ae2a5339a5a3389db96e403e0b79ebdaa30a6e871651e8affb2bf5931361514daf8f507cf0ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047962, "uuid": "fbeea25e-20f9-45c1-9c21-29010bea08bf", "value": "T18BC37CA3CC3AAE6CD218E4A0F4319F7D2B63E92191431FA99567C6794443EC9F9053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047962, "uuid": "9f0e8646-e90c-40f6-b48c-deccf0aac75d", "value": "3072:7k2gcA+jf7CDn1M0bTIqi2DO0AW6Msvfcn:7k281MqTIx+J6rfcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047962, "uuid": "cec043a3-cd4f-499e-b599-9570fef831c3", "value": 125668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047962, "uuid": "0e9935d2-a894-4292-951d-bb57cae3f053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047962, "uuid": "629e6bcf-0af0-42c7-9d03-71f2f6f78071", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5382f627-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786048943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048943, "uuid": "06864140-b505-4af7-9688-f3fdea10ef8f", "comment": "Malware payload (Gafgyt)", "value": "f98cbe0fb007f5a822ec2c40b24b7179", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048943, "uuid": "d8f6f018-2467-4755-b1a3-1281e2fd608b", "comment": "Malware payload (Gafgyt)", "value": "26418d383bfa8595b9d8ea45dc3b383442bca55451ceea3622b7da108b48d50d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048943, "uuid": "63181f44-d49f-475b-9b18-7d3c28e2a989", "comment": "Malware payload (Gafgyt)", "value": "1e5177a894c2c0c1462bb6f53afd057159905b6f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048943, "uuid": "932a08af-8a55-4e88-a7d4-f7dbe28bb2b9", "comment": "Malware payload (Gafgyt)", "value": "3357d12d3632251e39561ef1a3041d2ebebaff609a22ff32d1a335c61ed9dca3a37d3143d7e1a5fbe38d1bed8b214c65", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048943, "uuid": "9af447a8-0dba-4876-9226-e6ecb468050b", "value": "T14D5302512ABCF83ACEE2D9390B6841E645DC9DB494C7600E43CD7CF84A0696CBE9C6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048943, "uuid": "cf669239-b9a6-4e65-829d-a3f6184f5a37", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VukAQ9:MaHJgMo8FwOA4zUFGUO3UhbkQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048943, "uuid": "7c879cf5-b349-460c-9adb-be8d0dab07f7", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048943, "uuid": "21e86969-4604-4ffc-9537-d41aa9d194e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048943, "uuid": "3563bc0d-89e5-4c6d-8c49-24ca30486a82", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0458ef-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048930, "uuid": "51f071c4-1891-42fa-a7d0-06c72b5ea059", "comment": "Malware payload (Mirai)", "value": "ac43389377226f9748168035b2c00670", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048930, "uuid": "9046ee03-a1bf-4353-a28b-65a76bfae4e1", "comment": "Malware payload (Mirai)", "value": "275de7c93082effe9ae5455038094be33f216ef6370e78926c110398333aca15", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048930, "uuid": "cfd15482-50f5-4d90-aaaa-0c3dfb04087c", "comment": "Malware payload (Mirai)", "value": "78d75998e219d0bf226788e2829723469a8d1f21", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048930, "uuid": "e8cf5a82-e4cb-4c13-b855-3eed6b0e3745", "comment": "Malware payload (Mirai)", "value": "44b8081dde8e0f1ed3327406ee3db246ab62b6309868b39f1f8745b0e082f92572c9d12a97d7ffec8636b5460a595ee0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048930, "uuid": "72e24e0a-49d2-4881-8b56-ee66e96f644a", "value": "T134B3AF87B1907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3903292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048930, "uuid": "5b4510a6-6dd4-4bb4-a812-53f1161d1aca", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzH8rSR:t3SrlGWnKTU83AQB5A5Liy36frUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048930, "uuid": "27615c36-4a52-4e29-b5e1-f813cd5c043c", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048930, "uuid": "9c1e6646-869f-4b7d-8386-5f19a982f174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048930, "uuid": "f7c4ae08-374c-46e7-98d2-347dd38b633e", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8ab633-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786048936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "9a5485c5-e904-4433-88da-50d448662378", "comment": "Malware payload (Gafgyt)", "value": "582a0634b56146f8f18c48d395c5c62a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "8567acae-fb12-4bea-b7b8-0dfe48839838", "comment": "Malware payload (Gafgyt)", "value": "27b182832171a5b391a856746818554def33b70503b66b80ff6bd74eb34e9405", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "b2f6adaf-57dc-4410-a38d-417c526aa37c", "comment": "Malware payload (Gafgyt)", "value": "b2b9155aa88be17903b42b59a45fa3309e64c1c8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "4b82489c-eda3-44dd-9b15-84b748e1555e", "comment": "Malware payload (Gafgyt)", "value": "d58e3a0b4dfe2810eb2bc6e7c7449512fd32a745917c79585a2e2d6a404f1c8ec0491bcb00acd83216ee9f49f6764849", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "4497e812-8793-499d-8466-555b2415d77f", "value": "T1236302CB7DB06B67D1D8A1B2703814D9DC3A9DCAE6438A9C87E2A7564738532148CB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "ec9be0f0-7e0d-48fa-a367-aea9bcb60bc8", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMG5IB4Nr:1axZLmYKX+t08jmeJhYT24Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048936, "uuid": "d9b33d99-8ec1-490f-be70-7943728fd895", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048936, "uuid": "7cb962d4-414c-4d29-ae3e-2f26c0d8ee9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "5c8d850c-77d3-4ed8-98a6-94cc90c95e2b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43db7d4f-91c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786042903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042903, "uuid": "159bf6c9-8de5-495a-85c9-e7f3979dc720", "comment": "Malware payload", "value": "98bd3b3f99cd85e98fe5613b088072a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042903, "uuid": "5bf4386e-f6c0-49ed-b2ca-7a832a502936", "comment": "Malware payload", "value": "27e2ac55b200ba9b6c7a3f918fb360188c01e0a04c32606c3e50fe0cf71af2ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042903, "uuid": "4fcbe901-bf07-4c08-b1e1-807a501c9bc9", "comment": "Malware payload", "value": "d2a6e960f5e65c48fe9af7a96e39ea78765b1cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042903, "uuid": "520546fe-3915-48c9-ad13-1d1d4396ad37", "comment": "Malware payload", "value": "84678b30ddeedc91310db7cc1e40600276613fe254adeba5c7bfc8b3da160a83d1a47e455855eea81d48f279f3582810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042903, "uuid": "bb0bbba6-973a-4df0-bdc2-be1c1c27debd", "value": "T159335B62C6F99D06CAE06A7E02F303E3C5CB4F1443D8CA5FED951EA59F4A7108C66B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042903, "uuid": "f4595fb5-7c51-46a4-9ed2-9fefa1bd2ccb", "value": "1536:mSr9n4nyWj3r9n4nY9C2/tOrBBJUw3hBDI2BtlVc4YC/a:mSr94yK3r945q4FBJUMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786042903, "uuid": "9e6f33dd-562d-4f27-8f55-496a7803edcc", "value": 51792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786042903, "uuid": "04e4a482-734b-4f27-86cf-f6a771ed3437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042903, "uuid": "925cf93c-ab21-4ba9-b882-eef4fcf614df", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8380669d-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983740, "uuid": "43c4ee9e-adf6-4f7d-9620-76e2db712fdf", "comment": "Malware payload (Mirai)", "value": "71210752f2cb45c2790dc7ba905e6ba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983740, "uuid": "f6affd2f-8c2c-4e13-b07a-d38f17ad1ebd", "comment": "Malware payload (Mirai)", "value": "27f06e0d5c08b66a9c3ae1ca7c0629d8e20f9489bf4e1463481b6c9d5fdb27ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983740, "uuid": "9524c07e-95a3-4bf5-b3bb-d60e5901864e", "comment": "Malware payload (Mirai)", "value": "5237be1bc647f056c9219bb7a6259b99b9eb6285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983740, "uuid": "68492c14-25e7-4269-9520-fedbe8c73fbd", "comment": "Malware payload (Mirai)", "value": "1de477a15eb9fa104848bb14e900ece09e5905b17f135a72af7bbe29c3614304a77e0f8ebfc758e280f6011fc5dfbaa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983740, "uuid": "88fc6ef1-6ee1-4e2a-bc04-cc53c2be97ff", "value": "T1C4F2E162EA541835C3A76739D07D8CEC95A86C9B392C861E73D28F97075E02752BAE00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983740, "uuid": "4488b2fc-53e8-47d4-b976-d9b72c92fee4", "value": "768:rFd1biqKf8IJMBjThF/JgA2riyuF8i4w1HeHOACTvMI6XNTT0IRjVFam/BS:rJdKfdiJF/JgAa+F8PqmxL/f04RAmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983740, "uuid": "2345f23d-48ed-4c0c-803a-78b67f3af5c7", "value": 37640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983740, "uuid": "0046a098-073d-4c7b-8bfe-2206921d3a14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983740, "uuid": "d5c4c744-3a9e-4836-bd8c-b538e3ace874", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67928d8-91c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040545, "uuid": "ebddbb3d-eedc-4c48-9535-d7e3daf8ea07", "comment": "Malware payload (Mirai)", "value": "af87fbbbaccfdb1e2f4b138c49c766e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040545, "uuid": "ccc95de0-e01e-478b-ad2b-56accb476e74", "comment": "Malware payload (Mirai)", "value": "285460ed60d825dcf3426bf5bd5c40a7de8d21cdd9631bf5096d26c40e3fefc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040545, "uuid": "2300c42b-7247-46b7-b60b-a9576281b29e", "comment": "Malware payload (Mirai)", "value": "c4f42a02e93899431821d347d288819d45c1f94f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040545, "uuid": "5a1d3819-05b1-4dc1-82b0-e5ab9adb30f1", "comment": "Malware payload (Mirai)", "value": "f8e7183c53bbef171304837a71d649a48e3292b3f686ee35fb05f44c54c67c774ae5d1dc95f0908dff3b6b8f7ba566b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040545, "uuid": "658fdfb3-68cf-4aee-9d94-6ae6b7f2c00d", "value": "T16E445C427B254D43D2131EF03A3F1BE6D799EC9225B4F280795EBE9682329736041BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040545, "uuid": "6e45c053-098d-4dcd-a258-8d8701163e6b", "value": "3072:pO1h4+wnLNJcEryHZ800dCW+OI4cg7MmoaT19McpKGLF0LHO+2+A0LBR95C/bKn9:fnYBmXtqKwzBR7Cj8pUkZ5JWVBbszCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040545, "uuid": "03bf642f-4332-43b0-9008-41cab778beda", "value": 275688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040545, "uuid": "8d183ce6-236f-479e-8140-883d02924fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040545, "uuid": "d800da9b-7056-4a75-985b-d6fa4e6a15fa", "value": "pope.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf6248f-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "23d5649b-1f24-450a-8d8a-3d0d1b63bab4", "comment": "Malware payload (Mirai)", "value": "4091d0d91ed473e12a77870f74203ffe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "8abafb46-6628-4bcd-9e8b-dc7e36a7ff83", "comment": "Malware payload (Mirai)", "value": "286cfaa325353a26ed38491d1fd614d099f3aad1bf148cee069cbd79f877feb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "e25ac668-ac37-493f-82f9-0fba09218a55", "comment": "Malware payload (Mirai)", "value": "671f422fc16449173126cad580713fae84f29a29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "f08e04ff-b44f-422f-9d97-4004fd373cec", "comment": "Malware payload (Mirai)", "value": "d3187b5daa6e5b79459f46263ab3b5232c45f3d1831608ce9ed9e05483f60e47e1694c6bfb3dab4401e72f00f494026c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "26c32873-75d6-4117-b690-3f77aff125d0", "value": "T185E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "96b50442-9705-4b5a-983f-2d9a79610a2f", "value": "3072:CotWnBLigk1Tc3cCC0DvZe1k6aU6zL6EiueCo2kg:VWnligqTcMCCqeS6axIueckg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045737, "uuid": "7fdf283b-ac29-42a3-ba2c-6e39a019bf4c", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045737, "uuid": "97988326-986d-4b5b-8165-84c308ba8e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "98af6c42-d48d-4f4a-bc4a-396f728f6b06", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae29dc85-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978657, "uuid": "583ad2e7-b4e9-4575-9951-6cb2d46e4a8d", "comment": "Malware payload (Mirai)", "value": "81cd35bf389a55b94dfa2c639a3b2571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978657, "uuid": "7d8d61e5-35c3-4708-a299-71fd6640c360", "comment": "Malware payload (Mirai)", "value": "2910c598d1658ee0193b3001fe15137ca62be3a312efd76c134904c5c6abb345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978657, "uuid": "4c7adb86-135c-43f9-aa78-41da22beb814", "comment": "Malware payload (Mirai)", "value": "9e7e878c2ec4113601ac1796003e1b4517bb68fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978657, "uuid": "a1a189c3-1310-46b7-85c1-f8d63ffee4b3", "comment": "Malware payload (Mirai)", "value": "f03e050d010e07a234d90ad80d9c3f17925e02ce3ca1a90901bc67198ed73bb61c3300450700b029778cedb22d016f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978657, "uuid": "8010c123-de6e-4465-ae98-c38a413e4a1d", "value": "T1B7C31A99F890DE52C6D52675FA5E028C332357B8C3DA7205CD209F34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978657, "uuid": "c2cb23ca-9df9-4b26-ba12-4c6bf6317e73", "value": "3072:8N9P0r4MP9Zkocit2uEbUQ4g8O8C17MC+0OhBAmPj7ClTf1Dl4:8N9P00M1guqUQ4g8Oh17MCFmPjMT95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978657, "uuid": "7d3f5143-1b94-465c-aef7-82d90f8720bb", "value": 120252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978657, "uuid": "b3e1094f-9aa4-4e54-a591-d3c3e2c18abe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978657, "uuid": "3673915d-40eb-497a-a3f8-419ea9c51491", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47948b8e-9132-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978056, "uuid": "0e7c6f30-56ce-4e67-b554-908bce7daf62", "comment": "Malware payload (Mirai)", "value": "e02aa151386792f5a3a34eba21d9be07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978056, "uuid": "53cae661-6417-43e0-a443-f0fc4075d10a", "comment": "Malware payload (Mirai)", "value": "29248b98fe7b3e59919395e2f044d9c40a9a1eedf226f7bd2eb9d9067f4163e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978056, "uuid": "4368540a-5705-4dd8-baff-b3b04feda8ac", "comment": "Malware payload (Mirai)", "value": "faf51e0aa172fa76b987e703c3765c2036c8a518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978056, "uuid": "6997ffe9-c4cb-4dc0-8565-998392336c6a", "comment": "Malware payload (Mirai)", "value": "8680682fa7f002610273ef9be7eadee621a1a3943b44c73b0503dd89b71cb88141ffa9756ce21e9c32c1fc541108106d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978056, "uuid": "a27d0d38-339c-4b43-a020-8c1774dc6976", "value": "T1F4733B22BA72192BC5D0E57A61F30235F2F343CA14AC8A1B3D714DCDBF65A4026677E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978056, "uuid": "21d732fa-aa90-4f57-9c51-cd2adeec46f7", "value": "1536:ATBMTVz4pNZlEtztNk5Nw/o3/WWtx2t7QmyL2:+eVz4pNZCtztNUwNzuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978056, "uuid": "070c6991-dd3b-42c0-9a99-f37691fc77a3", "value": 78812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978056, "uuid": "265320ef-2bfc-42be-a677-5d09233419c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978056, "uuid": "298129b1-ff95-480d-8e7c-d6e81d85a109", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6572fdac-91ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786036517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786036517, "uuid": "ff135dae-9c71-4bc1-b5ec-93707808c8ba", "comment": "Malware payload (WannaCry)", "value": "af49d090af04cd0acba34c3308c45d23", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786036517, "uuid": "a3a407fb-42f5-4597-b1f0-a4bbedb7f573", "comment": "Malware payload (WannaCry)", "value": "295ea6d0c0e8948edec19dea2b6778d9b21cd52c2f1c29efe30462801f4efbac", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786036517, "uuid": "4fa073e4-46aa-46fc-8357-f2b36398d66a", "comment": "Malware payload (WannaCry)", "value": "44bb52939808600f5b230801404afa5e8a90ef64", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786036517, "uuid": "f797e522-bc68-4c75-9d55-222acad40748", "comment": "Malware payload (WannaCry)", "value": "9d2b7b830a798c3b9c1c76d4e56b18f922c19173ccbc1de8eb6d268f5b45875d4618865e1cef0717d6e00c40aacf75e8", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786036517, "uuid": "9074dc94-cf9f-40c6-992d-f244419b23b9", "value": "T19F36235531E8C0B4C003553488FB8A62F6B67C2A17BAA94FBF904E7E2F23795E714742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786036517, "uuid": "5c6dac9a-93ef-4712-b33f-d2404ca95880", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786036517, "uuid": "d7d331d4-8e24-406f-9bc3-e56a232caf15", "value": "49152:jnsnpEjbcBVQej/1INRx+TSqTdX1HkQo6SA:DMpUoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786036517, "uuid": "dcb2bb62-981b-4977-aaaf-18e952bfe8e4", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786036517, "uuid": "be27e382-7896-4a89-a8a0-093de663a038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786036517, "uuid": "a334368f-39e2-4d43-acc0-e35f40974ff3", "value": "295ea6d0c0e8948edec19dea2b6778d9b21cd52c2f1c29efe30462801f4efbac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4415e8-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "08d79809-d858-4fe9-8eb7-93effaee0465", "comment": "Malware payload (Mirai)", "value": "8644ef16d8e7a6eb7b6debb587fe3e02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "b5cffae1-f2be-4659-a675-5d2c9ccb4f3c", "comment": "Malware payload (Mirai)", "value": "29e3c4f2121ed064ee8a15887fdae8c184aea6143565676436adb2898b80c07c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "59087a06-0d4b-4589-9457-2533f676df60", "comment": "Malware payload (Mirai)", "value": "01dd8d4fd5f53c8b62a21f29512416314ab61e18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "46ffc341-4747-4e14-a8d5-d28142a58722", "comment": "Malware payload (Mirai)", "value": "4006bddbcd091ec494dbeb96e119d59283d8d65517ce0e5662c0f2004915d0f74eac3d6dfd629eb4c8a9897f420e257f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "7f415693-2a48-4f2f-acb6-869915529d74", "value": "T1E8D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "bc143338-fff0-4c19-8693-d558a18ba138", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyIOFe30Hi09lshKwJh:ZUH+FD99IVWFtAOgEmhPJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045741, "uuid": "605cb988-e244-4402-a5d3-e4d9c66ff527", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045741, "uuid": "261da172-c5dd-4e76-b134-2678239cf420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "3d070882-7785-4327-a764-478e84267424", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284b387c-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786030831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030831, "uuid": "0fd5a69e-0574-4660-bb62-7da076befcc4", "comment": "Malware payload (RemcosRAT)", "value": "f3053fed83a4d313e8aa9cace5db69ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030831, "uuid": "57df7d43-7f85-4eef-a2bc-54b75f368738", "comment": "Malware payload (RemcosRAT)", "value": "2a73cad53d7b6ee5df6fce0d9f5761891c6bf42d674130dab5a634ffcd9b3423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030831, "uuid": "5adee528-62e0-4474-838c-7029af97fa90", "comment": "Malware payload (RemcosRAT)", "value": "0045f51bbd0f4285fc59b60f9652e6a6ad0f8242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030831, "uuid": "6d20bbce-19d2-4c05-a7df-e0e2169bc959", "comment": "Malware payload (RemcosRAT)", "value": "97e850343c8c637001c82a561da58d58d413e1115a7119bc9748db1e421f754dae627258df1ad9dedf370eb6412f16f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030831, "uuid": "af29d407-9bbf-4550-97c0-078ebf3da263", "value": "T1B8D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030831, "uuid": "d037786d-3b12-4469-8fe1-ee40c99f4bad", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030831, "uuid": "e196121d-1c5a-45fa-a5ce-15161ce02c34", "value": "12288:+ZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:QQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030831, "uuid": "67101da0-0538-442e-bc38-4d96ea28e9d4", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030831, "uuid": "588da43d-adad-4c58-8d60-b1977e0769f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030831, "uuid": "a1f8a202-370e-4915-92f0-ed84e7ed3d65", "value": "SecuriteInfo.com.BackDoor.Remcos.716.26584.2239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b35694-91ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058979, "uuid": "92e7c1ae-d709-455e-b01b-2c183880431a", "comment": "Malware payload (Mirai)", "value": "cfc169d27ea0d2962b6adade5eb268f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058979, "uuid": "5f6fc81f-c3b5-434b-9ad9-85c634a00573", "comment": "Malware payload (Mirai)", "value": "2bcd14ad3499be6f1bc2b4b569df53ee9b70f6dc7eb3865bd6229650a3d634f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058979, "uuid": "66db61c7-d05c-466e-8e86-376c1123cf04", "comment": "Malware payload (Mirai)", "value": "bc262fee9560a49489e6dd55a28da255319ede46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058979, "uuid": "0ee1e667-6919-428d-ace5-4179bb714d00", "comment": "Malware payload (Mirai)", "value": "374cb2e9542f3f04d9dc128979864d65c6a827c8e6ef572bc29c2e090c521b6ae263aef591c5645c23facb168fbd140f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058979, "uuid": "87746825-186d-4713-8860-02fb114d1fa0", "value": "T141C33B06756144FCC156C074C77FA927EA31B85D13343AAF7B84BA31AE22E365F0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058979, "uuid": "d4bfb711-f7b6-48aa-8d4e-ffd8a4003d2b", "value": "3072:VLV0Pzv5f3EIPNG2uAKA/C5Sl01PSxDkG4Mh1B:VLVk5fZPNGKC5V1cDky1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058979, "uuid": "b9ee315e-30b8-4027-ad8f-21ae73f5fd33", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058979, "uuid": "e8b8bb63-27fc-4a24-ae8d-928a9e5f9132", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058979, "uuid": "66cdd0d5-216b-4447-8a2c-37d8b01cf658", "value": "fc09cf6556d51f47fac884e51c4eff76d43bf44ab9dba7578123d8aa19dd3585.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008ed10c-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786048374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "294fd2c2-0b5d-4093-bccf-a89143d7f38b", "comment": "Malware payload", "value": "348d3e4cd88223c95aa860aa9ac9a4ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "820dc4a1-fec8-43fb-89cd-12c622c20225", "comment": "Malware payload", "value": "2c804dbe8692edf32a655dfdfc928a31ce441836a05620684a2a8557aba811af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "928ef85e-f82d-4784-901d-a6f53e903225", "comment": "Malware payload", "value": "461caf8c6233f79cab4f49d0a2ab15e360821de5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "38db5b9b-c899-4fa1-8bc6-e314e70113bb", "comment": "Malware payload", "value": "a75859d1aa727f7f58a6b79092c85cee55317ec6e8217e09d55e7bd8f939dfa6ed4b38f990f33c3ca084989699de96bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "6f415543-f2e4-4e35-92c3-1d93bc8f67bb", "value": "T12F31E39926B07E61864ACF0DB0E542D4A247F5C6B2934BF2E5C31C6168DBF80B857B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "5f4c82ee-8041-4500-b267-1b4788382c60", "value": "12:7kft0dtnNaKE6dODOmT+fG8K1zk1Y7VbcVb1LBRN0/N0KvtZse77LLB8CRwl7CWX:4fCfFWDzTWKxkGCb2/2MtnLrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048374, "uuid": "c2163413-48ea-4e38-9e61-021dd6b132a8", "value": 1806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048374, "uuid": "f24c7588-100b-44e7-94c0-3c69d625385f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "e90cb453-e7d0-405b-82cb-6104ea01f0d6", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2960cca5-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050590, "uuid": "54c53cb9-8d33-4a9d-b526-d631d1add47e", "comment": "Malware payload (Mirai)", "value": "0f7e88a7c8367adbad7ec2c6261ea108", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050590, "uuid": "e5a120f2-4d1d-4fae-817d-7089af3cd1e1", "comment": "Malware payload (Mirai)", "value": "2cd24da13a8b8abbfcf0222b47e31707af04a082cb48d7259ac03494bc5842f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050590, "uuid": "802de6dc-8612-4e0f-b1e1-5c8878e68962", "comment": "Malware payload (Mirai)", "value": "b40d878888996f908a607707feb727cfc658ce3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050590, "uuid": "9a9df428-8085-4784-9d0d-ada5f2f7d72c", "comment": "Malware payload (Mirai)", "value": "0877787c2c9e2a80a9d5ce66963dd1fc39399a8a760e490285e575e5edba90427c9b94d103c381ef17b9633048bb1352", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050590, "uuid": "f6d0d947-5460-4f18-be22-b0a8bd2528f0", "value": "T1C1243B037A81C9FEC496D1F04BEB95319A78F82D1635714B3794FFB12A09EE02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050590, "uuid": "5eca75b0-3437-4ad4-8e55-615928d199c8", "value": "6144:mBbbTJgbFAd/jFSMZkdGFer/+xENv/4X9:m5RjFSMRFer/3/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050590, "uuid": "9ab73c90-15e8-4b26-b3f0-70b51f450e17", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050590, "uuid": "de7db224-2cce-44d9-b62f-2a3dafe7b55c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050590, "uuid": "dfd298eb-7450-4e1b-98f3-c9d1fa711657", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a7b326-91c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040547, "uuid": "42ebab92-adf7-43b9-8747-42eaeff6cc16", "comment": "Malware payload (Mirai)", "value": "a82726338fe4942ae415574f80d87cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040547, "uuid": "18d80753-960e-4cee-9463-37c065ae0931", "comment": "Malware payload (Mirai)", "value": "2d1f4054629d3f74d55b60a09e9ec547c3301ba827ad78e9bee42e9d661d68d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040547, "uuid": "542c0857-2b85-4ffa-80db-94789bab6e54", "comment": "Malware payload (Mirai)", "value": "01bd6c56463b08e67db55cb6e8b45218f70619ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040547, "uuid": "3c3578da-ddeb-4a26-92e5-d26e4e0cd4f6", "comment": "Malware payload (Mirai)", "value": "3cc2ddf6a99c160a45cd811b4991ac290e93551323ee49256dffda8290b91742e202ab842258468713123d46e7e3ce71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040547, "uuid": "43f02aaa-58f1-471c-a369-6f80db9e7681", "value": "T15D741A0AAF510EFBE85FDD3702E95B46148C7D4221A66F767534FA08B646A8E0DE3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040547, "uuid": "04ba8d45-6477-490f-b9dd-961ba9d79a42", "value": "6144:vV7KSAAcMfNrHgg/Fd9ybETqlRDOtB/Ezix376q6phLkl4CSYP0ziIGD73X:MMXywqnDP2lwzi93H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040547, "uuid": "b3b30d5c-cfe7-4a78-906d-0ba7117a3cf2", "value": 345696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040547, "uuid": "eb936a43-9b9f-473d-be92-cda00c85e806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040547, "uuid": "e6db6cb6-1abb-40d8-a04f-e2264cf1f66b", "value": "pope.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b754a6-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030964, "uuid": "5a19b0fe-feaf-4b15-9151-e6ca9dd191bd", "comment": "Malware payload (Mirai)", "value": "1210668c7fc044355eb86f0701d1e04d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030964, "uuid": "1cd06484-4656-4a15-ba7e-ae2074d73438", "comment": "Malware payload (Mirai)", "value": "2d88e51cbe20ac1379e8bae7cfc8b36966d76dfa775d0293d0c90d71dfbbee33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030964, "uuid": "d7ca6b40-ee85-4cf2-848b-797780979c17", "comment": "Malware payload (Mirai)", "value": "41bf3c710cd89696c791db2d5ce52adefeca3800", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030964, "uuid": "5ffe240a-20a6-4060-b67f-ff622e354364", "comment": "Malware payload (Mirai)", "value": "d7f81848aa9f5bf8bf523e571143ba9f3470922663e13375e8389d3fe934dc07d95e8685295d305c86ffa0b8992c7ebc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030964, "uuid": "4db8d19a-1dd3-456e-9661-659b8e904626", "value": "T1FF258D52BBF10166E680873586A2D750B643E7E264E4034BCF218EEBEF571A50F85CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030964, "uuid": "be56405a-f695-444f-a001-955e3048bbd1", "value": "12288:sGk6gL/R5jDuEfZnmf7Okj0YS6z9FHfqH2a56EUgRj:sAgLDLZC0YS6r/wt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030964, "uuid": "aa6caf7b-873e-4f60-85e2-e1703c8383b7", "value": 1057432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030964, "uuid": "c43dbfa7-3d16-44b7-836b-d4b962c48804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030964, "uuid": "4705bf1e-e53b-421f-9335-250e9e53020f", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c694626-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996183, "uuid": "f8109a17-67b0-4550-b6a3-c9de71431ea1", "comment": "Malware payload (Mirai)", "value": "954d22fbbbe127ec9f93581ba7f4ff2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996183, "uuid": "971650f2-b046-4ca8-a65b-5c0258df1bcd", "comment": "Malware payload (Mirai)", "value": "2dad811eb7474dbe96ee256795a9f58505a0c8732e2e3b06a4209bb213c455cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996183, "uuid": "4f024c3f-f91f-4ba1-894c-534282308d68", "comment": "Malware payload (Mirai)", "value": "12d512faffd28b957162fdf8b91609f48996dd8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996183, "uuid": "e63bbff1-4207-4314-b211-255ffdd2f9d0", "comment": "Malware payload (Mirai)", "value": "72255e9a07e87d107499b5005e56c1f9d416430fb3a0b2965f36034042b9451d51fd22aac8f9ba8d06ae03af6700fac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996183, "uuid": "2a64a392-d47f-4ab4-a567-a880f960b735", "value": "T111A3B71E2E619FBCF3B9823497F74F30965923D122D2C684D1ACD9002E7474E685F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996183, "uuid": "5c82c324-ec8f-49e9-8bfd-f927fe523759", "value": "1536:YXXjBcp5ARXTASB6oL+g8sRVKrSBfu8ZgnaMssQv5m+240p5LLWHDCP:q8ARXTWoy4RVdBfHia15I40p5LFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996183, "uuid": "9c201f56-cdd1-4e91-a9d3-87cf1ce9a994", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996183, "uuid": "1f0997b9-2f8a-4691-9892-61d291df2ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996183, "uuid": "2f176370-17c7-4934-ba27-2422ffa0050b", "value": "H8u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fd92cb-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785983604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983604, "uuid": "03b0d1f8-b9b5-4e91-90eb-c6f921751d76", "comment": "Malware payload", "value": "afac731c2877a0db53b783d6a05ea86f", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983604, "uuid": "e2e2d2c9-e502-4fe1-82e2-82990106183a", "comment": "Malware payload", "value": "2e747f610c9295132aa6e2827b4dca7656869eea15b6cad5b0a4aa61c37413a2", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983604, "uuid": "a6b81dcc-449e-4b5f-8a22-30e5d852cd47", "comment": "Malware payload", "value": "aa5ebfaa709abce178170a9d43916d6882303f59", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983604, "uuid": "f76b38ba-6838-4b85-8c2b-21ef661cef75", "comment": "Malware payload", "value": "7db40eebbb6dca5935cfb31a6fbafaf06393693c95c7ec5f16f11cfe7f806c48ba0b28847f9e2972c471d1aa456b069c", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983604, "uuid": "094e6342-5916-4fb2-a3d6-3d24953d4e39", "value": "T1FCD5238A7AB11DB0C43BC3B65F52E07EB0297B868B354D5BB6CC5A108E235586C3B735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983604, "uuid": "3878335f-fc3c-4a9e-a76e-548d802a9283", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983604, "uuid": "24933050-3ba7-4104-9426-3991c78073d7", "value": "49152:7XMKPZC37lZp3K25H0BVjFk/S+TV/9hzbtd2Pq3Yc6Vt/4cTr1RFJVsoj58cwkMP:AWC7lZ1K25H0TF23Txtd69VX/X1RRtCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983604, "uuid": "c76ef776-8778-499c-8ed9-3838aced3aa8", "value": 2913792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983604, "uuid": "af25783f-84d7-41b7-9516-2a0f962363f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983604, "uuid": "2edd21be-def6-46bc-8186-5121e6d924bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a7efe6-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785983616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983616, "uuid": "52d2c364-c82e-4256-af3c-63df81d95575", "comment": "Malware payload (CoinMiner)", "value": "8fe3f9d368c0f417944d46048083f878", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983616, "uuid": "3be976c3-c87b-47b3-a331-a337602a03ab", "comment": "Malware payload (CoinMiner)", "value": "2ed02943cd801954de9d92a66eab12cb718ffe57a3e0f3df95103a72d181f879", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983616, "uuid": "91306a78-d386-41c9-9883-1033d646181a", "comment": "Malware payload (CoinMiner)", "value": "0650505c58c16706a01566ea45d4ee362dfbdda6", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983616, "uuid": "bef9d257-f68d-4f20-bd6f-58b9b20f4c03", "comment": "Malware payload (CoinMiner)", "value": "a90c4a02bd7d573a0c63541cbc9b890262b490fa25e99f6e065c3eaf4c6698e5e37660b593b1c5e305576efd47deee16", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983616, "uuid": "25d27744-a2ac-49dc-917a-04187d2a5de8", "value": "T13536339659C62976C0E5C3F8D21E243DB1777B640AB17D0B7BCC7208CE5AA1129BC3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983616, "uuid": "166d919a-a075-4365-99ec-dddc4dbedee9", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983616, "uuid": "dd0a6e30-64da-4205-a6f6-83b88efd45d4", "value": "98304:nhxpRNrQ/RnVF4OflR1zlZJffeB6vFGQOTsqj80Q1Wdk4cIVKPVWj1ECPcI0vYy:ndHrG5f7zZJfWeGtTsqjrQkG45ctAiCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983616, "uuid": "d7f1cb64-adce-4fc9-b131-795ceb6bfaf7", "value": 5213696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983616, "uuid": "4c44b7b3-d6bd-4cd0-8ace-fbbca61d2d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983616, "uuid": "fb3a58b8-b08b-4edd-8dc4-b42d7fd741ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02df6f01-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "5d292638-9766-49a5-b7a3-354c8642b516", "comment": "Malware payload (Mirai)", "value": "0366941fdd5672e102009e0a1523fe26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "5fa58a1c-a2cc-4a14-b2c1-4b866db0cc82", "comment": "Malware payload (Mirai)", "value": "2ee382361d90e132a609142789120179e82c82291ddc7c8a477c3bb922d32093", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "a5322ed3-575a-4fc7-b7c7-7f2a13eece71", "comment": "Malware payload (Mirai)", "value": "a52f02fbacda39ff894a1a227f103412b395931b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "9ea2a0e0-9f02-4a05-b859-dccab639d696", "comment": "Malware payload (Mirai)", "value": "775e0e70f8eec68713caaa841afef3e4f6ccffbaafe8da4de8270062ab956a76fdceac195d7c6e6c788aebfc63486c65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "1b6a7e8c-ea6f-4de4-9141-ddde9a377f5d", "value": "T15024C50AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "4892c79f-0675-4e54-9a27-3e1159dd3450", "value": "3072:a/+gojDrAjMsbpqTIKRsqjPt7qD8pf7oh:a4DgDgTIKRj1qDgf7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048378, "uuid": "eb559ab4-338c-4616-8119-48827b529d31", "value": 211616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048378, "uuid": "b8b93325-132b-4981-915b-cb23b11fbeca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "65ee0c90-e129-43e4-a143-5f54be5bb1d3", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6310e97-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786049564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049564, "uuid": "14b69cf7-c918-4f91-bb58-4415b0cbfc49", "comment": "Malware payload", "value": "5be302261ca861b71f8b75a21e635618", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049564, "uuid": "caf58b55-c541-4cd3-9515-71ced205f617", "comment": "Malware payload", "value": "2f029858b8ecca8fb6c156eb2d046a2463e8b67d356c1003e5567339681a71be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049564, "uuid": "9b1d7636-9085-4a78-9bd4-723f66213c24", "comment": "Malware payload", "value": "4bd636293f63519b3f1f438fa164a1f5cc10fc53", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049564, "uuid": "739a31c9-d3ee-4df1-b822-3198541599a2", "comment": "Malware payload", "value": "5c05c8d15bd2eacc1077d16489547c14bc8a02b53ed14ce921f157a31770b55dad8071eec178421e4eddf4f83ab72760", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049564, "uuid": "029a1a58-90ee-4ad2-86d8-41e588b51869", "value": "T1F3F55B07ACA189F5C095B73188B79296B771B8085B3537C32EA1AFB82FB23D05D76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049564, "uuid": "9fd90eda-2d70-4180-9c1d-30f6cc398b90", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049564, "uuid": "27836a51-524e-4279-82e4-2e6d5ef569b6", "value": "24576:Oebi5XrxIxCv3GiszJcKCDEKboo51CCN0+apQ6OMPZFYKYuumrv/oBele5I92wi7:OebK7mxeGjnWEKcorCCNtsvxumRLVcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049564, "uuid": "a2366fb2-951b-4112-8c7e-e982b0103f7c", "value": 3442048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049564, "uuid": "c4cfe423-c93e-4ab6-904f-152135da7680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049564, "uuid": "208c0eeb-e2b4-4d5d-8731-8cceb5f8b3ac", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afeea3d-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045546, "uuid": "a96fd109-4d65-47ae-afb4-c7f16dc0f206", "comment": "Malware payload (Mirai)", "value": "ace9767652df82f2c1da3db9a4f3f384", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045546, "uuid": "78be2ce7-7a35-4c0f-9b63-684eb75a7a18", "comment": "Malware payload (Mirai)", "value": "2f3cf1211c1809dc10b506f8fb3d2641a8aad04409b64186a82caca3bf58a4ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045546, "uuid": "1763f0c4-4c62-4378-a5dc-9f1fa9c21406", "comment": "Malware payload (Mirai)", "value": "b64c70a875775504b0f7647fd774667a8a9d5089", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045546, "uuid": "28cc01f8-26c3-40dd-ae96-13bd8cd403d7", "comment": "Malware payload (Mirai)", "value": "afee8a6d47bb56bf43016367266155c006ceb4ae4ea39c998465d7ed82bca3d05680fb3721fbf881a6e46320229ecdbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045546, "uuid": "2d050818-945a-4ba2-aa2e-1077bf863652", "value": "T164F33A46E6409B13C5C72776FA9F42493322DB54D3DB330689286FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045546, "uuid": "170ae3e5-3eff-426d-aae4-649efbed68cf", "value": "3072:lyv7nOuds48fBoqd7GnvTaUhp/HAY/g5F35sUyZtUpXHA5/M/9721Fm:lm7Ouds48NKTaUhp/Hd/C35c6pXHAVMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045546, "uuid": "7336005d-8e66-497f-aeaf-b9b96825d050", "value": 167924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045546, "uuid": "f62e4cf2-6e69-4561-86da-f0db450cd996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045546, "uuid": "02dfc361-d3e5-4278-a212-ce9e8a58b841", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98a0b78-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786040202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040202, "uuid": "61aca1f4-bff5-4380-928d-c6f65dcd190f", "comment": "Malware payload (Gafgyt)", "value": "3dccd2cdd64574216ee47e79bd592039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040202, "uuid": "f70499ef-db56-40c9-acef-9f9716d4f6e8", "comment": "Malware payload (Gafgyt)", "value": "2f3e45e98e078db06e3c77997c7ff12515af94c9b970fa5c8298c31097c90aab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040202, "uuid": "ea64c439-90bb-4242-8015-e502af22a978", "comment": "Malware payload (Gafgyt)", "value": "bf3d95c1d44c6c6f7477f8bcfea523d9209cf288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040202, "uuid": "ec33ce15-7bc4-4809-8acd-126efb958d2e", "comment": "Malware payload (Gafgyt)", "value": "a24c0fbd1550734b364b6e3d3f18201ef0c5d1addbb406ce93ad352fe77f556a7d6e7f7da0c5e7aeedb0ef076936d4bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040202, "uuid": "501d88da-15c6-4b86-a5eb-fd0f886eb8ce", "value": "T194542B55FD42EB05C7C122BAFA9E0B8C73136BB8D1FB7202DD147FB5268A46B1E29141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040202, "uuid": "12512834-2c01-4ae2-af6b-3eb587c0fa52", "value": "6144:aLf5MKV5DuLMMnUwxAxwrr4vOUXgi6Z8tgFNX/PPCCkJ0QW2DKqnAX:Yf5BBuLZU1xQr4x6ZXNPCC8zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040202, "uuid": "83cbf608-482e-48ec-89d2-806e46f4eb03", "value": 285472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040202, "uuid": "63852954-6ca9-4082-9699-eefeb2dafa97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040202, "uuid": "aa1b32ff-b274-491d-bfe4-12fe917bb0a4", "value": "pope.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251808d6-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050583, "uuid": "e8070c52-faa5-4923-aa49-f31da8980135", "comment": "Malware payload (Mirai)", "value": "b6f0343531ec9cbce967869559327193", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050583, "uuid": "bc28d381-a654-46c9-9ee5-998a2ea8b097", "comment": "Malware payload (Mirai)", "value": "2f516e833a42b768ed8121ab74dd589f5513dd9531eaa8a5432ff49557bd4472", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050583, "uuid": "2481e576-52d3-4742-9f0f-42a047983dc6", "comment": "Malware payload (Mirai)", "value": "46b24d24f39e4d325ee9f8381571d1601cdc9401", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050583, "uuid": "306b6c9b-5bd2-4491-a4d4-d8484b19b869", "comment": "Malware payload (Mirai)", "value": "61b7968311d8e90cd54003a6f6507f52b5e7c9c5e30dbdfc32ddb960e262d3d561fcd6f5f1faa4e8894f661163890c4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050583, "uuid": "8b6e07e4-aca3-49a1-866f-cae7d609388d", "value": "T124548A1A2E22DF7FF66D867047F389305A9876D62AE1D544F16CE60C1F2028E641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050583, "uuid": "9d41feb6-684c-455c-a773-f3f14ca7c8d0", "value": "6144:cRR/4cIFT5z7L+gzX24siwzrC6lSqpj2TZKjB/6:F5z7TDrwzrVjBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050583, "uuid": "cc756638-ab9f-4291-9833-3565a5af8295", "value": 304656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050583, "uuid": "ad7772a5-9eb2-4f77-995f-9af83acb91ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050583, "uuid": "106ad715-e001-4331-9cc2-9d34798a4d5d", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfc988b-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993768, "uuid": "6e5c8058-3a38-4397-89e9-fc51c4df1540", "comment": "Malware payload (Mirai)", "value": "0630cbab006bf3fc7e7b0b2f4516b7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993768, "uuid": "7c8fab75-7cec-4f68-85ce-640bf7b64179", "comment": "Malware payload (Mirai)", "value": "2f93d5879af42bb204c9bf507b42c52ae113943d0bb750b7a86b4600af014169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993768, "uuid": "0d4c671a-5c14-4e20-9082-f4a03d7aaf6f", "comment": "Malware payload (Mirai)", "value": "115792fda182cda7542f597f9a289224c39cc0ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993768, "uuid": "250645b9-450f-4550-8c11-2f71202f6096", "comment": "Malware payload (Mirai)", "value": "f452865d19a4f5ed2d1962578cbac788996bd64f8338f839050342208803daaf9326df8731462970aa18107520de7ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993768, "uuid": "d225c496-18c9-4eb3-96b5-1240156e6850", "value": "T124C36BC1B10C7EADE5933D7DC20613176E1C9A55DC43810190B6FA57EAA72E32E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993768, "uuid": "32bb5b12-79c8-4420-955c-7e748399bd4a", "value": "3072:rjgytp9TwQkMPZ3zfi9NOCWPnvoypv5MtVTQLLjyoS:rlzkWZGOCWPvPv5M3TQXvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993768, "uuid": "b69c9384-2605-40f2-8235-18a817c55e21", "value": 125308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993768, "uuid": "a08b63ec-6802-4380-937e-8cd43d12b3c2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993768, "uuid": "9bc39c60-70a6-4c3b-a30b-d2f81a29fc5d", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d46ac14-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026088, "uuid": "c8b7ba6f-affb-42ae-b81c-b346c3af8b77", "comment": "Malware payload", "value": "cd91432e82f551fb46896b10efd5ca5d", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026088, "uuid": "65f0f3d2-659a-4c2d-9d46-23d1bfc56b5b", "comment": "Malware payload", "value": "2ff2e74e466cf2c1a230ecebdb3049225d5978c8330e0f601ccf02d53a76b578", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026088, "uuid": "30d34235-6550-4d75-98c8-79651c56a123", "comment": "Malware payload", "value": "bfcc327ba7e787272134102d72b319cb2d63b240", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026088, "uuid": "4f4ed6a4-fdd2-4fae-afe1-450e0df2b353", "comment": "Malware payload", "value": "bafd7bbf4d821ffa90f28ddf2e7561c5f8a00a06fc3aefaaabdb5b823fee82584a35911258664f81b2fee02ee60c1a5b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026088, "uuid": "f1d94139-e7fb-4d63-abb5-f7f2a1655445", "value": "T1D0D42306C8B3F948C6BF583DF50C62E266DE8C115110FA8E3F61B0AC95B546F8B8A55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026088, "uuid": "85729f18-098f-4eb0-bdac-732c6eb57fcb", "value": "12288:CLoqH/ixOBfXh4c5zdkaFwmmtWmnAUZapIC9U/6QiaHBdDn:+zphtdsSICBFeB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026088, "uuid": "0a70379c-e170-4237-aabe-e4914c902360", "value": 641360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026088, "uuid": "d226a5e2-30c3-41fb-b1e2-a4f7a97da5b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026088, "uuid": "8d5cb00a-76c5-4a11-966d-39df87096de7", "value": "P10_Return_Simplified.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e3e46-9178-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786008164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008164, "uuid": "3be76b5a-f287-416a-9285-38f3f3cd1772", "comment": "Malware payload", "value": "be77cd1c6bbd99ee013269875029e5ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008164, "uuid": "5af0300b-0193-4994-9c68-06d9618fa747", "comment": "Malware payload", "value": "2ffc393631f3cfcaaf89fb52a33681b9b6cec8104aa2b1863bafe15986f6c2f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008164, "uuid": "995ecc53-52b5-4384-a4f4-675ee9239a83", "comment": "Malware payload", "value": "7f69a769b370eb14c1c88225374342527be60069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008164, "uuid": "90734dae-31bc-4b87-8155-3d63ba39eae1", "comment": "Malware payload", "value": "2e343786ad8b0ce130850d0703a5e6ef9c9e89a5fa625177fc581edcb3dc9434ab98671691fc8a61493000d2d124c0fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008164, "uuid": "f0df1fc5-1bdb-45ab-b363-2ed114803c00", "value": "T17D1628EB65E9C229C1F9C33AC1924A309133BC752B32C2D75E99359C4A76DF50E3A25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008164, "uuid": "ef720e5f-5cd9-431c-b8a2-59d911389f22", "value": "8b92b16cccf2583edee4dd5468c44a4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008164, "uuid": "616ec7b4-0606-4328-9961-abda24c31dfd", "value": "24576:DbDgFx9Yh4X3K8crBOz7EmkJJrmX/6ACkK7IIfxDapFhLh+gd1C8Az:gHYhdBOz7rbP6AdCxDapzhhd1C7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008164, "uuid": "e044c914-22be-47fd-ad46-f3179d891848", "value": 4178432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008164, "uuid": "4872db0f-13a1-49df-9bac-da29653ee7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008164, "uuid": "45c6cad9-81f5-4f15-896d-367561333afc", "value": "2ffc393631f3cfcaaf89fb52a33681b9b6cec8104aa2b1863bafe15986f6c2f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13948f7-9139-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981212, "uuid": "316f5c31-05cf-4db5-916b-3aa23423ac0e", "comment": "Malware payload (Mirai)", "value": "4690bfecb470957b7086f32470fb4fda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981212, "uuid": "fb0e5264-634e-4719-aa1f-ca66ae43d309", "comment": "Malware payload (Mirai)", "value": "306a43e268d005d7491b1c472d3f13e66ca5551cb5714b5a48f54830f15ad0d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981212, "uuid": "4ba8fdb7-1ff1-4c95-b482-5404adeae7d0", "comment": "Malware payload (Mirai)", "value": "c7bc51a765212d1f55f3baa580c339c64e8d4f5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981212, "uuid": "41f45657-a4ef-4590-87ce-c046b1ff3664", "comment": "Malware payload (Mirai)", "value": "d59b97aca2945de0d2bd7f06aaf246e7e0b05bbbdd89c1c03a7c48b737497d2ed7233b3f656a437a7ee1c1a933e6a053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981212, "uuid": "74a9191c-2bce-48e1-99c1-4a5757fbc75b", "value": "T13D8309C7FC10E97AF409D73B04970A0AB230E3A14A831A76B7473567EE7A1951537F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981212, "uuid": "5a9c22b9-5306-41b3-856c-d2f82a547f1a", "value": "1536:mO82Gi6I8A45G8kvPU37UyAo6zHELyR3w/sznBheZfrWc8B0HohLZZSigIShgn:K2GX5gPUrUyAo6ztRgk6frWcZHaLYOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981212, "uuid": "bdd236ae-63fe-42a8-91a5-3c3f476d9dd7", "value": 87732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981212, "uuid": "66273b8d-e01d-4310-851c-ad0b47f7187d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981212, "uuid": "fcb03487-4a6c-4f92-a9d0-6340264ed31b", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014c2d70-912f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785976649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976649, "uuid": "9da4430b-ebec-47b5-879f-ca849ec0b5a3", "comment": "Malware payload (Mirai)", "value": "80d1a207a1cd95be5c77658529c9f87e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976649, "uuid": "2e84e4bb-423c-4ae4-aba0-87b74b3105ab", "comment": "Malware payload (Mirai)", "value": "30753a7b23ebe62c5daa7ba3930c2aba7859b90070718eb82edada1ef01b4f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976649, "uuid": "1de5d260-b70b-4aaf-b52e-1e52d133b40e", "comment": "Malware payload (Mirai)", "value": "2c010487642ea85ce691bd77c9dd70063e8b1bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785976649, "uuid": "0ef13c0a-2ee2-4e3d-a535-d2207622b2ae", "comment": "Malware payload (Mirai)", "value": "94704f8bfe59e585b97bb00cbc91c3b6aa6521698fc4e0ff21cf21b15b17007e869615cf26802a72b95f0f31224e23cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976649, "uuid": "adb4379c-2fde-48bf-aa5b-5458820d4a1a", "value": "T1308302FFECA4578FE301CDF467B3D5A29B160368D940028534EA575876C0FDC62686A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976649, "uuid": "3f2e523f-fb7b-4413-a91a-305a0fe53c99", "value": "1536:s1BcY50K+FyH3EASExZZX5GKCvE0on4zPP/Wz3J5Eul0w:a0ZFyUApZDC8d2PP63J5Eul0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785976649, "uuid": "1c0f3b53-32f0-4b99-9db1-1f30bccf4347", "value": 82760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785976649, "uuid": "f4ad8d64-2ff6-4a5a-b895-2782d04f16d7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785976649, "uuid": "6e8475f0-1a57-4203-b354-6acab3c24715", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf92f22-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021981, "uuid": "20b0ad63-4fd7-4808-b5e5-016c8d6867a4", "comment": "Malware payload (Mirai)", "value": "526776183dc2c3d2357f75e5248d7b88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021981, "uuid": "cd016b11-ae0a-4390-9ec7-fc2a4b62108d", "comment": "Malware payload (Mirai)", "value": "3080c315540b3013faf6669709bd92c4b958262ede77b76c88f4daf993b859e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021981, "uuid": "7047b43e-0679-4cd3-ac50-6736b58b8013", "comment": "Malware payload (Mirai)", "value": "159d4b2218d624943a7b0f3c7467f8320c946bcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021981, "uuid": "cd918d20-2948-431b-8344-3d647bdc9e3e", "comment": "Malware payload (Mirai)", "value": "71b7271c884fb5a2f8aef6411f74fd87c0a958b3c4e6ca6ef462fe5e509313d7720e0da74e3b6c069b244de7e27d5df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021981, "uuid": "bd103f04-7cae-4471-97d4-0475962e50f8", "value": "T1EBC44AD4F3C65D7DF00619321A83DB16D6166FD2E3285BAE892507493C8CBDBDF22268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021981, "uuid": "c1c94be6-2820-4375-bc2b-a2c5f08c8025", "value": "6144:NY9kxUTvZ7TG9MXfZeFrj35fvjjzhm48ovq9EgDLW75fdtugarorVxoY+Qp3q37:NeVT0IRKJv9mLPfLW1VwS+Qp3q37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021981, "uuid": "dbe4a0a7-f2d3-4f93-81cb-a0c2cf1cdf58", "value": 562880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021981, "uuid": "fd90d6d6-cd8c-4298-9c15-a654b24e449f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021981, "uuid": "39f8b6f1-9c19-46c8-a369-e6b94c93cdbf", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e8442f-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979479, "uuid": "cde951e3-2cac-481b-92da-4ee071fe5e1e", "comment": "Malware payload (Mirai)", "value": "85a9392a8369c0b688e16bc481f8d362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979479, "uuid": "f5311bdd-e04d-49f0-a567-34a957c65e8a", "comment": "Malware payload (Mirai)", "value": "3091e5d6c4d7b71b15bc46b3a7ee6327e9cc1c8b554aedb10bcf0f7986eef4be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979479, "uuid": "cb788e7a-b77e-4394-9a48-0229b94a203f", "comment": "Malware payload (Mirai)", "value": "8d538b27369e3942791665ae1338be655c871c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979479, "uuid": "354bc306-e9b2-449c-b188-2b5abce08bcd", "comment": "Malware payload (Mirai)", "value": "7ce30683a9cd97bdfc6e35c61cf87ee7e10d6057b246610cfd0a281525e0c99f334d72e16928c9182b6b07c5a4926d42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979479, "uuid": "6a89742c-9c77-4ca4-805a-81fbd5ad270c", "value": "T110530174E34397A8EEDB99F0441ECB191748EBF45DB1CB8002666B61A1423B2770EBF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979479, "uuid": "6028c8a8-4ecc-42f7-b6e9-cc561c4d3947", "value": "1536:8kBUZjbiy+qNgUQaXEN8W2I/G05MwwX7uuPNtqQtQP4u+qgw0r+:8kGZay+faEEIZ/e75iQtQP4u+qgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979479, "uuid": "f74f8bb1-6584-45b0-a4de-b9766cf779f9", "value": 64788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979479, "uuid": "8b4d064d-8970-4def-ad5e-b8b2f9176646", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979479, "uuid": "ebe6309e-9d51-461a-b3bb-2f93025b4402", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84552a5-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022161, "uuid": "6e0cdf23-775c-431c-8de4-899fd63217f5", "comment": "Malware payload (Mirai)", "value": "dfd9fdfb073c9a366839025ffac82421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022161, "uuid": "4f433f9d-5326-4cd2-b9b9-e78bc7c7ef4a", "comment": "Malware payload (Mirai)", "value": "30f692360dcbd48498857cac7a7ce2e1118e9f9d1531a47f1d4a08a6a3ecc298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022161, "uuid": "2cba2e68-d7d4-4082-8ec5-3de06bea441b", "comment": "Malware payload (Mirai)", "value": "ab4e75bcb570cf5c664d94a360f7013b6c09f39a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022161, "uuid": "6ec0808a-795f-4703-982d-d0baaa683386", "comment": "Malware payload (Mirai)", "value": "391010ff77606c684bd4cd8464c55f025985e98331bd6dfe861f3452076e6214d9100c7c9632b3dbd5a16296446dc490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022161, "uuid": "0d75c5e1-227b-45b4-9881-597e75e1341d", "value": "T157536131F94267F1CC720A38979A2E496E7709655EEB16715E1B233EED76810CA30F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022161, "uuid": "5ceebd64-d286-4b6b-9821-0a2098f95666", "value": "1536:hCLZmYi+lVBwmuuOxuuuuuuuuuugC5uEnsFz1noHd9JdRnbBVA:84YiuQmC5nYuJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022161, "uuid": "6271f2fd-fa86-4aae-a98c-fd7669553d11", "value": 62120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022161, "uuid": "26795993-caf0-4b3d-bde3-f4f86e0bc9ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022161, "uuid": "13a59fc8-1559-4324-9429-285e9357b449", "value": "main.microblazebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87662477-9193-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1786019824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019824, "uuid": "838b16b3-9a6e-4f43-b147-53c6089bbf94", "comment": "Malware payload (CobaltStrike)", "value": "54a74f0b55029cdb6b808f3043495505", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019824, "uuid": "00ba6d7b-9bff-4989-a51b-e185fc9078a1", "comment": "Malware payload (CobaltStrike)", "value": "3170f50b5cc1dad6eaccd300929d3f93ce7db1c25c7c5f31d86d1ba548464502", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019824, "uuid": "76b215a7-646d-4e2c-a04e-cc7ba2d08cc2", "comment": "Malware payload (CobaltStrike)", "value": "303618aa569c18adbd51e49c4fc03875525fe074", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019824, "uuid": "fcf42e50-6362-4955-9e9b-2de8982b9ebf", "comment": "Malware payload (CobaltStrike)", "value": "991e5f149a803bc67b47238976be25618bb0c4f79aa3ac1f1d513b3db6554a1046332066a2d41497746730d65cbc58a3", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019824, "uuid": "4e805675-a800-47ee-8948-8c438cdcad4a", "value": "T18DE423FB87589660CA756797309A3F1BB685C17C506CEF2E21C2831C652C30999B3AFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019824, "uuid": "013b4c4b-fad8-4a17-939c-04a2161619b1", "value": "12288:DhrRZ31OmYj/ZkO3o7claovxKFER/kIGlZ+cLLsvlV/sVdG55xDLmYW:VX1dEkOBmFER/xGlrIlVU65XWYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786019824, "uuid": "1c58af85-d0e5-4cb4-8742-498eae71335d", "value": 663903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786019824, "uuid": "6b14e8d0-fd7e-4fe5-8112-99832b8ea37d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019824, "uuid": "22b7d71c-8992-4086-9b5d-26e155b6bb17", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde1917-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979485, "uuid": "64c70182-4062-4481-81ce-cf62a8553313", "comment": "Malware payload (Mirai)", "value": "b3e649e99a379ed479fb9d6511bad3b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979485, "uuid": "e368a252-e3f2-4293-8f46-4b1838d8b15d", "comment": "Malware payload (Mirai)", "value": "3233d5128b3453c621d31df5c3d1ce4525318068224c0ab37c609a72884c3f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979485, "uuid": "1c1a7212-f120-4a6f-aebb-0079e59071fc", "comment": "Malware payload (Mirai)", "value": "21fdc522cfb226cea56b1fe7fef3c97b207fbf66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979485, "uuid": "2e609f20-4eab-41c3-8745-40e69e3e6b23", "comment": "Malware payload (Mirai)", "value": "f8ec212560113908ee1fffd9a0f8522e6ee70e95e339506f144067e1170dcbe40b89cb9c7bac14db7368d2c8ed0d9194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979485, "uuid": "9065de77-9f5e-4493-8c7b-82ec5fb7c5a4", "value": "T19D830262C3B44A6AE48F82B7551904FB7AB1B70D6C1D07EAE5FBE2071A350DF8409F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979485, "uuid": "911d4cf4-4481-485b-9e30-536489de77cd", "value": "1536:Yd2A4JLL921sR/ITcPry9sDBdjY6Jp3KbqzqWY97PTE3TPKFhqgcJ0KRlaeQueo:Y8Ao52mR/ITq6+2WY9EjPKJcJ0KbTeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979485, "uuid": "3e835bfb-9896-44f3-a20f-aa6a5f4fa1e7", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979485, "uuid": "d1498a88-d398-46f9-beca-b9fdbdc04da7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979485, "uuid": "e3f3a2e1-658c-48be-be0d-22ba488f62a1", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f33943-918d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1786017155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017155, "uuid": "be9766bc-b757-4927-a5cd-ffd80471ead6", "comment": "Malware payload (AdaptixC2)", "value": "4339992a31aaee2ca8802cff5a40c43b", "object_relation": "md5", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017155, "uuid": "a516fe7c-64f1-40b4-99cf-75736ffe54d8", "comment": "Malware payload (AdaptixC2)", "value": "3260d94ea8b51c306f506eff40997055b9cefd0a79c2b6fda4c8c8aea8e8dbc1", "object_relation": "sha256", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017155, "uuid": "3fc4c6c4-4bc6-42c8-9c9e-b948e5b44a67", "comment": "Malware payload (AdaptixC2)", "value": "ba110f49cb787438c2d4dd8886c964f96049f417", "object_relation": "sha1", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017155, "uuid": "097d028f-24d8-4229-9886-3dc3ce143ccd", "comment": "Malware payload (AdaptixC2)", "value": "89469cac69b4bf34708dcc9976affdd525de3e071d2c59eb915adb02b4b99de93eec209a19c1250f3de89078021dd1b9", "object_relation": "sha3-384", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017155, "uuid": "fa771f0b-a3bd-4e75-a49a-3cdd5515642c", "value": "T11FC37337D3B3C4ADC05AD234AB8395B3B9F07C1C4634752A478596223B5BE786BBE184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017155, "uuid": "596477e0-bf3d-4bd3-a327-3ecef37b205b", "value": "cd54411d9ca69fabd0c0174b3b55155b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017155, "uuid": "ed74cc5a-66b7-435e-bd8b-490e2d971956", "value": "1536:PuQzmVOORWx9V8qd/JO20BawX+P7uBJr+UeTgc118QwVti4SSzJ0tosHo+r6xzyl:P5zmEv/VTQOaqgD2iz0wdARaKmEnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786017155, "uuid": "6e725e59-c2a1-41fb-af67-32ad48c264d0", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786017155, "uuid": "42f3ce38-5987-4fe3-bc31-b524ed146703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017155, "uuid": "ccc15b43-cbf5-429d-a746-accee2c5d12d", "value": "dbsql2_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ee0ef2-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996056, "uuid": "12a7dd41-df63-4ea0-99c5-0f710467338d", "comment": "Malware payload (Mirai)", "value": "caec9f2ede688783057141033337aba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996056, "uuid": "f745adc8-4a73-4917-95fd-af0266035577", "comment": "Malware payload (Mirai)", "value": "32ce061066c5f24713c468244edad05ecfa434bc438ddd7ae8b85220cd0c38b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996056, "uuid": "8762198f-34be-4f71-8b95-9fab49fdcf50", "comment": "Malware payload (Mirai)", "value": "0f81273ac16d7b038ed38edd4be440291a1c27a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996056, "uuid": "a74f3cd0-a867-4d46-81fa-134d282cd52d", "comment": "Malware payload (Mirai)", "value": "6dc3b54d84ee5d3f4eee3b21ec2b86cbdab5fe5b2ba01ff11437e03eb43b397ef500327d05e6f1b7d68fab50e5ae288a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996056, "uuid": "b9ee137d-7582-406e-b82d-4e60d1cf7fe9", "value": "T170D32A56B9518B12C1C321BAFB9F514D33136FB8E3ED32129D14AF60678B8DB0E76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996056, "uuid": "5ab7d9ab-e8f3-47d4-a87c-567c380ddf25", "value": "3072:TXBi11WlufdG8PmY259T1+ys3L8aOjSL8NYmzzp/rM2jL:To1IlufdG8Pu31Ns3AaqSKYmdrM2jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996056, "uuid": "4b1b7297-95e7-4a93-93d0-42647b3cfd2e", "value": 133116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996056, "uuid": "02d64eea-b878-4da3-a9fa-7c1867e1a653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996056, "uuid": "31d21a61-3b61-4fa4-a21d-4ae8dc19848f", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669d1715-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785994428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994428, "uuid": "e7e64e04-7028-4c86-bbb1-4567372ffb7d", "comment": "Malware payload (PureRAT)", "value": "0f4f5b9c26d16a8594b8bca526b824a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994428, "uuid": "c85422f6-a579-4cd8-8d8b-b4fd42dff446", "comment": "Malware payload (PureRAT)", "value": "32dffaea1d2a0713f83910f760ec3ad0562555ff2c2f4bb7edf5c3c0a37c7b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994428, "uuid": "03e9e40c-0352-4fa5-bcab-286f3ed42839", "comment": "Malware payload (PureRAT)", "value": "dd140141f07d13d2fedeff5c9fab9a68ae3738e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994428, "uuid": "9e78a2d7-6546-4e8e-bfa7-df49b4456501", "comment": "Malware payload (PureRAT)", "value": "7ca24a27bfae7deafbfb76baad4d148dab7b0a8dceecee82d4d4be82ccd3e0d05e7ed6f6ce321e1e549050f822bf543a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994428, "uuid": "65fc2874-b0e3-405d-9f4e-50bf11d09b41", "value": "T1A194230B370EA37AD71AAC35BA17077A2040CB9671069358F6FC6E79282BF74167A711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994428, "uuid": "18ad31ed-ed3d-45b6-b1ff-e8cd1f95c9d2", "value": "6144:uOuFihJi64Yf8JXcFhE9+fwFPA5NiK/1f1ipZAC3/uk9LEVchTZVlhgl:ukTX4hqQA5QK9YZAU/p9LztXlql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994428, "uuid": "11461d7e-c633-496c-9569-8bb6fe13142e", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994428, "uuid": "141eff4d-028a-418a-8c0a-b59545701e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994428, "uuid": "77c8ae98-ec9a-4647-8a4c-609d679d5bc5", "value": "0f4f5b9c26d16a8594b8bca526b824a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19407d13-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026081, "uuid": "0e0ff883-d21a-48a3-b372-e94f6ff183bc", "comment": "Malware payload (RemcosRAT)", "value": "87eb0a1a6b07479bc1065576d10ccf53", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026081, "uuid": "e031920a-a478-48d6-891c-98e0b91de2af", "comment": "Malware payload (RemcosRAT)", "value": "32f7eefee64db549de9a1299ae677db39d34df0736d6bd3f1b69dcd1a67284a9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026081, "uuid": "7b0533ff-df19-444f-9120-767f07a51c8e", "comment": "Malware payload (RemcosRAT)", "value": "acf1f46a59a8c675eafb52051956322aaecdb763", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026081, "uuid": "08f31f54-83cd-4042-9ce5-c507c90ffb71", "comment": "Malware payload (RemcosRAT)", "value": "6b44cf4747ef65d12801608b2bd2e7628d021ce67e0e75be294ed390bfd3b25fd00f08e93535465a8cbfddcfc7a840f8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026081, "uuid": "24e1f7b0-6d07-41e0-b49f-6d983baca369", "value": "T16A151211EF848937CDD297380B9372C5E60DFC679E6B4B0A57487369783B6F4A861C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026081, "uuid": "8cbef8b7-ddda-4189-b535-55a201c9fce5", "value": "12288:DrKPdVpw2F1J+RT/II8fp4rm4y+ev5B95S1UiXFZYeC/FF1anBTNex4Ae5rcMoTb:/Kdt1QRT/64rmFu1UiVNC/z1yPkUrwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026081, "uuid": "258518d7-52cd-4c5d-a94a-079003f91564", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026081, "uuid": "db326392-483f-43f5-8e5f-35b2520ae9c1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026081, "uuid": "61bce5d1-379f-4f3f-b15b-1a0105bb909c", "value": "PO-159621_Order_List_Technical_Specifications_and_Quality_Requirements.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680d8f5e-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786005598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005598, "uuid": "03a71bf0-a0ca-485c-a3f3-6ef59cce256a", "comment": "Malware payload (MassLogger)", "value": "9478751d6c133b32f841efe8b1f87a74", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005598, "uuid": "05159276-5d0c-4bc3-93be-26e24a5786f4", "comment": "Malware payload (MassLogger)", "value": "33018cae66e6edefbd6f0e24e45f3549bcd19075f153a9b014165655bffefed8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005598, "uuid": "0cdbccb6-7c56-4eab-9862-20fd0884261a", "comment": "Malware payload (MassLogger)", "value": "9bbfc8950d3a5ddf818115b81cc08266271747c2", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005598, "uuid": "0b9f7998-648b-4c8a-b93d-be03c64557e9", "comment": "Malware payload (MassLogger)", "value": "1e34a3cdf5b5d229f436ec6181db35eab3eccdd36d179d3ab1931f6ac2903d80197ae5a562d34880d3d1f1375afbe9a5", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005598, "uuid": "9988dc13-ca5a-47b2-8ab9-7656c4e68eec", "value": "T16F5390A21E28C0E32D5DB45860C5DFEE8A767117BDB94D0713648BA2CEBD1CB3E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005598, "uuid": "a2b0ab2a-003c-4190-b797-09a6de569061", "value": "768:a9yjL/llafwf5g44abyEoSLW9uaZ6q+4L5ftfuPIvIZIHpPDaNQ0Gp/kbpNlSNAC:NaKIEoxSQGID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005598, "uuid": "87f4cd62-17b2-4e89-87e2-fdeaa2955508", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005598, "uuid": "9c46419d-7d9f-42ca-b2f0-b3f0070a76e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005598, "uuid": "0d80b5b7-6ffd-450e-be42-c1ac7e4b0ba8", "value": "rrk00462.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729aa279-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034392, "uuid": "13ce4d42-50ed-494d-b9a6-d1b773534e1c", "comment": "Malware payload (Mirai)", "value": "81455481d1130a5d85c80081c4f79675", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034392, "uuid": "849f98e8-73dc-4a20-9912-f2d62d2dfbe4", "comment": "Malware payload (Mirai)", "value": "337a796be64286e16e31dde7b8ee48b2dba3f76314e017ae1c8a2be37bb36162", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034392, "uuid": "100039c6-35da-44d9-9454-ad8d935428f1", "comment": "Malware payload (Mirai)", "value": "4564487a28da48a8d1ad97c5967737b50b78cc10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034392, "uuid": "0c8f2a5d-414a-4334-8925-47cf778eb77c", "comment": "Malware payload (Mirai)", "value": "8565ae20bac5fe4282d2ac8f7457dfdf3ada8f2764d20ef46d0a3b8a579ef11c4e93e70ad63108a4f18c555bc3a1ca2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034392, "uuid": "edc5512f-8631-45b8-8b4f-a10409d4bdeb", "value": "T12D344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034392, "uuid": "0d9bdc90-a1d5-4322-a13d-76db4fe9ce87", "value": "6144:W8tTPA0OBzabKacEK1dAnJd7uLfdfM/9hWfAU:W8RAVBzabKacE62Jkp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034392, "uuid": "2a846442-82b5-4090-8c72-5ce2bf43f1cb", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034392, "uuid": "092a34a0-ce4f-4fdd-b97e-3430e4961021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034392, "uuid": "0c844712-e6db-4989-8336-2cbef23c3293", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce54c38-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005525, "uuid": "f16acb35-c90f-43d8-82f1-3155131d54da", "comment": "Malware payload (AgentTesla)", "value": "b8179a874550d8162936ea47045c36af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005525, "uuid": "34e6fdd0-369e-455c-8d77-76a3debf8111", "comment": "Malware payload (AgentTesla)", "value": "33a236fda76a3d96c6d5c7057a946fd8a5f78e86fc63de9de70a809e3a362533", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005525, "uuid": "8ef04f45-bcfc-4d24-b4a5-5a63595e87fb", "comment": "Malware payload (AgentTesla)", "value": "420bd579de3dba215ef64dd76e1fdf15cc094546", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005525, "uuid": "7ff8e533-fbf3-45b9-a227-41c3e52fe7c6", "comment": "Malware payload (AgentTesla)", "value": "21c78975293e1baebf2274458be5c73716820705a0f3c8c179f3b85d1acfe390123d03a0c6b2b72eedff4ee8aaf364b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005525, "uuid": "24612468-1015-4d3f-a32f-c65b8230c2e7", "value": "T10625738EC6A36073914046788E59FCC78B4B881B2C975FF972D96CC04653188FA79DFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005525, "uuid": "907e75b0-d0b7-425d-a51d-204360c792d6", "value": "96:fdEGYGOG6G2IGcGYdEGsG2sosoIGcGYdEG2osoKG6G2KGEGvdEGYGEGsG2VdEGsh:XuxGGdLzwvebxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005525, "uuid": "df931679-d8b5-4275-8ad4-3af95c28668b", "value": 1036997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005525, "uuid": "3a3d56c7-99a3-4aa0-87c8-eaa46ecd587f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005525, "uuid": "2f511f96-18a6-40ae-a819-75545d0499ae", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bad460-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994405, "uuid": "f798f017-87cd-4989-8bb1-e52610d1b47a", "comment": "Malware payload", "value": "528dcc9e21e98e04a2871b92f4e1825d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994405, "uuid": "eeffe68a-524c-4b34-886f-8232b5967056", "comment": "Malware payload", "value": "33f5c2c34d612134649f0cae07b5bd9abb7e23e778d163c2fbc6c61407a4a2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994405, "uuid": "f6c69aa8-9d0c-46d2-b196-80f7c48dcfa9", "comment": "Malware payload", "value": "b7c69bb60dc1568c80ec102c9b7fa7276e2cca1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994405, "uuid": "ea3f12a7-1904-40c4-925e-999f1e878573", "comment": "Malware payload", "value": "18bbb3c297e3808a47183afa974581c3ad4164bc6f35d8d7c1fdfaf911c9f826603f03329a97be741650dc77ff73af5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994405, "uuid": "2ba259f2-c0b2-4965-8157-8149f544c189", "value": "T1E656338D3594B9EFC84BD8B55A586EA4DB9538B6031FA607790722ACCE0C35FCF84076", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994405, "uuid": "315e49c7-b946-4c8e-9b57-6a9f69de2635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994405, "uuid": "1bc99a42-5bf5-483a-b492-5e20740c5c03", "value": "98304:uWGT4IzIrgy0vMntO9PO5GvKIJDAtLu/UZB5F+A2C1XviFF6Yo5n7QpTDYT:uWG8EqnadhaK/aLwKd6B4cpTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994405, "uuid": "4e5e13ba-b372-4ca3-ab86-be0ffac40ae5", "value": 6347264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994405, "uuid": "e804152b-0447-45a5-bc34-7d4bebbf2f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994405, "uuid": "193da478-696b-46b4-b52c-ff1025b242e7", "value": "528dcc9e21e98e04a2871b92f4e1825d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ae412e-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022151, "uuid": "5fb85ac8-371f-4713-a66e-50280741b3c8", "comment": "Malware payload (Mirai)", "value": "905324304b664aeac049979196707387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022151, "uuid": "2cbf93db-71ad-4f70-b456-bf07e665de1c", "comment": "Malware payload (Mirai)", "value": "348168a1b5956e10c04390d58b867a0d5ab801a118a36ee2db8a77febac98216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022151, "uuid": "b9758f15-a369-4c08-bc6d-a23a9bf22231", "comment": "Malware payload (Mirai)", "value": "6b480fd06303352a46a0bcfb1009d9fe564c6c65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022151, "uuid": "ac165cd1-4406-49e1-9025-6fd605f4e7ef", "comment": "Malware payload (Mirai)", "value": "b6a1482c21f8acabb04a07dd8f1d218e660bf1955a1bf1b01aa4956abc5463daccd044f0d35d1ae7ccdd86e228cfa637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022151, "uuid": "f5c4063f-4587-4b56-8879-b0607d42e46e", "value": "T13563EA06ED926AF7C41FCE70952DC14A01DA5CBE92EA511E31F8D98C7BBD3464AD3C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022151, "uuid": "08d8fcae-45d9-4625-9ac0-4a894b760109", "value": "1536:BKjkuLv5TkyHFlqPshJ6ceBc9BcKqGqoY:BK5v5dJ3jeNKq5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022151, "uuid": "e11ea4cb-c8f2-4984-8b50-2b1d9295b8ff", "value": 72768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022151, "uuid": "5df715fb-d935-4f43-8959-2244d8892df2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022151, "uuid": "1b644452-79b6-4d0b-9be0-aee2039db96a", "value": "main.mips32el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f609c49e-91c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786043202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043202, "uuid": "b1e3f400-310f-4a3d-8349-a326a352148f", "comment": "Malware payload", "value": "6e414d87a2430d17e0f00b78a48efd0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043202, "uuid": "847b3b58-657c-4630-a52f-1ae94dcfce73", "comment": "Malware payload", "value": "34ca57e6496b7758f00a95a42f9e8e030585b6f0cbc9425a92f607ae44fb9b12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043202, "uuid": "2e7f7148-75cb-4550-9113-6d2e2d58cee2", "comment": "Malware payload", "value": "ad211e88de23f0d8e97220e7ee616ed9a9948ae9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043202, "uuid": "a6e32016-3dcd-45d9-b3d3-da86a14e0574", "comment": "Malware payload", "value": "e20b0deff9b77c293a9ff929fbe7e45d227126cc8a5555e8dbc61e962fad97488f5a75d1152c16e6eb6342743b7bfbee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043202, "uuid": "2a274267-9212-4a0d-bced-799a9a67d122", "value": "T17A237D6126857C14AA99C8371D7E2F0CBDAD43E6320452EE7FCB3CF68C4A69CA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043202, "uuid": "9556d009-1d7a-475b-8b9d-8ead9cc8e206", "value": "768:b6rDTPjHD9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:er3Qcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786043202, "uuid": "25bca451-62a5-4da1-8d09-e68e3a0966dd", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786043202, "uuid": "d6935ee7-c2d8-41a8-9c15-c2ef92b78ec4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043202, "uuid": "4ed727b0-7a98-48b7-9337-f619a78d82af", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb5665d-918d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786017232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017232, "uuid": "77d5363d-644b-476b-8f41-e1b76f741c75", "comment": "Malware payload (ConnectWise)", "value": "bf419d229029aa24121d7e2b4bf97f9b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017232, "uuid": "699f3c54-b340-4f8f-b52f-f0d8e45bdca7", "comment": "Malware payload (ConnectWise)", "value": "35102c739b5a1c52f6e33ed0456b207e0a206a3cd5ba59f5efe3ae85918b3658", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017232, "uuid": "15ed3c3b-906c-4375-ba63-6fc3c9fb8d3a", "comment": "Malware payload (ConnectWise)", "value": "3938fb41aeb1640dc664b225d4e6e5a033363955", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017232, "uuid": "b850d3aa-9ef0-4fd2-9963-909c754ea1b8", "comment": "Malware payload (ConnectWise)", "value": "4aedab1f6efc82d3630af169b8f0c75632b732aadc6b7ba84a3b5c9c0572d39f0193e1d456d72031020e31aa2762332e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017232, "uuid": "7c0eb512-4cd9-4b07-809e-e82572d9dc29", "value": "T1D736023FF28B653EE069563A39B2A110943B7A6165134C1696FCF88CCF251B01E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017232, "uuid": "042d3b04-c800-4c7b-a70f-1bc4d95ad391", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017232, "uuid": "f09740c7-03d9-4b96-932b-33942170d3fd", "value": "98304:45O1V775bzfuwOSgDhhfe+5lpOJ75z1c/03bX493Z8nJ:c+1bzfVOLDh9/lK7x1c8IBSnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786017232, "uuid": "d933dc49-af05-4a2f-aaea-c80cb5b1ef68", "value": 4889848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786017232, "uuid": "8f6cb473-1bb7-4c13-b869-d2c4110c0eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017232, "uuid": "c3a25018-6b99-4ce2-9eb4-0d64af2f901e", "value": "SecuriteInfo.com.W32.ConnectWise.AE.gen.Eldorado.4067.5403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee2d040-91e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786056639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056639, "uuid": "dbc6e6c0-33ce-4551-aaed-3af1575c80a9", "comment": "Malware payload", "value": "4e36b5a1aeb323557936b7bc8665a7ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056639, "uuid": "3e1ec3b8-ebf7-4b3d-b2cf-5b4781d7ae28", "comment": "Malware payload", "value": "353c5fe38cd4e5a0736da021581f782be3c5f6f73da4a035f11f70a305dc19f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056639, "uuid": "90d0b5f5-f035-42a1-a7b8-7cf28a83d4d8", "comment": "Malware payload", "value": "8cc7e5ee18fa96656c4bfe44ad839259a558dcde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056639, "uuid": "7d05a90e-cfc3-4994-82e3-4751f7d381a5", "comment": "Malware payload", "value": "bcb4a54fcd6e7da7471777006805fe19504f39a882203d16ac80f832727a694e15439ab95892a474574ca0573870e5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056639, "uuid": "fc49cfe5-ec51-4bf9-8fa8-5ede0aeb6a18", "value": "T15F33D645FA41AB05D5E232FAFB8E414D3317AFA8E3F9312199305FA013C6ADB0B76525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056639, "uuid": "00feb1ff-a9bc-479d-9993-3ec3b0f3055f", "value": "1536:dNnT9qKqvYiSrdwotXAGfflUyGAig4zurEy:T9qhSrdwotXoq4zMEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786056639, "uuid": "29db69c7-6b4d-4701-958b-51448c8c9246", "value": 53868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786056639, "uuid": "e1afcb74-2653-4c4b-b588-3b521823f2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056639, "uuid": "efc42cf1-ab9a-4ccd-96d1-77167f0c5f53", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.25962.11260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2863f570-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026107, "uuid": "80c1ebaa-b7b1-46db-b843-df97fa5d5dd5", "comment": "Malware payload", "value": "dadb0456537c460844da74dc5609a753", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026107, "uuid": "02382f3a-90c5-43c9-9c59-8a75bffcc729", "comment": "Malware payload", "value": "35dfd49d00dbd9fdec834dcc8627738562e5a58717b72525cd21bb729cee4980", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026107, "uuid": "15c37e6d-ddb1-4d0a-ab3a-9ed0ddae878c", "comment": "Malware payload", "value": "535f77b77f9ec4ffb8da65fe76872baa83c7764c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026107, "uuid": "69248110-6639-4bb9-afcf-d4dcf9320e76", "comment": "Malware payload", "value": "ef2e3591d0e6a8938332a0fd26500bfd0c1bb660ff849088b4d404adf332b41dfd928b4a8a66a4cbde809aa68e344b87", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026107, "uuid": "dc63afd9-7e2a-49a4-abc3-f8df5b60ce46", "value": "T124151212FE804837C992973C0F5366D1E61DEC6B9E2A4E0A578533797C3B6F4E9A2C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026107, "uuid": "db621910-08ba-44d6-b45c-0df003085087", "value": "24576:hKpt1QRT/64rmNu1UiVN6BPiWjb8MSsS:hKptmB6Lu19voPiw8fsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026107, "uuid": "4b8b86bd-4018-4e2d-a73f-f0411664584c", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026107, "uuid": "958bc14c-ee54-4546-910c-5f0873ddc7a0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026107, "uuid": "134bc3c7-7b1e-4ea5-84d0-934152d03a4d", "value": "Bulk order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc13b58c-916d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786003699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003699, "uuid": "57d7b7fe-48f7-4343-b5be-dd2c6996c90f", "comment": "Malware payload (ConnectWise)", "value": "950e960b6e04cbeb9f331c7ae80bf767", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003699, "uuid": "022c0477-b2e0-4e52-9689-2dd875a13e08", "comment": "Malware payload (ConnectWise)", "value": "368c2dd0c55c29b81ee53295d553f2c6f4509b99d5db2838df43238cdc76f309", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003699, "uuid": "0038abe6-6190-4694-8ced-d4a0635ce33c", "comment": "Malware payload (ConnectWise)", "value": "37097c13e2d236cbf19f60ee422a1c558220e071", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003699, "uuid": "fe5e131a-994a-43d9-bbaa-8ed976791af4", "comment": "Malware payload (ConnectWise)", "value": "2b62369f0a42d03c9873a0b85b2e4803b08a492a2efc805c99ce5df505a6001151c5a7df902b436796ab4652e1a68d3c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003699, "uuid": "6c70cf52-d980-4338-8db6-140cbb3f2030", "value": "T146C61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003699, "uuid": "4f3374f5-2e5b-4695-9d00-f919e08cfa71", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003699, "uuid": "4d67fe02-10ec-4e18-bb2f-59d38abba0ae", "value": "196608:W1TfefPqXQyiixtMjGZ1jhlrwUCQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMjI:WYPnjGrrbPnj5PnjgPnjqPnjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003699, "uuid": "ae354f05-f4d9-43c9-ae31-c118afe9c410", "value": 11624136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003699, "uuid": "8c1f12af-c27f-4290-8846-762ec74f5438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003699, "uuid": "144b3397-400d-4133-8cd1-5df9ddf17658", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c110f6e-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005229, "uuid": "df263cd5-15ab-4350-bfe8-2ec0533357a6", "comment": "Malware payload (AgentTesla)", "value": "3a1c2f6f5209478a1cc7912553442c36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005229, "uuid": "90a4c351-993e-4d07-b73d-85c227773691", "comment": "Malware payload (AgentTesla)", "value": "368c897a66748451a53ac55e9d9844d7a1f4d9e961bbeddddcad844a0a5e21e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005229, "uuid": "0f9491cf-655e-45a0-aa2b-b6c97bd3df8c", "comment": "Malware payload (AgentTesla)", "value": "91cc62192f38eff5e984ba0bd4fd3f16ab784bd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005229, "uuid": "2a916503-cb86-4320-b47d-762c641098a4", "comment": "Malware payload (AgentTesla)", "value": "d0c036a114a0c69cded3e846da526b4caabb3471e80b266fa8be8a94b98cf9c20b0eb63fee57c1459d519bbeaa2f008e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005229, "uuid": "16578adc-c878-41cf-8110-d46c51c08fdf", "value": "T1B7F6D10501F18E3292B22C1D2DEA29712BBF616376BE71D1F342167DA950827C1FEB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005229, "uuid": "8712f14a-8347-4f42-966d-0ff506424727", "value": "192:KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKX:NUMXKMQXM42Ma5MOLtZFkqV9Qq3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005229, "uuid": "6accfd9d-4f6e-418e-96a4-ee14847e576d", "value": 15770164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005229, "uuid": "31317707-1f36-422e-8777-81532417d403", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005229, "uuid": "081ab4e8-69b8-4a05-9661-cded62abbd40", "value": "Proforma Invoice 40966.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718c35db-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "f8c580ab-cacb-485d-b769-587c4b077b3f", "comment": "Malware payload (Mirai)", "value": "28e476eae205458946b6e54e437a1179", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "392120fc-0f8a-4fb5-b991-5111cfa4c5f3", "comment": "Malware payload (Mirai)", "value": "36fd38fb3bde624b67d2e7be824a7da3b552326f8ad203976d49dfb87e4b3547", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "0e5ea3ef-5e56-45b5-9bfd-607bef874a11", "comment": "Malware payload (Mirai)", "value": "0c49bf5853ca30dfc0ed17c5e35f581137946782", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "cdafcbb6-b7e5-4761-99f2-f3e145281da7", "comment": "Malware payload (Mirai)", "value": "79691d7ad8cbc52deb1ca1f1c2d71a956eddec1f77db54397d8cd141eea1a3e450fe5f39965c2f60838f27ef5fecbb68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "b88db874-49cf-4ef7-b81a-e5d6f90a545a", "value": "T17493E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "b6491197-5086-41f1-86c3-1155d2a4e9c7", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8zn:8+tsCurVDN+ouw8Lin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034390, "uuid": "40d73070-f01b-4b82-8a1b-07a17761517f", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034390, "uuid": "b3168e12-749f-4e30-a5cf-c1c9b18e229a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "4bec0b21-0c64-46db-903f-e35771f0f287", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e3a79c-91b6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786034797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "e8dbbaca-444a-4a94-9a36-67ff3acf648f", "comment": "Malware payload", "value": "44933652aa45d85450103a73af6e5f70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "cc60299f-e1dd-40d1-b359-69fb03466df8", "comment": "Malware payload", "value": "370497b3e639e4fb260ed0139b8ec18b2c12fe914cbc056976a4bd10fb8d4aea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "1d427fd6-c102-43f9-a098-2af089491bdd", "comment": "Malware payload", "value": "c888ffb860b9db9e4ed65292d824f820da0bdb04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034797, "uuid": "43b0eb5f-0198-4508-93e0-14c694621d16", "comment": "Malware payload", "value": "b774d52c4e8a1d80151e1ca3c9cdab2c96b78217bb5f704c8ab8d27ffd27ce0ba8b8b61efd46baea2a3b8082c97a614c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "0ad5000f-0913-4c24-aa09-a399c1a5528c", "value": "T1B1C080574610947FDD3BCC50DDAD4172664E71C3421362C17547481174016D79D5C9DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "81ce6c91-e138-4ceb-ac87-b9f3972b2e22", "value": "3:mKDDGKSSJJFISFeBwHTXjcARmaTuKIEM+OJqQ2JAFCSA6BNeu1MFCUHA6BN2yM9b:hSG8SFrTTJwaTFIEM+OJy5z6Su1MFCzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034797, "uuid": "1e844dfc-8627-4be8-b903-20b299680a9b", "value": 176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034797, "uuid": "af4f369a-453c-41aa-9e61-2ffaecf6ac3f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034797, "uuid": "71e3617d-65f0-415f-94c6-c442b563fa7d", "value": "x.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b95612-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046846, "uuid": "b660eee4-2aac-4b62-8f86-d302bd3d21db", "comment": "Malware payload (Mirai)", "value": "2c18f5eb494e42ae3a15ef18199dda23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046846, "uuid": "8d125fb4-112b-44c2-8792-f36fa2ba2800", "comment": "Malware payload (Mirai)", "value": "3765c1701c91925ae8265173e0fcf7e56938fb2994f920515aa0dc40eaa44cbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046846, "uuid": "cb626650-be73-4708-9a2b-24c718f227a1", "comment": "Malware payload (Mirai)", "value": "802c9aa3233ffc1a8e8c1b35cf3b79735888eef0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046846, "uuid": "0b1695b2-0396-4378-bc86-3b6de6609346", "comment": "Malware payload (Mirai)", "value": "8109bb53fc3d37b4467fff38d7842ade40c2329d63d88fba2c803eda8a870bc795afd8d0d62561b191c5f568e6fe10dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046846, "uuid": "56d50899-331d-477a-afae-835b8c9ba25b", "value": "T1C1246BA8BA0F6C41F2C3D3F8DE8C87E13A1735E3C7768971791212EDCAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046846, "uuid": "8fb6d604-17d5-4503-a6eb-516cc3a5c03b", "value": "3072:ywn11ScpwRz0maXCvz9P+HyC37HbKG9P9nKMheLboqN3y:p11ScKRz0mayvhPIyu7HWwnKHLboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046846, "uuid": "f61dc562-7657-46ee-bde2-57ddc7e86733", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046846, "uuid": "a22c3730-3216-45e1-b5f7-f2af1412f721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046846, "uuid": "9804456e-f0a7-4f11-8f6f-f4997c4f7641", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d66eee-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022001, "uuid": "ac0095a5-eb20-49e1-963d-454dc37f08e3", "comment": "Malware payload (Mirai)", "value": "c308022cf31458c86340f3886e00bb77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022001, "uuid": "5fd26736-9507-459d-8338-61c2a10f156b", "comment": "Malware payload (Mirai)", "value": "380ae1df7465ce458e1fd8b343c2c132e98f45d8e9947e8f4de596e00a7d44a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022001, "uuid": "461ec9a4-d717-455a-9e42-a621c87ee25b", "comment": "Malware payload (Mirai)", "value": "450b54e334692edfcfd481e30dcdf1e343377cc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022001, "uuid": "25e09762-fa9b-4112-956d-bfe7faf38c50", "comment": "Malware payload (Mirai)", "value": "c59048bf075f9513fc6d4f19effa1a091fd798dcfa30bf9e14569f3142e18f025fa27e05ae9fca72be3edf0f64295449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022001, "uuid": "28e1941a-9bb7-4881-a4ab-68bfea3ef67a", "value": "T157030A46EA519B06C5D232BEFB8D414E37136F68E7FE32359A306FE013825E70A35525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022001, "uuid": "0bf04505-7511-4b8f-b560-ecfb5837b662", "value": "768:1F5nTvY9TWPiuAlMLokZqDZmO0J0M4VCi6jtgnw04+aVswL/:f5nTvY9TWPiu0MLo8qYniMhi6jGnw0S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022001, "uuid": "6248fc09-d407-4533-9ad6-b96f9c1b9a1d", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022001, "uuid": "7c763ae5-3c59-45e7-8f1e-9405bc1f0501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022001, "uuid": "eee64ce4-167b-4c7c-aafb-a046f94fabf3", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a664691-9196-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1786021090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021090, "uuid": "74b4cb53-950a-48ed-aef3-4e8cd0e92642", "comment": "Malware payload (CobaltStrike)", "value": "083316688a2a0e61f45c74a953053f55", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021090, "uuid": "7827813b-b46d-417a-b909-49deb47a30dc", "comment": "Malware payload (CobaltStrike)", "value": "39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021090, "uuid": "6151b188-2db2-4743-98d9-daf020bb3e6f", "comment": "Malware payload (CobaltStrike)", "value": "936b0aa520ef5ad9c5ad14a306a4e95eacf65600", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021090, "uuid": "2cd1e770-f519-476a-8e95-599ebb895ac5", "comment": "Malware payload (CobaltStrike)", "value": "a3031c4db1766f916c91aeb6b79201928f036979b3e31c5899b4c27b1616b4a1efca9171d9345e8fa1e4e9e982dc286c", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021090, "uuid": "b906d5a2-b0c7-4fe1-91b9-4cfea811b065", "value": "T17B28331099D699F6D0012AB89C987E621B37C4471DE5DE3F879C7A1E4CF07258A23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021090, "uuid": "26de3c64-31ef-4133-862b-9169c1133b5f", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021090, "uuid": "b71be4e5-8ee8-43b4-9aa2-d03c276d1c81", "value": "1572864:yP4pZrq7QRumfRdoHH02GlqJiyai8Hlup/ivrO3C90cbGlSWj/0wRHsHnjSRzfsk:yPwZreIMHklUaiavE20cKlSzwRHsDSqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021090, "uuid": "58455f7f-8694-4934-8a2e-9f85951a55a5", "value": 98980978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021090, "uuid": "c64a3b24-c329-4f3f-93c3-b6fd872005d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021090, "uuid": "578ba894-26fe-4a04-9481-e07b24441118", "value": "wczt-win-8.1.65-x64 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e041996-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005125, "uuid": "47b88e32-aa20-490e-9e50-665dabe6935f", "comment": "Malware payload", "value": "7e792f5a07c2bb48baa09584b24e07cc", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005125, "uuid": "86d17006-b3e3-41f8-91da-477313a882e2", "comment": "Malware payload", "value": "3a2584e9d358beacb1c65df6697c26e08d3bbd40febb1f4d94e3bc615b55a126", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005125, "uuid": "cea749b6-a60b-43ee-b557-65a25bf74921", "comment": "Malware payload", "value": "ca55d73356f1f02992a2f3e4ef3030305bb7d707", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005125, "uuid": "1e6922b6-d5a8-42b4-9def-af66fd907b89", "comment": "Malware payload", "value": "1a14069cc12eb2ccbee8569056581797f1c5c53840a776f4ffbc707544f6cbe910cf803f33f67a9c24e23355d9cac5a5", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005125, "uuid": "d4bd61ec-7a79-44c7-9d4f-cc513c328217", "value": "T11E362333AFD91D1B0AF46779B02E2E227FAE4913420CD2968EC5E16735DFAC5413E864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005125, "uuid": "2bde1843-96af-496e-8f1a-e5cac3f528aa", "value": "49152:hynvPr137EcEDnXzlfZ4jn6OIB0juKTAnvhSxxrLJc9/pOvCZUQyFdm0jid3Goxe:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005125, "uuid": "824f7909-761b-46c0-b46d-9b6a2e87ff80", "value": 5119905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005125, "uuid": "89a25e5e-9910-47c5-b4a0-d7e710af9773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005125, "uuid": "1974fc3a-5fb2-455c-ab2b-76856fa1cb53", "value": "_Pedid805120IZ68GG_FESMZZRHXY-Vrfcejyu.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a07ef7-9130-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785977118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977118, "uuid": "169e3685-6244-480f-b92b-8c96c5db59dc", "comment": "Malware payload (ValleyRAT)", "value": "7457acf4ae83faae52db909d15eab181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977118, "uuid": "de07d7d2-899d-4bbe-8e60-e22dfa076ad6", "comment": "Malware payload (ValleyRAT)", "value": "3a81c926fdeb699cf8a4de9e037d6ffbe9041d22d7c9b0fa1ed36e6966dc4211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977118, "uuid": "ad0ee182-cb30-45ea-a1bf-517f2c8491fc", "comment": "Malware payload (ValleyRAT)", "value": "3300b405cd6e322c09a4a063255328dccfcbe531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977118, "uuid": "7cf8c869-0a4a-4c25-be41-9d04a2bb1bb3", "comment": "Malware payload (ValleyRAT)", "value": "79f5f95600f2164c4b49a4cbcc0f34ff55231c65d0934d3ac2bac3d2e76d2c55fe8398ec219d5a611b9e3d601933094b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977118, "uuid": "d1f5a4c9-031f-4cec-9a54-dccb1ec6ae45", "value": "T130E78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977118, "uuid": "e1fb5689-b650-4cb9-96c6-aecb1146338e", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977118, "uuid": "0dbefc33-7670-4429-a772-4db0f64aa2f3", "value": "98304:cuj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3rR:dRnmW2s/m3xq9a2l8/QX9EfM3rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977118, "uuid": "c8159719-abf8-4e47-b286-4b349729affe", "value": 64691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977118, "uuid": "645439fd-dd19-48ac-89c1-daded53ed03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977118, "uuid": "ea5501fd-79ef-473b-9ac0-4a775e7d2307", "value": "setup_r8010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b4d9f3-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005263, "uuid": "5e2615b9-cfef-466e-83d4-c386e086889d", "comment": "Malware payload (Formbook)", "value": "af96010b6496f2183fcdd44b1ccfedc5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005263, "uuid": "45d97473-8b0d-4711-9417-f1d27b87046b", "comment": "Malware payload (Formbook)", "value": "3aa97c40f9829f8211dc4cd9b61dfee0f49505d0199358f1a2d52184702130c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005263, "uuid": "4224b5f5-8d48-4519-9775-5c2697160768", "comment": "Malware payload (Formbook)", "value": "e4e2ae8ac3a8fd26063dfd72ce8adad193866a4e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005263, "uuid": "2ad6b5d3-c1dc-4bcb-a2f0-80b82eecc64e", "comment": "Malware payload (Formbook)", "value": "ab6702560b0d7c1fb93c09c53d6e06fe1e77ee93f99f6513bc1dbc895916cf2aaa498cf58de9a51e39475bf9c71a2b38", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005263, "uuid": "0965a05d-ae03-4fd4-b6ad-71755c766d0a", "value": "T103E5F7C11B4485B27B20ABAD6637DE35AA0FA01319D6DF15312DE204776CE4FA34CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005263, "uuid": "9f4322b2-1351-44d4-97b0-59ce7bda6b96", "value": "49152:bRp4CNbR8SNfn3tWSis0XEwvd/h6eALyEOuRIyJrbJpQeNm589G1LvrMetsnMTlU:gCNbR8Of9H0XEwvd/0eA/Om1bJGeNm5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005263, "uuid": "8fc5ccf8-5609-46f7-811d-f6fbf7890140", "value": 3092554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005263, "uuid": "a8b917db-3f28-4022-87c9-b125d68b3b98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005263, "uuid": "077351d1-90a4-4333-99c0-f0273a0fe3d0", "value": "Shipment_0285_Detail_Specification.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c6bce7-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021974, "uuid": "e9dfe003-121c-444c-a8cd-6904fe4d72de", "comment": "Malware payload (Mirai)", "value": "6617074fda9500aa714882298bef6463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021974, "uuid": "33dea101-6a73-4ac9-9b10-f5af9d2fc5a6", "comment": "Malware payload (Mirai)", "value": "3b66f8c544c1882dc1c63e08e6b92e38df9fe4e4d4b13fdd3e9dbc186b7f923a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021974, "uuid": "188c510a-aab0-4166-8a87-932f330ac79b", "comment": "Malware payload (Mirai)", "value": "8ccbe57a23d98b1c96865c99b3e7b16be546460f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021974, "uuid": "b6ba52ec-78e3-4d97-87e9-58d75dcfd093", "comment": "Malware payload (Mirai)", "value": "74e77af78b38fb502593ec5eb6599f2b8cc7d4ccb0033faeb7086884e83543c9ee106c104e3abc29ee08ab8348c6630d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021974, "uuid": "506db6c0-7fea-47c4-863c-283054fe49a3", "value": "T1B8E30855FC90DE52C5C02A7ABA8E428D332317B8D3EAB102DD245F2577EF95A0B3E941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021974, "uuid": "ca4a477d-f69f-40df-a280-1ac79fb54454", "value": "3072:8nzyVDXtElWD0D9/VZRUlIbcPSiC/1j4yYOj9u80eQTC/AM/5:8nGVDXtElWDA9/VZRUu4PSrj4yYOj9uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021974, "uuid": "c30b7003-4acd-468f-88a7-a5e9969f2df2", "value": 157272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021974, "uuid": "58432bd4-b59b-453a-8925-7143a96baebd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021974, "uuid": "00e86f31-2735-422d-b004-f71ce8f05dd5", "value": "disconnectraw.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476db327-91a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786028736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028736, "uuid": "40ff0e69-3143-4194-a439-9759b991b4cb", "comment": "Malware payload (Mirai)", "value": "0b096ef9eabb55f5077b4589b93e9a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028736, "uuid": "2acd8f20-d5b1-4491-96ff-3d351304b2f8", "comment": "Malware payload (Mirai)", "value": "3b7815c5d05adb718938b69cc4512ec9c14f9096be2693f622e4b25e0e5bbbe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028736, "uuid": "98a148ea-d9a2-45ed-92e7-cc9016a1796b", "comment": "Malware payload (Mirai)", "value": "9baa7b84d781119f8ac8e7bfec6024ea3ff86039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028736, "uuid": "b8e6b85c-a602-4260-823d-88dc1c826150", "comment": "Malware payload (Mirai)", "value": "096109cbd23ff91fbc28f933b40077b9814faf0851e2d09aa2b0fdefaf53c0f2b39f63bd223c33be5515b453c3a0310c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028736, "uuid": "038cbaa6-59b7-4b9e-bf7e-fcc3e3294baf", "value": "T1EDE34B06B70C0A47D1A32EF43B3B27D193DFD99124E4FB40651FAA8A91B1D32158AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028736, "uuid": "3248fcb6-feeb-4458-98a0-fe9ecccc6ff5", "value": "1536:mhoPDTjhzG8Zoxe95GXlnD0hxOXAzS/ZK+zuTa8b/Grx5MO089iFvAfh/SGKSzjc:WaDJzExe9gX4xxzUJxeO8SfRjeynlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786028736, "uuid": "b7e0cdc8-4588-4c0a-9c31-d3ee40eaf62f", "value": 144316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786028736, "uuid": "6b9966b0-984d-499a-8dde-4742d2d13afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028736, "uuid": "01a094d2-935a-4051-9813-1d1695570872", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10db2527-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785994714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994714, "uuid": "83ec4b66-bba1-445b-82a6-b36adb547ac6", "comment": "Malware payload (PureLogsStealer)", "value": "10ecc5bbc17e91b5cebc41a0ad6ac983", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994714, "uuid": "c5711a55-ca6c-467e-933a-71075c874c6e", "comment": "Malware payload (PureLogsStealer)", "value": "3ba05bc0b0c1e32f542aa9b311f5be8a065ecfd3b50c99ca2a13643984a6c2e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994714, "uuid": "3ef31223-5a3d-4d92-b6a5-9c0343da0daa", "comment": "Malware payload (PureLogsStealer)", "value": "1cff08943047beb43a64fb014f3b781e9924d222", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994714, "uuid": "35248efb-6d2f-459a-9e40-ddc5ab2bec0d", "comment": "Malware payload (PureLogsStealer)", "value": "95c15b5c55c0d5925dfb23cabeb6e62c67356d9863e29c874dbe62edcca6d1b47f627ac85691070bda47a49c9934b36f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994714, "uuid": "66b9c17f-0997-4fbf-b694-634bcefc249a", "value": "T12ED5A4F06E01FCD0E565C7B3B6BF8985723C2621E9C92F9911E8B3800DA6D51ED4EC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994714, "uuid": "19622f41-3ecf-4088-b190-848a61998305", "value": "24576:zhWSEnrzlsFE0pQT6dOdKAo053Uhxq5WOWN7FEvc8Y96EXzovl58KdT3oaWI0pe3:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994714, "uuid": "bc9d6e56-bf7b-4f8b-b21d-5ecad4c5b208", "value": 2897979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994714, "uuid": "68d77b53-5354-4f09-8337-eaf77a1f61ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994714, "uuid": "7765a5db-a62f-4aa0-9ebc-2020db19f4e1", "value": "INVOICE 73105290.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdf8929-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1786046494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046494, "uuid": "3b19ac68-cd55-490e-be1b-49c9e04bbd39", "comment": "Malware payload (DDoSAgent)", "value": "19463685af7614a73e280267a9584f58", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046494, "uuid": "d27a5261-94af-4f20-acc4-fdd494cd55e0", "comment": "Malware payload (DDoSAgent)", "value": "3bb4557afde2d9bb6e6c93e6fed88c3e2f258e9e792dd09866dac82afd2bd15f", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046494, "uuid": "9324c12b-0ca8-41e6-b2b3-b33376403e23", "comment": "Malware payload (DDoSAgent)", "value": "19984a8201f7275789b5a3a7b9f8c91e12f0d9dc", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046494, "uuid": "f58d6c39-d7cc-4a75-907b-21fdafa70e03", "comment": "Malware payload (DDoSAgent)", "value": "31da9bd3fc481370d608fc04b4e79ce479f86649e0fce72af6ffa9e2a69068afba4c5ce244b3caa613b05948bae6e406", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046494, "uuid": "90eca063-5f75-405d-a2ed-d310ea4d367e", "value": "T1E8077B43ECA515E9C5A9D2308A739253BB71BC495B3127D32B90F3382E77BD0A9B9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046494, "uuid": "38f9ec79-745d-4f99-9b42-d8162725a154", "value": "98304:jopv876YrwvTRZmbrZlal09s7VDgJyleBB0ovwNxlH9Iq1EYsKViiam5+uPxaaij:jATXRA+lb7OJyw58QTKViq5YhFwTT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046494, "uuid": "4ced703c-e8b0-4e0e-ba6b-cf6d1b0a401c", "value": 17249533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046494, "uuid": "67168d6b-7574-4c49-9456-ab7468f464f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046494, "uuid": "c7bb3e9d-fa2a-4664-ae9a-59d409d34f53", "value": "gg10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259ead66-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993890, "uuid": "2e59a6a0-1b69-45b9-8821-1a1da13e4bbc", "comment": "Malware payload (Mirai)", "value": "dbdd807f79d481e88e13f730929764ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993890, "uuid": "b7ba0e38-3a9d-4699-a3b6-571f40045c0f", "comment": "Malware payload (Mirai)", "value": "3bf3f6f1241749aab85fad18f5aa754e23c42763349224ba59cce1d94c91e631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993890, "uuid": "55f1fb39-b412-45d0-b65e-059855d091a2", "comment": "Malware payload (Mirai)", "value": "8b6aa440e7aa1bbdb6ccc8f62d32abfe32875451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993890, "uuid": "6b512f18-b4eb-43de-a9ef-30ca4b2d44c4", "comment": "Malware payload (Mirai)", "value": "4081f2f9f32a4c1cde7c2d94fc3d6ed2e6326ed2b25473e2ae1cf02ed267e64ef5ec29140940d24e752a83f395027e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993890, "uuid": "b5ea2a88-5f60-443e-8378-8dff43673d53", "value": "T17BF3F70AAB610FB7D8AFDD3702E90B1129CCAD5725B53B757534E818B50B18B89E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993890, "uuid": "243fabc2-c994-4df7-ae6e-b2ccfd2b7407", "value": "1536:uVJwYA+qAqPwZ5WvvJaWGUiNHclGp06kJMU04OaGPP/u+thJi/31gUbGbdZ/tbbw:0S/dwXkQWHr+M31h2dDbFum9nSz/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993890, "uuid": "66cac960-48cc-4b8b-8829-5337f7baf617", "value": 170444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993890, "uuid": "e909eb18-f1dc-45d3-ac4e-b7115145ce73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993890, "uuid": "671e0c3d-9d52-4655-9aba-41b0b62abfb8", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bae429d-91d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049869, "uuid": "c93a77cc-64dd-471a-bf8a-6707ce60d96b", "comment": "Malware payload (ConnectWise)", "value": "683223a69f91887a6cb4f68b50adefb2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049869, "uuid": "1b305d91-4e84-40e4-ac76-5b63c5d11ac8", "comment": "Malware payload (ConnectWise)", "value": "3caaa5e8cab6d0ec2932ea20fb71301eeea20ea16ea18d4cde08f8130a59fd25", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049869, "uuid": "4f421de8-2d44-4793-85d7-09631d681da0", "comment": "Malware payload (ConnectWise)", "value": "1d766b04adda359f3a5b062f6abfc20e1a32e1e4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049869, "uuid": "99c10b93-90d1-4b70-a5eb-36209a7ef221", "comment": "Malware payload (ConnectWise)", "value": "1d8d436d03d6b9265fa84bc9bd4541b093396fd1b8afba7009d73d3126fb917b7fff2ebae8dcdd1dc57be66304737b09", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049869, "uuid": "408f9d09-9419-4d9c-88c6-e462771fcac9", "value": "T1A846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049869, "uuid": "483fb6aa-04e0-4b4b-8959-43d72f69d38d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049869, "uuid": "90cc54cd-e7bd-40a5-bfff-dc2ed38b092e", "value": "98304:fzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:fhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049869, "uuid": "d0119abe-1e27-4c3b-b2d3-59a03958a449", "value": 5680104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049869, "uuid": "d17b9e35-846d-4eec-b553-a5d00ed0f1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049869, "uuid": "bf9d31bd-be14-46f3-91bc-0922b14ffb4e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce83461-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786040959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040959, "uuid": "5a2c696c-7238-4da4-a659-dfe6c67ca707", "comment": "Malware payload (CoinMiner)", "value": "9c251e7f1dae4d3e2ed07540a1390624", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040959, "uuid": "1bfd2b9e-925e-47e8-9dd4-400de60ac55b", "comment": "Malware payload (CoinMiner)", "value": "3cf4a9e9af1a3733562dcdd74160fe1001c124878370c7bee555517f38720a6e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040959, "uuid": "82e153f6-0f3f-43eb-9fb5-ab11316d3aa9", "comment": "Malware payload (CoinMiner)", "value": "aae82d75ffee3cc6c84a592f17ffc0ca31b93533", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040959, "uuid": "6b14020d-0bf0-4883-9a7d-8d1d9c03624a", "comment": "Malware payload (CoinMiner)", "value": "6a6e21f2d4e19ff251319a2cbdce92ce552b91dbac6b1aaadd4c539f531ed441567fbf64d3b83fcae3ffe0159c75615f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040959, "uuid": "9f9b29f7-bd14-4f13-bc93-2de0c1d90c67", "value": "T1BD6309D1BC25D831378A087CB9DAA6507A93193F095D3C08F04FA96C6F6C19CB17A77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040959, "uuid": "0584b301-5ce6-4aff-82d1-9b297a95f9a7", "value": "1536:ot74vUzPNZiFrbnnSBkVgWtTESqzlLHIFZS95KDXeW5L:Q74v8PNM3nSSvtTESjFZSvKDXeUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040959, "uuid": "889156d5-43e2-4885-8295-8236998e4eb0", "value": 72655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040959, "uuid": "e9783769-0a51-42ea-8bfd-7b7918869391", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040959, "uuid": "f99b9133-0cea-43f7-8abd-3b24e3c9589e", "value": "ca06059d5d3d81d2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0b5f35-9134-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978818, "uuid": "bdb470b4-26de-4c62-a7d4-faf10037a18c", "comment": "Malware payload (Mirai)", "value": "30a9e53c466039b91c8ac5373fdec16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978818, "uuid": "7b1ce69e-82a0-43cc-ab56-9080b24c4115", "comment": "Malware payload (Mirai)", "value": "3d3cdd80cc4ef5e23c5ad9c86732ab8861ab2a4d931239040e54c3d410ff7c6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978818, "uuid": "7c8de19e-66d0-4aa6-874d-4686456415dc", "comment": "Malware payload (Mirai)", "value": "52482cc65f451c82561abcc97999741430cb6edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978818, "uuid": "c072fa92-6bfb-4c88-b4f1-dc3be3505825", "comment": "Malware payload (Mirai)", "value": "6e55fbead16c283ed0a8b004449913866d44e244a9e3b1e3ade2da4ebbb647ed557cb3f7152a898900ef9c509391feef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978818, "uuid": "b9d9e48d-5df1-46c2-9a54-661ccdf9d5aa", "value": "T119534A82FA83D0FAE8130571442EF37FE631D61AD121D365EF695E32D923902462B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978818, "uuid": "687c6970-271d-49fe-8163-69ae09ac8718", "value": "1536:ZsS/1WjA5svTWm8KnAKMSzjQl61rG4Zp1LbnbcMYRg:6SdL5JnfKM+jQlA7pJq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978818, "uuid": "63a54429-aa3c-436a-857d-dd3a64a10355", "value": 66664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978818, "uuid": "aa0c3b3d-e2cb-4d31-8c01-abb7aba8071b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978818, "uuid": "dec6fe68-5083-4eaa-a7f2-8e387e9643c8", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c098b6-913d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982852, "uuid": "a73e61e9-2083-48ee-bc66-464d06198d25", "comment": "Malware payload (Mirai)", "value": "d6e5be017144ea23f2277d4b02d8d82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982852, "uuid": "78e3ab79-253c-4568-be6e-00a8f4d34576", "comment": "Malware payload (Mirai)", "value": "3d647fcb1c48da7a95c0bc500da45c150f00ddd7871e90297d2f79f38286ada3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982852, "uuid": "9b2a91a4-6a2b-4828-95e4-8f7def5624c3", "comment": "Malware payload (Mirai)", "value": "951abb177f965016ec53b47713b0353a3696f430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982852, "uuid": "027e333c-69ae-4b4c-b847-48aa35bb395a", "comment": "Malware payload (Mirai)", "value": "7c3ef189f4d8bbbbbcc0ba9b7ad872461c3b03ef6b2351ba179ca09ab3f9f3854aecac05a10e6d81362afbab278691e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982852, "uuid": "e3695f0d-61c1-4b1b-b8a8-0dd92c4e6f63", "value": "T132F3194B77118FA1D33AD63006F34BA7ABA9268517D2A585E36DDD007F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982852, "uuid": "17002a36-43f4-4845-a3c8-b34c6ad3265f", "value": "3072:rYM/RSXUitDSbR6CdSbGjAHHfnH6AKjDPW1LGjNxmZoHZjby:J5SkIDSkCd4Gk/gwLGjzUolW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982852, "uuid": "97e3e451-16af-44f7-82ad-3b145bdb100f", "value": 167156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982852, "uuid": "c6801c9b-3970-4ee5-af4b-691d0e5b00bc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982852, "uuid": "87112cb2-5fb7-4a0f-b111-6d556e435cb6", "value": "killbotx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c208b9-916d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786003686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003686, "uuid": "19067671-177d-4493-97f8-462af2429e4d", "comment": "Malware payload (Formbook)", "value": "f01afca27ee2c5d8779eed816bf8c91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003686, "uuid": "ec4063e1-4de2-4fc3-a662-7090406de2b0", "comment": "Malware payload (Formbook)", "value": "3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003686, "uuid": "9956df5e-348a-4c75-b447-3050408c4ef3", "comment": "Malware payload (Formbook)", "value": "2d2dc3e2beb02d79d39c17c3388b51566f29edf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003686, "uuid": "2a820151-047f-4c89-bdf6-f4f4e2065d66", "comment": "Malware payload (Formbook)", "value": "0ab0d4d54f50d30f1234b58f5c2d18ce4de98dd8ebc60dedb0ccf7f093fb618ea48ce54143a7bfe2d05a23705dfb29a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003686, "uuid": "f0a1030e-b182-4160-89d1-0a8283e82f35", "value": "T1AD54230235DBF9A7EE95C8F3CE1BC08F553595380B8FF90A72568CDA06104F56EA8936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003686, "uuid": "8bcdd0b4-99ab-43d7-bf41-f4faeb5a10c2", "value": "6144:MYd77T/BjuU/aTca6vBOCi2udXrdw7vdZury71AebVUDX:577TNZ/tBOr2ErdwZ57yebV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003686, "uuid": "23eb8ac2-c90b-4076-b0bf-fb560ee452bc", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003686, "uuid": "5bab6a24-54c7-492e-8033-c3b974cba49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003686, "uuid": "55577b16-f804-49d4-a091-c76a7589ec73", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14fdc94-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993346, "uuid": "bbd0a805-fd51-429c-990e-a3ab669f928d", "comment": "Malware payload (Mirai)", "value": "305b5e68cc3fcc2c371ab522622f47b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993346, "uuid": "4e60c013-423d-4860-b733-3a46ebd6157a", "comment": "Malware payload (Mirai)", "value": "3e706e5ba4379c25525baf79d354577c0e036078d75db7644f01632b11bceed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993346, "uuid": "19df1993-9015-4977-8a07-70d9ce193427", "comment": "Malware payload (Mirai)", "value": "85d030c89091efe4ec834758633ed876ef62424f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993346, "uuid": "90c5d909-4af5-4f1b-aa46-ed8b7ddae106", "comment": "Malware payload (Mirai)", "value": "2cc382f3ef471238fae462e83bb42ec34eb338eb160257fa62ac82d7adf959f1ac4ccd5420b2345a1b4f7634b9938684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993346, "uuid": "4f6ce60f-042c-4795-99aa-598d92acec53", "value": "T156E35B49FA5BC0F0E6D344F5062BEBAA563B99116173F1F1FF5A3661F8B1301288626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993346, "uuid": "04243b79-1ac7-4735-9f5a-b7c58d3acdc8", "value": "3072:+sLQS+Nihgu0eBu0pcqZakEjFKWIR7AtoJ:bQzN2BE0uAiKjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993346, "uuid": "d7440ed6-97c3-408f-8024-846a99e9511e", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993346, "uuid": "55aa89c8-58b4-408a-b40e-ba6e7b597b43", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993346, "uuid": "164e6e25-7e61-4387-bf94-3ec89302288c", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260ada99-9170-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786004628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004628, "uuid": "072dd16a-ec8d-4ec6-80eb-a2e0fa9fa6f7", "comment": "Malware payload", "value": "bfaa84dacabad416cb15cca2479c166f", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004628, "uuid": "2022e749-a032-4f7d-8342-a5a0f16bf164", "comment": "Malware payload", "value": "3e7f7cdc5b44a7a47be3043847b0efe51a6c37fca4b9c2770aa305c1ba3a5927", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004628, "uuid": "478ebc77-e97a-4910-9564-1ba772b1b1bb", "comment": "Malware payload", "value": "b667d243c8795034d29bb16c2139e34784275d86", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004628, "uuid": "15f55d67-b137-4585-af30-47af61abb072", "comment": "Malware payload", "value": "dbcbebacae35be5075ce4314ba8b9ef2ca769ee4b329ba356770b1d17b9eafa39690ff6e36be71f7b61f700c49ac52f8", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004628, "uuid": "511f26a3-0d69-446a-9ee7-7b35a46da494", "value": "T1A2115B45049DCEE5D4522CBDDC190B6BEC82216F481DA92E18D812F5F4DC93E99BBA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004628, "uuid": "17837e93-efff-4e74-a9a4-fe32e5309008", "value": "12:HmYNvT7AHrQLRGB7YGN218fg0lncXB7YrTJlBP4TDGQDsxM8sUeFu7uiIJwJk2lK:GooHrVsX8TJShQQUecui21r+8Bd5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004628, "uuid": "b1270e84-98ec-4f84-b4be-222edcc66287", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004628, "uuid": "ab54c47e-7b6d-440a-9ec6-74d369db7664", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004628, "uuid": "d33b6d75-00c5-49fe-ac46-74cb14564bdc", "value": "find_brute_files.pl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810594af-9161-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998338, "uuid": "f1a30343-fec4-4417-9d72-16b011ab2969", "comment": "Malware payload (Mirai)", "value": "7d9f3513e1cfc267935dab6d63a93db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998338, "uuid": "064ebc57-3c04-45e0-92c7-410861cb153e", "comment": "Malware payload (Mirai)", "value": "3e92ea9b3ec1067432d7c48699abc0704cc1dbd9fd49ba084bf792a308dca7b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998338, "uuid": "814a7334-a673-4c5f-aefa-7892b6bc48f4", "comment": "Malware payload (Mirai)", "value": "b77e5445c5e75b7417b35e20d5e1211304ea3f81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998338, "uuid": "0b2fe56a-3bfb-4b60-95a8-03279605eef5", "comment": "Malware payload (Mirai)", "value": "c3eeae586a775275f17b88a2dfca2d7c52f891918b186e43d6a26d57afc7c6bc7ce1604ce6f056eee4bc290b10afb301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998338, "uuid": "5624fbc0-59d2-4a02-ab12-2345d0a16c47", "value": "T143430224B11559FAE0A46E35D7A7400EBA2C41BCD4FDB5B30320CAE8F1B37921B3A459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998338, "uuid": "ad77c48f-f028-4907-957f-fc93f4d948ae", "value": "768:HGi84qhAiM5XX4hCwzkKIRcJl8EJqAwpsDmtcqh/n3DEt+h6d+xbNf2xEQ7f8shT:HATI4hCe8Ewx4mGoC+dNRsUfvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998338, "uuid": "847f8d1d-0e2b-4c71-a94b-f10d66f4abbb", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998338, "uuid": "67b16280-b771-42ba-ae3d-f1a0d2edeccd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998338, "uuid": "79c59376-e42f-4743-a6e2-61eb93958c31", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534b0d47-9141-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785984518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984518, "uuid": "1187a2cd-891c-4179-9dd0-aabacafbac04", "comment": "Malware payload (Mirai)", "value": "e6b9bd2021041fd5851db30891c47215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984518, "uuid": "59fa8dd0-2b52-43a1-98df-3b762203ab87", "comment": "Malware payload (Mirai)", "value": "3f515f90d48f8900a449406a4bd176eac3731e9a203334af516b9add6a9ca7cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984518, "uuid": "60939979-9365-4a7a-bb5c-9d8ad8b7cdd8", "comment": "Malware payload (Mirai)", "value": "6023d2873728698c4df36f737a51fb936d09a208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984518, "uuid": "b56c0d2e-9380-44c2-9497-cd7734cc0aa7", "comment": "Malware payload (Mirai)", "value": "c41300508f5b0836a0b31c4d077ea845c05d7396ad62bc78c2728fa5d7f751d5f649b0c35b40a079463e344e75c84b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984518, "uuid": "52eb7d17-d416-4ad6-ad87-bd5200cecf06", "value": "T111F32B56EA418A13C1D217BAFBDF825533239764D3DB33069928BFB43F8269E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984518, "uuid": "bff27cdf-8d89-4710-8ce0-94fe3c19a7c9", "value": "3072:iVEQPusaqsoEbUIqXipNiR1dibf6IHSBbW22PLiM/9tsWhcmRwaWQx+i/:6EQP7aqDEbUIqXipQ1Ubf6IHSBy22PWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984518, "uuid": "8f09e959-f5fc-4340-9c82-306f6f9062de", "value": 166368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984518, "uuid": "efcbd49e-c326-446f-bc96-5d44de5312a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984518, "uuid": "fef1bdf2-f0e8-4a98-8de7-9df682376e47", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72010822-913b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981992, "uuid": "312cb1a7-3c3d-4b19-8f2f-506f7bc29356", "comment": "Malware payload (Mirai)", "value": "2aaccdb3c409455c24fee846df6f3031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981992, "uuid": "7d71acb9-d5c2-4c2a-b91c-18f5fd8db83e", "comment": "Malware payload (Mirai)", "value": "3f856bcfb0f007e94896433d134d16b22b653745d26a5c7d14bd9e9d9b1eb068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981992, "uuid": "e10e7544-3d67-4d9b-88b2-1de6f6c2a6f3", "comment": "Malware payload (Mirai)", "value": "13363de0b541ceed4d3ece85627eb643b0adaf1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981992, "uuid": "fe40d8ca-348c-4299-a2b6-e00d4bc30214", "comment": "Malware payload (Mirai)", "value": "5fcb17d49bb7af9af47e7ecfabeca3ff53585ba802c512bf39aec335b71a4dc06798480ac5ff4eb9ca41bb4680b25550", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981992, "uuid": "de9662e2-7eea-4dfb-9a91-239adbd3ca7f", "value": "T1BFA3E716EF100EFBD86FDE3705A90B41358C594722A93B3A7674CA28FA5A94F09D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981992, "uuid": "f12c20dc-cd90-4f7c-ba5d-ab5ba5bf5249", "value": "1536:mFdM87/jzucl7gcQG0zuZ5HYOpacoeQjc6bVyebrru6n4s7ncqC+:m7/X576GZLv6Nl4+K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981992, "uuid": "c6f87615-3be8-4152-bd5c-e997df9947a2", "value": 98596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981992, "uuid": "3a9fe4c5-d9ba-4dd5-a835-8d2cb4df814b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981992, "uuid": "6075f961-8706-4af7-9b90-b09d8ed9bcc1", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c954aa2-91c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786042972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042972, "uuid": "a5cb019f-5c1d-45db-ab6a-0d5d54f1724a", "comment": "Malware payload", "value": "874b12d8846187716b5363196df09ba4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042972, "uuid": "9ec42bf0-d5c8-4f41-94fc-72092aa99940", "comment": "Malware payload", "value": "40ecec3216ca8cfadbc82f7bd0262f2daeb39ec2547cef1756606104ad2e0563", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042972, "uuid": "37e593d4-e3d9-40bd-8031-3e4b0271a83d", "comment": "Malware payload", "value": "03b3cf69b6cbea5d39da3b4442b5d77e35256c1b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042972, "uuid": "9629d105-2135-4830-845c-5474d507542c", "comment": "Malware payload", "value": "191fe5f0140b715fa3f965c136587a37e9e9d9db645d78ceb15f61a0eceb9a235ce3d35e5366ad5a520203af53fce14b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "zsh", "colour": "#5B9698", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042972, "uuid": "56c7c87c-ab39-46b7-bc89-52dd44d534e4", "value": "T16531D5FAECAC36127241DEE1E49A96235E1A4A2ED8203C09A008948DE51E33B60C6126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042972, "uuid": "fa67bd4a-78ba-4fc2-899e-44c8bdf5f53e", "value": "48:n5m1m8XVmRpkwxbbb0ezV8jgbb/Z2xUnAL:5mI8X4RiwRv0Wbv/ExO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786042972, "uuid": "1ab29aa1-1dd9-45df-a694-38e91b74ea07", "value": 1828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786042972, "uuid": "6c1ba7e3-71de-4933-ad14-cb75c6c9b04c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042972, "uuid": "1b556ec7-36ef-438c-9643-fdd1055122ef", "value": "payload.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ee004c-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026613, "uuid": "26dd62d5-86bc-4dd3-b742-5fca7e6fd098", "comment": "Malware payload (Formbook)", "value": "f53bcd652f35849870ccfae29579a755", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026613, "uuid": "7954fb92-17f1-49ab-a62c-216a843aab8c", "comment": "Malware payload (Formbook)", "value": "415ce6602e0497152674528dd3e4c580aa151127380d6582880a1ccea60f9e55", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026613, "uuid": "4919b92a-dbad-4aa4-a413-eb88eebadb91", "comment": "Malware payload (Formbook)", "value": "79170a7a81dc4236d2c1a9a73c4cf79aefd488a4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026613, "uuid": "776a2ee2-0ab2-48c9-832c-20683b323ee6", "comment": "Malware payload (Formbook)", "value": "0c8fc5edd19242b56a3edb3859b68a03d641cd48921155113a0fc291e22fe11e13f5d3e3e3b8441a17ea59bc3b4ae147", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026613, "uuid": "e95671a0-490a-43c9-809f-70cf2e8f3333", "value": "T11762443AF50CDFF40B2E11D1418B7D0650995BA6743A8AEDE4DAC1947F2AB104EE78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026613, "uuid": "60404911-ecf7-409a-81a1-27f426237e58", "value": "384:BFirHnsHD4v5XHsoHS6XDzlw6gJPNIxiWzOOpb:Bq3PSNdJnAfpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026613, "uuid": "69403d9f-7551-418e-ad09-4c29b84ade84", "value": 15716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026613, "uuid": "df408763-9fd2-4168-8d0f-721514b32e01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026613, "uuid": "b153c6b0-1d1d-406f-9f13-5a526470a86d", "value": "Doc_Ref0000392026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60480fe2-9138-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785980674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980674, "uuid": "dcc976f4-0c48-4943-ab8e-cb0c048508aa", "comment": "Malware payload (Mirai)", "value": "0939be97e36f2be2a40df101e1d291fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980674, "uuid": "fc267349-bc61-414f-b4e1-22ac171b5b6c", "comment": "Malware payload (Mirai)", "value": "418239951e671967784688d121cd66a63a1c9896633038453be3afff2393ecd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980674, "uuid": "a6871858-18fd-4471-8ac2-999f4ab3f72e", "comment": "Malware payload (Mirai)", "value": "ed0a1a6f09875b32b81ba91973fb91976d6edb3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980674, "uuid": "f3c8dc58-f7c4-4683-8bb3-09d6fbeaca48", "comment": "Malware payload (Mirai)", "value": "17f292a077fffeeb8120f8c726b7eb67a017359b3266eb6a73aac9bf024a6a94ec4008ac6e074ddfce96f3beba2948c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980674, "uuid": "2aa6dfff-fc17-41cb-b496-7bc8ae6af4ab", "value": "T1BBE2F186D0C4AEA4C003C6FD47DDDCBAA1E1EDC09684514A365E6FDF9E32170C292D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980674, "uuid": "fc8f5dc0-ebff-4711-bbdb-5675f7eb8fe1", "value": "768:D1XTVwwC7yCFpxtk/NNugn7gIwsATuJQMfvj637Xk9Bx5rZvV:FBCh9kR0TMQM39D5dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785980674, "uuid": "a0e420e1-173d-4b88-bed0-c13f3d9fa4ee", "value": 33460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785980674, "uuid": "8b50f9fe-4205-43da-8fb9-e81c617f1358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980674, "uuid": "5b251e10-681a-4ba8-80a0-85c83440b72f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bab88fa-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994491, "uuid": "9b290c68-30e1-492f-9042-67c92d552d99", "comment": "Malware payload", "value": "d7a1fc347c739ceb3b1fcab63f8e1c43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994491, "uuid": "64981ae5-8b86-4bf8-846e-716b39d20663", "comment": "Malware payload", "value": "41943213109d0f33415c9fb7443f2ca0703fb92e6dac5cb4fd9f2ee6cd2ba0d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994491, "uuid": "7d8e3e05-3f0a-40fa-bf92-c2d42bc4adfb", "comment": "Malware payload", "value": "c80e4651a4df41905528852532aa899a4b44ef04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994491, "uuid": "b7d5093f-2e4b-41af-b885-7cb26644601c", "comment": "Malware payload", "value": "0e1d83ada4f7ef96ab9ac077ece23f3219faf0bcfd494089e572dfc42396b8ee455fd241c2f5e1a83b3c79cfcd5d2cbf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994491, "uuid": "30921d52-435a-4c12-802c-579316c1820b", "value": "T1E4236D651A857C14AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994491, "uuid": "3d9ccfb3-3b55-48e5-9a60-122fb4d58aaa", "value": "768:eXRWNGxVm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:alxlcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994491, "uuid": "afb713e8-8bb5-4660-90a8-78dceb97739f", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994491, "uuid": "88a09809-abfa-42e7-ad04-98f03a227bba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994491, "uuid": "d1d58853-506d-4b7e-9244-8f034d7f4291", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4d8735-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004075, "uuid": "27c6c7c8-588f-4c8d-8de7-f159ee7bef54", "comment": "Malware payload (Mirai)", "value": "d5b9d53a3a3604ad2616d3b7e018f646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004075, "uuid": "5b70b5d1-f854-4326-b7a4-4072ff94dd4e", "comment": "Malware payload (Mirai)", "value": "41bae052489f145c01266d93935de8b421e6cdc3541f504f78d7666cebcef93f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004075, "uuid": "1724e024-209f-43de-9c26-570505e0e68e", "comment": "Malware payload (Mirai)", "value": "13083276962034b16301014c2ad5a0a89b9029b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004075, "uuid": "0aaee5e5-f5a3-4953-ae55-c25a6b9711a8", "comment": "Malware payload (Mirai)", "value": "e948088d7078e4df7096c4dceae7a70f443abe813cb3810dc4877869c7bfdfb39a220ef323b869c1d166619c4d06c4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004075, "uuid": "b8d431f0-7eea-4de5-9e11-521a0507d593", "value": "T198430946BC818A15C5D813BAFE2E118D33136778E2DF72129E106F2477C6A6F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004075, "uuid": "00c44f94-ff19-47fa-a38f-11dd1c6af66e", "value": "1536:Bdn0MMXbzK/9z1I/8bCCq+/w6IG3pViCds7LkTuT:pMrq9zekbxn/Tds7LkTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004075, "uuid": "f5e3e443-2c8c-47a4-843c-f68d8c099219", "value": 58612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004075, "uuid": "fcd2a0ca-f562-4b90-8e9a-93501301e342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004075, "uuid": "54a89ea4-a0c3-4495-917b-f6741083c025", "value": "1de3f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ab41e8-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979616, "uuid": "6018036e-5c96-43e8-aae6-85dadf498d6e", "comment": "Malware payload (Mirai)", "value": "8c7915c5481e6e8a699d09ce5debc26f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979616, "uuid": "8e299203-7b01-4052-b3a6-6e61087bf890", "comment": "Malware payload (Mirai)", "value": "424b4e38d6f73cc6f7c45b03d604e0d921ac815dfb88e0e492a15a4fe535d9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979616, "uuid": "38085b10-5bc1-4ba8-a0c0-e69bf2cd7691", "comment": "Malware payload (Mirai)", "value": "b572807cadf0b7e51a1a1641fe4ef3c63e18dc60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979616, "uuid": "68533d17-f40f-4e9c-ad2d-ab6088338e96", "comment": "Malware payload (Mirai)", "value": "700745f63ef3cc702b177846fbf1564373f24f1852715cc43820e2d32693969ed9824fe87ec1ffe50e439e386ea53b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979616, "uuid": "d36a678d-c3b3-4a16-8046-55e57bf42854", "value": "T1D6E35B49FA4BC0F0D6C344F1052BABAA9A77D9212273F1A1FF563776F8B1302258526C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979616, "uuid": "38402d85-6683-418d-ac64-ac9acc4e59db", "value": "3072:LuTrgfFTj555orwyFEjHBaUzU9LWIESXUHw:grgtTL51bTzmLeSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979616, "uuid": "522b57a9-fabf-4fc2-867a-579b7248cc90", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979616, "uuid": "bb8b5a33-2050-483b-8e0d-92ad30baa077", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979616, "uuid": "159f0fab-1987-4b48-b7e8-1888f1b7748c", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b530f0-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "22bfda0f-78c9-4c40-971e-31c2da738118", "comment": "Malware payload", "value": "e1c0677fb68325da1e09f9818696f0be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "a24a3c11-63e7-4a4a-b58b-b620524d8a70", "comment": "Malware payload", "value": "42bc441401f33d6cc02c90c13b020257da58fe735c87c59846cd3e4ca679752a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "b4a27576-a9cf-4a3b-a42d-667045eb9c8c", "comment": "Malware payload", "value": "4effc1c06b0cf6ca4605dfcd90fed66023a78a80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "c24da3e2-de0d-48d0-bb48-8c026babf530", "comment": "Malware payload", "value": "b2227e0942bdb901cef940585a0e3e43993e9e807d1892f9076ff9e975edffd01a8283f6b6c4c0505e80fa85b16877e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "2de79b34-4c21-4625-a0ec-4631b77ce686", "value": "T14BB57C077CE119AAC0AA93328DB651A2BBB1FC490B7123D72E50B3782F727D45E35794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "35c21d71-2115-44d3-b420-f3517b0e1d2c", "value": "49152:nv+UKkhbC5+b30qnW9ZlUIyoVWPR+tWTl3Ad7M+y:n27ViRX3AZMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044994, "uuid": "a1855502-97d5-4cdb-a11b-9a9efa5b5bd9", "value": 2391513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044994, "uuid": "2d530466-2925-407a-a4f7-c2cbad42b185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "c76deb7b-f275-412a-9176-402a84b7d35c", "value": "oldboss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fe456f-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mofksys)", "timestamp": 1786005217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005217, "uuid": "4bc0471f-5d80-49a9-becd-40b145e86839", "comment": "Malware payload (Mofksys)", "value": "11414345bc2c5c11e50efb23c5639f67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005217, "uuid": "2873cdbf-bd2b-42c2-bd55-cff0f242eff8", "comment": "Malware payload (Mofksys)", "value": "4410281c659cb2fe957d7f192d217f4642127827674af45afcd24329fe13bab5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005217, "uuid": "58b9619c-fdcc-4901-ab43-0ad18ab0588a", "comment": "Malware payload (Mofksys)", "value": "b0e8b835e5d38b60f009307917a10b11a7acb1e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005217, "uuid": "ef7adfbc-a04a-41ad-9db4-086cf18a2622", "comment": "Malware payload (Mofksys)", "value": "788d0f4984410a8294e62fe8867d6388abc78cb29feade33461a4a88c67bcbbcaabd1f03292bdaae0694f0a17683075f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Mofksys", "colour": "#23E34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005217, "uuid": "97dbf948-badf-417f-9f14-e7341cee4b5c", "value": "T153266B8C4309CB4DE2FE1578C92AA9E6D61929072D70AB1A7B3F511CEFA2B43F344475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005217, "uuid": "0d73e049-3760-4275-82cc-c657c463ccea", "value": "98304:Am/4KghyEVmPg4S25h3IJMZnDFI4qxUNvfLkpb3LAZalGMEK+UyvV4Zo1zf6R1:l2vhQhWHUeEalqKpZazyR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005217, "uuid": "6eaeffee-8baa-4203-b46d-5446b99669db", "value": 4453020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005217, "uuid": "9ef75728-782f-4f9a-b5c9-c0a679b926ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005217, "uuid": "d316e739-aac0-4d5b-aaee-b41fcdda5edb", "value": "Payment_Notification.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb1778d-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026815, "uuid": "6469c624-2e23-44c8-8eb9-9c651520e117", "comment": "Malware payload (XWorm)", "value": "7476ea3106ae5ca90ff940d4fb126e02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026815, "uuid": "59fc36c5-ee21-40b0-ae58-17b810a42ee1", "comment": "Malware payload (XWorm)", "value": "450b6c8ffce56ab8cb90010bdcfd25b20433ab6a2383785090d300b1f352bd9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026815, "uuid": "c6775364-49a5-4d01-8f9f-0380fbb5cfd6", "comment": "Malware payload (XWorm)", "value": "80966aa9b3d79375bba8dc6610a9b6421403edb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026815, "uuid": "8ec9b299-5849-48a6-a32c-8479773fd84f", "comment": "Malware payload (XWorm)", "value": "80c51e4cc722702e1a77a30f84e47a1f2213fb019e2f2e5eaac73a89f8aaf57f2d29bb373d489284f38d6481caa9bd95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026815, "uuid": "6a0eb58e-dba8-486b-9aee-45b5e308aaf4", "value": "T1F925A477C97E83598C620359FE846387A7B6420B6A476E0F307EEDE9D0B1D54210CEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026815, "uuid": "32c5ca6e-6733-4599-9a32-e75baab58aa1", "value": "768:No+JrR9MlpOjxBjo6W5SoFA8+yN/pHJpHxcIFvg0ZxnF7J:++JVFPk62bupyN/pHJpHGE1F7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026815, "uuid": "f5dae881-aabd-4480-9a67-fadf4efc1b6b", "value": 1051952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026815, "uuid": "8350cd4e-a4e3-4719-b628-2ca67de61fa4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026815, "uuid": "1f76ee85-ae15-4300-9679-5e5ab22b18fe", "value": "\u03b1\u03af\u03c4\u03b7\u03bc\u03b1 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1\u03c2 \u03ba\u03b1\u03b9 \u03c0\u03c1\u03bf\u03b4\u03b9\u03b1\u03b3\u03c1\u03b1\u03c6\u03ad\u03c2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da7aab4-91ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057872, "uuid": "b0b24919-f4ae-40c4-a443-897a4231fcfb", "comment": "Malware payload (Mirai)", "value": "360803549f1b77a31f368a267796bdd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057872, "uuid": "ed589f56-4f24-43c6-99b9-c01f368fe555", "comment": "Malware payload (Mirai)", "value": "460e297dfef977c8054c1ef871cfe6a9102839411308555c1d49480e217e70fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057872, "uuid": "cde8eb29-d33f-4f1a-a0bb-34c413b7bb7f", "comment": "Malware payload (Mirai)", "value": "aaf465228c74bddb9bc510c01133bf85fa77a0bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057872, "uuid": "61b5c99f-5eec-4acb-89c1-267f010dae27", "comment": "Malware payload (Mirai)", "value": "793bdc60cd0af5fcf9e3e5c4fa63d62a6d36c0e02693d9dbc671e345da2ff4950f46e244848ca132d099990cb553c1db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057872, "uuid": "c877eb0a-0f16-44d9-b3d9-3f0f7602f490", "value": "T151E35B59F99BC0F0D6D340F5062BEBAA963B99116173F1B1FF5A3761FCB1201288626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057872, "uuid": "7e2a8e06-cc39-4ed7-9a73-6c9df741c452", "value": "1536:5AVyiyX7cA7e2F3M9x/GXZXSsQAvrnXB1yKFsuNvuDZkUeCsYeaVByo5WIkorKYW:h7AsQAvbysTNvuD+msXaVB15WI1KYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057872, "uuid": "bab4ad1e-36ec-4b1b-ba40-5710be053037", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057872, "uuid": "059e7757-28cf-4965-bdaf-03a23e1eb17c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057872, "uuid": "43cc0f36-155b-4e83-a6bb-7889f5a548e0", "value": "c151368e6297fcd311f548fe124e6e41b7c14986465bc558b8ebc69e9265b26c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc35940-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "056337ff-ba06-4bd7-a2ac-c47ef76f5850", "comment": "Malware payload (Mirai)", "value": "fae9c7d22f2641d7e0c1e514b144ace9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "c86c6b8c-c717-4af8-871f-2acab21bc8aa", "comment": "Malware payload (Mirai)", "value": "4653dbd2c14ac4d168fabc07c187813253bd40149e6438ce47e10f18d6d31ed4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "a579874f-fb79-4184-880a-6cd7877366b0", "comment": "Malware payload (Mirai)", "value": "ace5a201751f42dfe8df912050dac7ac497cefea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "c822337c-b28c-4ae2-81cf-ece83fc8b7ca", "comment": "Malware payload (Mirai)", "value": "40d3966e8ded93a9a025246b9a570f7fae9bf44b5e35b8c1aad2af5dbac6eb9f99d547f2fd34ec385668d4797d35d5a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "f4205dd3-00ec-4149-a820-4d7597d29d81", "value": "T17B530896B991AB39C2C05777EA6F018D3314A7D8D1DA3307CC280BA47BC690F1D6BB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "0be16579-df25-4cd2-8009-17a76088e07b", "value": "1536:Ng4yO+oshOZCOcawxWRl7iWDfpv8t467hbDJ7:m4N+oshvxSl7iW7t84Ah/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045554, "uuid": "70b36777-bd88-4d27-a8cf-a8cbf7670a8c", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045554, "uuid": "f60e76de-a9da-4329-9fa0-6586600b35af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "c96af777-392d-4b21-8a67-1aac89e6ab45", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0eb93a-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993283, "uuid": "00d12052-72eb-4a1a-8c8d-3c24c186968e", "comment": "Malware payload (Mirai)", "value": "d1b8fe913fc956a34750c9237aee0ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993283, "uuid": "e839fe9f-bd8c-411d-9d40-5be8b0dc1b63", "comment": "Malware payload (Mirai)", "value": "46c5172dedc1cba7e9b3e062f8a357dfac62b9c0a1f8242ce3b7b8c23ce8d73a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993283, "uuid": "5a71c234-e00a-41f1-ad12-94bce275b774", "comment": "Malware payload (Mirai)", "value": "59b71f854e866e042520ca785a0dfda162912364", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993283, "uuid": "6d9fbd3b-a6a1-44ec-b040-2c9687b8cf73", "comment": "Malware payload (Mirai)", "value": "7154894c5229a234d9683be6b0142c89cd52ec3f2fd0ae43d01c300a1e73db082cb8d8e760af659d87d8635d061f30c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993283, "uuid": "317abb00-89d7-4c1b-8bfc-f2f45cd25cf4", "value": "T1AA831237DA8185DCD841C872161FDC5612EABA04B9C48799187E5BECFA3E9C63344A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993283, "uuid": "c0886d26-4188-48d7-84e4-6ee9944b785e", "value": "1536:LqCa+1fvJFAYgmS6rkn652aDQ8UuEY59nwSuPitJBMbzgKFKr0CwX:Lq1+15Ngm5h5Tx59xRozgK8r0CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993283, "uuid": "9ac54f4d-f476-4cf5-bc60-8e15bb4114ed", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993283, "uuid": "34b9de63-6459-4e47-ae90-aa03bd4abed2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993283, "uuid": "ed2a622f-0414-4cc5-b875-229db548e0e1", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a903d9-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040198, "uuid": "506b233e-5039-475f-810a-939baf720849", "comment": "Malware payload (Mirai)", "value": "ac0f1a0ab50b345fbfc59cee5cc32f69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040198, "uuid": "bb753bbe-bff1-4404-8693-d78d1c895be2", "comment": "Malware payload (Mirai)", "value": "46e7d59db9f133152f26eb315f607a81182ab2aef9769e893770730fd6d570a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040198, "uuid": "370c8f74-aa7c-4263-b3b5-364c2c660ff2", "comment": "Malware payload (Mirai)", "value": "60b1ad956caa613965d1551719cd4a2f3006c976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040198, "uuid": "fb3596e4-3104-40c1-a74c-487b46e2a305", "comment": "Malware payload (Mirai)", "value": "c7b686a1aec8117a7a6f9c7d34304a50b8a7ac5e6a9a1d20e76498cacddf7501e9b7ce7e7f37f03c3ba4a044a6297bc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040198, "uuid": "82e94250-482c-4d4b-87e0-357bc0f40e16", "value": "T17F644965ED41EB05C6C156BAFE9E41CC33035FB8D2EBB102DD286F64338A96F4E2A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040198, "uuid": "b532c342-8c14-40aa-9684-994a8258bbae", "value": "6144:YZpd0d+vScvpH1E6l1Dth+o68GCbFTKO0hEtu4hkCa8fBB7nsc1jmbc8SlO6qhrV:EssKipH1EwxLB68GCbFTKOGAkCa8z7nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040198, "uuid": "cf470a7a-3e83-4ac8-8792-f036a3f5416e", "value": 314280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040198, "uuid": "928bde25-cb3d-4e07-9264-cbd3f8884f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040198, "uuid": "7d9cb821-4876-4716-a457-8e6d00c57390", "value": "pope.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb26daf7-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040204, "uuid": "4a602fca-f1a1-4f24-a584-1a60fdf5b6bc", "comment": "Malware payload (Mirai)", "value": "9f68bb8c4971bba2f1a8b0054132c02c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040204, "uuid": "778e6867-aaa6-494a-96b5-95abecac4f3d", "comment": "Malware payload (Mirai)", "value": "46f1352141944e4c758c5c145f7f278e0bf2378595587d22675c71111e309274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040204, "uuid": "84fb854e-1f51-433e-8d50-58798fddd126", "comment": "Malware payload (Mirai)", "value": "ded84c2e4054bd47f87fdb48454fb1f82e237098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040204, "uuid": "c5949fd1-f4cf-4a90-9f62-dbe4b31d0299", "comment": "Malware payload (Mirai)", "value": "898fd1e8742e0905f3b69793218fdd3ba0418fbe4d55aaf872e3b162993621a65d9396f049d6d1e993669a01b07e2186", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040204, "uuid": "399c5cd3-2bd7-4e45-a269-f0d7d16acc71", "value": "T16F445A07E757F4B0D4470171330EEBB1A936A871A420885AF7D2BF69F9B1AD0960672F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040204, "uuid": "ab6bf0eb-930f-4a66-b594-6b1b52e72826", "value": "3072:7RGAu5kJfklIvky+C3MpDmdeRSuvj4aRUM1nGbRJ4U8rgBS+1gXhNPhVGK8:7u5kJ0Ivky+EMgdeQnofZGVJ4CBUhX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040204, "uuid": "c21d73e9-03c1-4c27-b308-bc4dc6ed7bcb", "value": 272444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040204, "uuid": "52fc56ab-e95e-465e-aa5d-37eb26c6382f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040204, "uuid": "599075e7-f143-490e-a512-c2e604021ce3", "value": "pope.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1e28a5-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021978, "uuid": "144e2996-9ec2-47e0-bcbe-527802082cd8", "comment": "Malware payload (Mirai)", "value": "eae7fa4bc7ada49c52745baf5c705c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021978, "uuid": "c836d220-a1f8-45bf-9b3e-8d050a0c7cda", "comment": "Malware payload (Mirai)", "value": "478bc2e8c99e73aba5f68ea8bd7247d3931a2f20151d0315537c9162bdfdaece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021978, "uuid": "8eac10ad-a200-4bd6-886c-1cea38e541a9", "comment": "Malware payload (Mirai)", "value": "45ea5df2a4626aa8b761ab5c585e9b18bb6c7a51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021978, "uuid": "2784682b-6880-4ffb-acf4-4b165cb29f75", "comment": "Malware payload (Mirai)", "value": "a5b43c6c7a2932c4aff2cd87f10c96591099c29d80f8a25b4664f9004b5f2ed43e397676fb3bab634086dfe1b1129148", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021978, "uuid": "5507ed7b-7516-4856-85ae-e036b41b5b9c", "value": "T1AE538D6AF0DAACFACC5485F6E876A1300B017CB123D90C95B99DB2944B3F9897D4DB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021978, "uuid": "16df8f44-c89a-43d0-8195-5f50918995df", "value": "768:M0kxTxOjQDBYHZYEwJL7m+hQoMPkhFficgGWQh9Xp0IF+K2XFcv:M0AxiWEwJLK0Qo7Lict9l622Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021978, "uuid": "693638dd-e3df-4ef2-b643-89ff6848a93e", "value": 66336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021978, "uuid": "45b9bd65-7db8-499b-8142-34e60d87dcd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021978, "uuid": "386c89b6-7a7f-4d5d-b7dd-c75e9efd4c80", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef34732-914c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785989154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989154, "uuid": "8dafec5d-5248-40bd-8111-022798cb0f29", "comment": "Malware payload (RustyStealer)", "value": "542295866d084d2bad16df24bb968c4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989154, "uuid": "3981f85d-e128-4ece-9691-b0b4b058fcb9", "comment": "Malware payload (RustyStealer)", "value": "48b82ab7b701612f393aba8502c1cb7de61f6f29e55975c1a07ab7eb592399fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989154, "uuid": "996a9072-eec5-4bb8-872a-8348d2f65b29", "comment": "Malware payload (RustyStealer)", "value": "59ee4adb223079e9b5f65b77711f278763d07f92", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989154, "uuid": "e77f7e9c-4f68-4f27-85c0-bf33405192c5", "comment": "Malware payload (RustyStealer)", "value": "c02b2e3d4263397b78618674a0d2aabc13a25b28f4e9a17066df81521356a16c47db5dfa13e2f4592cee6d67a4ff591c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989154, "uuid": "4013a1f4-9fac-472a-9e53-94d94564df64", "value": "T14846AC5DB75B38BEC30B4138856B57357419E684462ADCBF4AE2C3B0FC30A45169AEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989154, "uuid": "4e1a8cd1-9a3d-4059-bfe5-a21e7e753ee7", "value": "e58b1de1b0892e8f36424fddb102489d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989154, "uuid": "d93cf294-1357-4616-888d-8bf549721d9f", "value": "98304:jkF9/pdoIVPvGo7huxzZtK+LrC2LQUqVfJTXuju2SOGXDsYLKCFnOOxy9SZ9AB:wbpdo0Pv/huNtvS2fqbzB2flyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785989154, "uuid": "c9ba5b51-96e6-4f1e-9e06-4e18d839459a", "value": 5654528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785989154, "uuid": "93450849-77cc-4966-82d6-a714e1d14bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989154, "uuid": "ed66f630-8615-491f-b5bf-dd65ec663e2f", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d26d6a2-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005257, "uuid": "cb780044-8138-4a9a-bf72-8977c1aced93", "comment": "Malware payload (Formbook)", "value": "6e292e153a4b26a49dedd8dc8f025779", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005257, "uuid": "a25485d8-5555-46a7-a10b-1ffbc55a6e9d", "comment": "Malware payload (Formbook)", "value": "48db3033a0aeab073a1066866c09bef20cdae9fbdab7e85e0c0b3d21804118c1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005257, "uuid": "e718622e-c75b-4cc3-a010-2a1fa1b79fad", "comment": "Malware payload (Formbook)", "value": "68039ab99d9f12c44ced8bb9466b3392b496834c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005257, "uuid": "827a6422-3da1-4a9d-889b-29056aeaa17e", "comment": "Malware payload (Formbook)", "value": "68cb0ad7f128ab698398be7b9f2a44a24851ab16c12e9d5be2ec23f103c26afbe9b6083d4cc63e278f0f3eadccc672eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005257, "uuid": "a41710d6-52f0-438a-935e-8ff421082c9d", "value": "T1E2E5F99133FFB70EA42C3739424ABCE8572FD5304A4226ECF4CE05D5921B55A3AE916E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005257, "uuid": "d818081d-3945-44bb-bfef-51c7b9187ba0", "value": "24576:dnHz4A1b+/6xGljsEKlXbrEmiivbzqu5I+a8Gt+mUqAzteXWEnN95hhM:pz4A1b+/6xSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005257, "uuid": "12424131-0609-4d82-8ae6-00de62f54552", "value": 3143117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005257, "uuid": "9bcb9edf-2225-430b-8bf0-8bd0ec0252ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005257, "uuid": "a3e41cfc-24f5-47fd-8e5f-98c70af19ac6", "value": "5TP00356-0162026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0191d0b6-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "0a4cee75-14ad-422f-8a70-42d29f7072a0", "comment": "Malware payload (Mirai)", "value": "ce9d179370b961573afc019b88b25ac9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "12d4bdca-c285-4260-a106-9e82af1756b3", "comment": "Malware payload (Mirai)", "value": "494aec19883cb5454d5d8e84953ceed65b83af99ff8a9cbf049544105e2b5e18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "122a0afb-b40b-497c-a324-2224a27daa99", "comment": "Malware payload (Mirai)", "value": "8fcaa6eba8d04764d56a744e4fb18cc2070559fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "ad58ac75-3d3d-4c00-8841-f9130029fb66", "comment": "Malware payload (Mirai)", "value": "d48ab5c9f0550269ca561990f8e2e6be2231b01f266ecf92074fff5bdcbca011c24075e82277d9b3dece70b299bd031f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "3174d998-c427-406c-bf9f-5b3fa6b4ff3f", "value": "T1B8F30755BD519B16C6C262BBFF4D428C7B2A1768D2EE3103DD296F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "3b35adf6-f97c-4816-b70b-c0b25bfefaf8", "value": "3072:1GpaNJnxpejqYmzCD2N2ijwPR4JzpQNqNcjGx58:1GpaNJnxpej+/sijwPSJzpSqKGx58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048376, "uuid": "fe04de8a-2bfc-4d87-a46a-16b44a4baeda", "value": 157368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048376, "uuid": "b9e4f00a-39cc-44bf-ad69-f5dc079c176b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "6afcf9cb-a878-4c36-808c-f04df40832a1", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c536a18-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049360, "uuid": "3b2c3037-b03b-4bfb-9326-ace4310e8fc4", "comment": "Malware payload (ConnectWise)", "value": "b89d071659f8f1a5160a08148b34c959", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049360, "uuid": "5f314ead-64af-4b5b-b4eb-8300b2df9e91", "comment": "Malware payload (ConnectWise)", "value": "4957dc632215a7500070fa697a4c9439bce4d35d27ab4f62c67f72b8178ca92e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049360, "uuid": "eceab273-4ba4-4281-8161-d375c49504a5", "comment": "Malware payload (ConnectWise)", "value": "cd94511537ddca34a232b7638e30e0c439e71231", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049360, "uuid": "9c284cf1-5719-4622-afc9-7b3ab58aede8", "comment": "Malware payload (ConnectWise)", "value": "4705dae2dc0aa9d85f907601dd996c4580bb4c625e15dd0cfc8dd85294627e68ef184e1be3a8429de3b64b443aeef892", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049360, "uuid": "5397e7ce-d3e9-49b8-bdb0-30210f6d6406", "value": "T1DE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049360, "uuid": "2c7a6660-ef16-4d51-a97d-9ec52f5f33f9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049360, "uuid": "dc19410b-8f21-4084-816b-c4a7523e9a22", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji94:A1iw7gryNkSV1hy1Z1u2JLu94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049360, "uuid": "11acdb17-4a29-4b26-9a87-9da5ea273e72", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049360, "uuid": "27e12be3-15b2-4ebd-b1bc-f798d28f127d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049360, "uuid": "0a591911-2d6e-4e7e-9a08-6859638cf2dd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f049b8-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786044996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "e66998ba-7f4e-4c91-af6f-32f5eb084f86", "comment": "Malware payload (Mirai)", "value": "c1123dd02101c05f39627e63acecf2a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "92ec0ff5-701a-42a7-a0c8-a36cb5883152", "comment": "Malware payload (Mirai)", "value": "49dfdc259084a9ecf7795fb1464a28091cf44df3df6b2486e5fcce55959d08b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "4bcef768-65a5-42d6-8632-2efd42c8b5ac", "comment": "Malware payload (Mirai)", "value": "b315f4c2d0d29ce8545761fb6d6017d828cadec8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "cd36e603-1032-4b5a-86ce-68fb7235e202", "comment": "Malware payload (Mirai)", "value": "ea0acc2cf164d787c1f9dd2544e950108ff14b9b7a5485f660182077b63cec010b9d52dd4f41658bf7375fba7a7dd270", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "5f0edc4c-f9ca-45ce-8b4b-331c064aa9ae", "value": "T184964B37B6A285DCC08BE1746A9FD5F3F920B4F40221206B27965A367F36E900F6D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "60a12d94-5171-4b36-9703-feb3e06097aa", "value": "196608:TNlusYpHZPaU8ZlgoHOdWPV8ZUah/KrUb+Hs:TNlu/xaU299ah/KrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044996, "uuid": "cd6b7237-58fe-46af-8b62-f99cbd3308b1", "value": 9430488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044996, "uuid": "723662b7-3bc7-4429-8f23-d03b7ae31d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "ad663b19-ad21-4501-a4ca-ae7d9501b1be", "value": "wd1337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae42ec0a-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996267, "uuid": "d53e7cb0-39bd-4c33-9821-b3c671fbbac2", "comment": "Malware payload (RemcosRAT)", "value": "60e1cce704229549db1cbc4d064e256e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996267, "uuid": "562de710-da81-45f3-8ae2-0f1192b9edd3", "comment": "Malware payload (RemcosRAT)", "value": "49eb1f8c8f049d2ba0e82b4907f85a3c7a0f1ea6898576aac149642352c9ad77", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996267, "uuid": "c391d634-41ab-4451-bb3f-d42f66d4fee1", "comment": "Malware payload (RemcosRAT)", "value": "8cee0d2cc504e25ca2f0f3d42346382df74d5beb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996267, "uuid": "b74f50ca-1294-455d-87ea-a36567460bba", "comment": "Malware payload (RemcosRAT)", "value": "f70c370bdf10e9011a4a8aa4aad002e62b9442841898b1312433bebaaf31ade78d77b7699809aa84bc10eeefa5ad3c2a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996267, "uuid": "b9c79420-d695-45ce-a7d4-deee8b41da9e", "value": "T139E40212FA848437CA525B380BD366C1D61DAC2B5E2A8E0F5B85377E7D377E4D812C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996267, "uuid": "51f462de-9ee1-40e2-a754-4fd3a8458103", "value": "12288:gKPdv5B95S1UpXFZYeOLrdBMsrblzkyvuLcsJyTH1eEih5EpLU9aw7UmrPZ:gKRu1UpVNOL3ME54TbEp49aw77B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996267, "uuid": "64df23b1-6cbb-455e-a726-b1f1067d84e9", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996267, "uuid": "05ea1adb-d619-487b-80dd-34d7c4f4fb63", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996267, "uuid": "52be42bf-9d78-4e69-a0b2-9237d65242bb", "value": "Productlist_PO00920388_Request_Pricing_Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc479e1-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786005255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005255, "uuid": "46e58a04-b912-4a66-9eaa-4ce00a7b414e", "comment": "Malware payload (LxBaseRAT)", "value": "80f75e1631aa7af1c9ecc46f40cc6236", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005255, "uuid": "9b9569ae-2108-4746-9561-485f60913045", "comment": "Malware payload (LxBaseRAT)", "value": "49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005255, "uuid": "6ced64f2-ce43-4235-92fa-61fe94bcb4f9", "comment": "Malware payload (LxBaseRAT)", "value": "b53aeb4a4bcbf3dfbcb6f1ad215a0a853289751e", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005255, "uuid": "5e63d032-d4bc-42ab-ae56-c3a9d700c291", "comment": "Malware payload (LxBaseRAT)", "value": "897f104b7caffeaa91a7b1f1e6952084fa0fb8782b520e5a19a85f141b66e19711b8054e28a00beafa796661a75ee4b9", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005255, "uuid": "e4bfdf76-4407-41f5-8158-e2ab52eea0c0", "value": "T19773AED9557ECE792FC98C0FC665580BDAC94A027F9F700375299CCDC2283E82AA7527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005255, "uuid": "6eafa5eb-c0c0-469b-bc3f-3afb1e1f7204", "value": "1536:/qN4MMMvr24U8+X3YktX3mHci14t+6rkCX:/U4MMMvr24U8+X3YktX3mHci14t+6rkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005255, "uuid": "c7042bdf-644e-405e-b164-9f391621fda4", "value": 79549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005255, "uuid": "34e63c6d-b019-417d-9884-fc19d769d683", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005255, "uuid": "3cc3e7df-9770-4eaf-8495-54adb630d6f0", "value": "HSBC Swift Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2550fb0d-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786045000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "043f22aa-06df-454c-8454-6563fa796872", "comment": "Malware payload", "value": "1a0ceee8a3707cbd5ebb2eb287e042e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "c2ad9e88-5fe0-468c-b112-d918d940edea", "comment": "Malware payload", "value": "4a08468e5f681ffe6240fafb19424fc3a0c0ccf24c1fbc66e6b7000e44c34417", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "9e514718-0578-44b2-8e5a-fc00e32bca51", "comment": "Malware payload", "value": "02f727e95fe89023dc3817d9078392a8645e8fac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045000, "uuid": "2f459c34-a2f6-404c-bc2f-e21f88dcebc9", "comment": "Malware payload", "value": "dab98fdf776648f770bdd908a6ef23a719b4a4764f5a60d7cbd5fc8df343dceae20af0f5a59a6f707a494d71f7bc388c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "eca0ad66-dc52-4af7-bddc-81105e8eccbe", "value": "T17BE07DC48770AF3418A8E51CBCBF8100938270CE64CB439C59D4480B1449219FA25604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "3bb1b87f-5195-4f38-99d2-1e1c89bbb95f", "value": "3:jsOA3zGK1EPkgVAGGXZYQt+yQZuF/FbmN+QXc/NlOxEiLftN5MIF334LftN5MrDW:VhqGe+3KNbVCcexEoGIFGGTq65FEnBVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045000, "uuid": "6e05e4b6-178b-4944-9963-1eb680066785", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045000, "uuid": "d1113233-a563-442b-9eed-0cddcacce072", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045000, "uuid": "d851f97f-88d6-4de2-9fea-8707a1cb148a", "value": "nvidia.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599419fa-919a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786022753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022753, "uuid": "b6f44b2a-e345-4829-8848-290df66ead57", "comment": "Malware payload (Vidar)", "value": "53380f2665f35cff7d00e6137a70bf27", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022753, "uuid": "b80d88ab-3b10-4628-b441-4da0d9ca6c40", "comment": "Malware payload (Vidar)", "value": "4ab36399059f32090619c70d8dbeb6fbf3136383b85bfef1a4f1c0c3b32f837b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022753, "uuid": "18a333cf-a8dd-44ad-ab37-e3572ef04629", "comment": "Malware payload (Vidar)", "value": "2fd62761d69d28f5067397bc9e5d6827794fc257", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022753, "uuid": "53f0ab92-5d48-474a-af16-bf471f729cad", "comment": "Malware payload (Vidar)", "value": "03087260cb60c8505efd0697572dab428d670b7a74ee99370979f7e23776ea80909d7f39b7f4ca5aefe690c24e573c25", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022753, "uuid": "d99c2790-5b67-438d-929e-45709b5c5954", "value": "T198067C03BCA549FAC0D5A33189B76252B775B8081B3623D72E60AFB82F767D05E36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022753, "uuid": "9bf1979d-f82c-4c91-8b21-626afd5dcc01", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022753, "uuid": "4f01a1b1-77e0-41b4-a718-c3919383ef61", "value": "49152:LvBpFl5rP1updyg+RcBVVx6tfXxKVV2iPcT:LrGsg+Rcxx6t/g21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022753, "uuid": "927a5e5f-4145-4688-9a80-981dcba73c69", "value": 3993960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022753, "uuid": "85d34ee5-ef6b-4407-9e38-c2ae3d1c910e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022753, "uuid": "ebcec8e6-caa6-4656-8fa0-83368e6e473f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7859c90a-91d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049863, "uuid": "37e7d856-93b4-4a7c-98aa-b6aa3f10e316", "comment": "Malware payload (ConnectWise)", "value": "fdb6c03e9d9e120f85e827954d55bd88", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049863, "uuid": "fbf662f0-2e8a-4c9f-894b-a57024d9d6f8", "comment": "Malware payload (ConnectWise)", "value": "4b1f69dcea99ca1e1884a377ed2481ee1f0d543e7faade27f6ac3dc850042233", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049863, "uuid": "7a2454e1-6cc9-46c2-927a-800a444f5298", "comment": "Malware payload (ConnectWise)", "value": "bee0adee9ff4bd8cce13bef4381c5f6dcee3aa25", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049863, "uuid": "c62feec7-680d-4b43-b6fc-7337b7c3da3a", "comment": "Malware payload (ConnectWise)", "value": "7ff572bb5463016db60274e5562c62bda83af12c8a19a9818af63b5c6bd9f5dd91a78063ffe78a4f04594a005a3f6c02", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049863, "uuid": "f9a05464-09c8-4a03-aa9e-6a031dc71217", "value": "T176646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049863, "uuid": "ef0e9981-4189-4e41-8d3e-d19b8657e159", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049863, "uuid": "3eefc6c8-c1e9-4c2c-bccf-e6bad6ad88b0", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9f:h1iw7gryNkSV1hy1Z1u2JLu9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049863, "uuid": "49362b07-5f3d-497f-adcf-9bf9f0ac0b24", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049863, "uuid": "2f2e42dd-5b98-478c-b224-78089f444bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049863, "uuid": "ea646d35-d7d9-4996-9ef4-308b80799e6e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5620318f-913b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981945, "uuid": "a045976c-7d78-4344-8afd-8f8a8d06c762", "comment": "Malware payload (Mirai)", "value": "b1cce40b2e456629e680d17f1e76ad14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981945, "uuid": "f7b30742-3682-4c69-816e-2f6d09a3012f", "comment": "Malware payload (Mirai)", "value": "4b53589aa2d15bbd5e723d2ec61a9453edcd3dfd5d82cee356c5388f7d37aadd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981945, "uuid": "5488cd49-c879-4cef-946c-d016236b80f7", "comment": "Malware payload (Mirai)", "value": "ddfe715e619e7e45e4ca42b72956c7f35ac34813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981945, "uuid": "c91eccbb-2e5d-4979-8cdf-e71127c8da0b", "comment": "Malware payload (Mirai)", "value": "6e0690e4c634fee18b433b186bdd907cd483fc7eb2ef847a22df3eb467497fbf277d24949630a48406a1ea86f1c2b17c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981945, "uuid": "005bde2f-17aa-45c8-9190-df48a6efe2c2", "value": "T1DE03F1EE91616B05C58F9D3A81DB23712E84B0E0304E6F35B21564DD737EE67E82C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981945, "uuid": "fa7cb37c-1a13-4481-b48d-8c0578041d90", "value": "768:tgZQtrQ3/OMRTK64Yg6AjZlD0hs3svdxsn0GqOWW+:t0Qtri7RCZN0xLsRqOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981945, "uuid": "1848acf7-2b9f-4f17-852c-d66a50e967e5", "value": 38004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981945, "uuid": "7ae249e1-d8f9-42df-962d-2ae75c0e3056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981945, "uuid": "00a20f0f-5082-497e-8a15-e140ad849ee9", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0a39b0-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785993530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993530, "uuid": "60d5a82b-8550-48a8-b8d6-563517d4f793", "comment": "Malware payload", "value": "672c2a691c734eb8d5790aeefb18a97b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993530, "uuid": "848d566e-f95f-4de1-bcd5-704f89d5630b", "comment": "Malware payload", "value": "4b879cc95c16f91bfdcbef200be3a44099ae449cb7281436c9b280254f4de77f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993530, "uuid": "da51cb65-2ebe-4544-934d-c0acf801978e", "comment": "Malware payload", "value": "89a56478e41deafffc83242c1e8aa54a8db913e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993530, "uuid": "1a741786-2b0c-4fb7-ac5e-37aa5c06fdff", "comment": "Malware payload", "value": "b20659d776c8f98371d16ed17fb473ebe13ec1fa1614059e38e36118c70ce542f33d5062c78440e78eab27a610e52596", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993530, "uuid": "0919670a-ff97-43ad-821a-bbf02d0a856d", "value": "T188C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993530, "uuid": "8a235d0d-b3a3-466b-9509-188f15536e20", "value": "768:j8vCB+25j6es8RH9FYpMSUpi+20qUpi+20YQX:j8l25Jhd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993530, "uuid": "160a2504-20b3-443a-b7e3-9b2b238dd889", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993530, "uuid": "aedc969e-ab66-40fa-b304-6c226b1176af", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993530, "uuid": "db58e11e-e24d-41b1-9d05-cec726d6c2ae", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d74692-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040954, "uuid": "0c5f5055-5bd3-4ba8-bcf7-e9d481b91013", "comment": "Malware payload", "value": "6482a3711098d3756a7a25e10f79e0cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040954, "uuid": "dcf71ee6-d7ad-4c6e-ab96-9b7b28049214", "comment": "Malware payload", "value": "4bbb6bb94343c2eb9a2de93be956043456c732a2bf3c2549bbb7dc9c31d9c31d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040954, "uuid": "64313e69-7db4-41de-b217-9e590bc5d074", "comment": "Malware payload", "value": "fb8efce6fb9c1cba8ef635ad3370744f672c9032", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040954, "uuid": "4f849107-c694-4dc5-b5ab-a42a33c3fbd2", "comment": "Malware payload", "value": "1acf47799cf78bd6b4e5b6e3e93454fc0b11ab56aa76f9b3bf228bd5ae1c110345c2da8b3299ea657aad304ec1801ddb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040954, "uuid": "34f10740-ec94-4375-af6e-0284148c3006", "value": "T139E4B0FC76047DD6666F536BDA96ACDD13B626238ACBA4CC80647BC305A3375EE01C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040954, "uuid": "490de86c-a478-4586-b5c3-07a54697344e", "value": "12288:y9PkpNuoyQa/yZw5Rkih5IF7new+LqXrVZZseh43XiAnnqwW10jlXamBIfU+PPLr:y98Tuopa/yZyJmdnew+Lq77ZU3Xi70jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040954, "uuid": "0d5d6754-427c-4666-bdb1-e1cd7944df02", "value": 666864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040954, "uuid": "495471a1-2f71-4a36-88c8-92c778760db6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040954, "uuid": "41bd62ce-048b-402e-b053-9b64731ad306", "value": "cgnty_carrier.ahk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57766fab-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009006, "uuid": "a8734929-b522-4446-8cda-dee02917d254", "comment": "Malware payload (Mirai)", "value": "047c315c548389e134af26f0b82abc98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009006, "uuid": "95052118-eb60-451d-807c-fd79714454e3", "comment": "Malware payload (Mirai)", "value": "4bcee369c9d5ae8a2841fe5c817028d844163737de2332518fcd28e46996fc66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009006, "uuid": "00bc4fa7-0306-48ae-8f9e-8a780e167767", "comment": "Malware payload (Mirai)", "value": "a5ee64a35f60a349c4db5bbb36a642610c34cbc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009006, "uuid": "192e4dae-0308-4e66-adbf-9bfd283c83cb", "comment": "Malware payload (Mirai)", "value": "76d3a74957d10b5850427fb510df56603c8eef1d4cef13b92cf545abbf56f4d3917e62eca525fc235947d56b5136d940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009006, "uuid": "050e56f8-a09f-4269-9e27-8e20bce16db6", "value": "T1F9343A8ADEA50FDFC4AFCE30462E031715EE599B93F17336957CCC54B68A2094AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009006, "uuid": "54c08d7f-a10c-4ce8-9ef7-37e226593ba2", "value": "6144:MDHQVZ4QirBcd4/xfw4E4c49BFjLZ4HAHOEI:MD1LrBcK/2n2ZjFrOEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009006, "uuid": "0d77533a-0fa8-4fb5-82c7-c4586a7e9127", "value": 233840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009006, "uuid": "11d293b1-0ee2-47da-b996-10b6bd98f916", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009006, "uuid": "bb7453ab-423b-474e-aaf8-6762cf97495b", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.32690.29136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9942aa3b-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786026726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026726, "uuid": "97a79114-c0d1-48dd-bb01-082351e0d01e", "comment": "Malware payload (AgentTesla)", "value": "adf69f0e3d04667c533c977ce149d898", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026726, "uuid": "63537721-c7cc-4ac2-b1fb-18ae9f53ba06", "comment": "Malware payload (AgentTesla)", "value": "4bf9c547ab27ca81b639296c54e7e6c51edd28fd4e2cb863d7056c05504277ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026726, "uuid": "90b242ad-4ce2-4f41-a857-81cb5bbd5e9e", "comment": "Malware payload (AgentTesla)", "value": "88eeae2dca0acbc900b9b9ba55a35b9271c41a3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026726, "uuid": "bfd135fd-0c9a-4589-acb6-f95af3b5bdd7", "comment": "Malware payload (AgentTesla)", "value": "673f2d862987c2271b72d832f44b43688ef21d0fd82bc97b8577dd8d2770183e2bf055e0160dcfb535e7ead5711f383a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026726, "uuid": "2535de60-2bb7-4314-b0ae-4722d2a73414", "value": "T10EF518A117C5A26333717FCBD229ED32D10A4A535409BB63B07CE708BF2DDD49A64B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026726, "uuid": "f7d4a80a-65f6-4264-b581-df231f26b6af", "value": "98304:Zu8GIRXo3jLt68r1MLJ3jOPwfUjerXeacCdw40wsAB3VaE6rbyfz1JauDqxoY7Sg:Zu8GIRXoTLt68r1MLJ3jO4fUyrOFkjHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026726, "uuid": "b134aa89-f1b3-4630-8bce-6e14d44bd602", "value": 3410540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026726, "uuid": "eacf7173-68cb-433e-be46-1b2c34c1a85a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026726, "uuid": "dbb863ba-3ba1-4bf9-b94f-9cecf0aa4972", "value": "Curriculum Vitae Isabel Luca.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c18468-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005222, "uuid": "42c9db5e-5dae-4dab-9537-0328e6c42285", "comment": "Malware payload (RemcosRAT)", "value": "418747f23ab9e5069de6e9fed31956d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005222, "uuid": "bd0bb905-0cf5-4ddd-a3d5-00e90084e3e2", "comment": "Malware payload (RemcosRAT)", "value": "4c1a6aa684dba8da8ad478c994fe9d251687dee1f8db2c6e3195d8ccc3256ccf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005222, "uuid": "fb2764fa-1de6-4575-8b70-dc9973807325", "comment": "Malware payload (RemcosRAT)", "value": "14a4445f5f0c80b341dcd5dce42d5e5771c00d0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005222, "uuid": "7cc60a7f-543a-4747-9035-16eafee4e65c", "comment": "Malware payload (RemcosRAT)", "value": "afdd42c5bb1e9f2e70609070404f2e48605d0ed21b4b61964183438c2e8f48af1280d8d4b1ed73a57ccf6b76782a629b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005222, "uuid": "4e087b95-96ef-404f-865f-d2302d2cda90", "value": "T18D575EFA3C8D3910056EF6BCCC15978F1A9486869251A2E7B5063CFBD8C4B1C25D9EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005222, "uuid": "3d46a133-feff-431e-a976-12ffaef4797b", "value": "3072:TUCquG7CNct9xQ/O3qMz5iirLPSjG+3y0TblyiDKn9NSU0qbn7MGM8TAYuztl4i4:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005222, "uuid": "2833d832-a4d5-42d9-8c6b-7c290b16eebd", "value": 27615446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005222, "uuid": "e13326b7-38fb-4179-966b-9bec98d257b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005222, "uuid": "b6c5230a-ae08-4456-8892-0cc50fa98e4a", "value": "AWB# 875282125366.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b024657f-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785996270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996270, "uuid": "2c838234-261d-4fac-b8e8-f6dcd72b16af", "comment": "Malware payload (AgentTesla)", "value": "795c5db4113d1085f3e77c165cbc0777", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996270, "uuid": "93e9ce21-d609-49f3-aaa7-fc6ba172ca9d", "comment": "Malware payload (AgentTesla)", "value": "4c1c043fa4865c680ffb5a8eb14bcc9792afaa45d06621f3b5c275cae89891b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996270, "uuid": "d218fa86-ebe6-4ac6-b9f7-7815c2583abd", "comment": "Malware payload (AgentTesla)", "value": "9be5401a3190448ed2d13c50cab1c1ebb539fa19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996270, "uuid": "4cd913dd-df14-444d-8db2-4c90cbf2aa6f", "comment": "Malware payload (AgentTesla)", "value": "aa791769a4840451205b01830d8148ed1e71b5603cea0e45c94e803e992569f367921c272c3ac3234e02e3a954b31fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996270, "uuid": "3b0898dd-f018-432b-8a66-90dc583c71bf", "value": "T19114BD15FF498421D95517310BE3B2C6D729BC2BAE2A4E0E2345B73E6D73AD0D832E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996270, "uuid": "ae11cbc6-6e31-4348-9bfc-0adf345d8626", "value": "6144:gZ+RwPONXoRjZ7SezmfDlavx+aCChyKPd7I8FrEOSSQYZS1z9F1JUrgKGy:zKPdVrWSvZ+AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996270, "uuid": "117f0d0d-42f0-4534-b76a-af0ab44d3e16", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996270, "uuid": "c7e7bad3-b88c-4289-89c4-b00b5e92c1d5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996270, "uuid": "aa4aaed9-90d7-459f-b205-325e52a07700", "value": "Bill of Quantities.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a893e997-91e7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786055957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786055957, "uuid": "4f6fe465-a552-491b-8d7c-7bb87362f1d9", "comment": "Malware payload", "value": "bba14867fd9c3158489aa5a3018ac2f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786055957, "uuid": "8d0413f7-d6fd-428c-bb59-5da833d61c12", "comment": "Malware payload", "value": "4d24c9c629ce5e5a35544d656228de3ea15b8f4c42ac2497df926b3179ce30cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786055957, "uuid": "68ff57f3-f71d-4355-a988-90e6ef35964e", "comment": "Malware payload", "value": "9127a1d21c8d7bc193081048c2cb2f60c993eac8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786055957, "uuid": "bbca2e8e-af56-4417-84e0-df669bd05dad", "comment": "Malware payload", "value": "fd3834961c0ff2f959276c4efd6d84ee9a63f7e5dc17eab706a7b0cfa2b1722591a4803b13520339e842fa1020830d2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786055957, "uuid": "cc7fb594-dc52-46c7-8e2a-c84c221ff25d", "value": "T1C1A48D44B54F7D52D3D6E2BCEE0DCAA1B11B79B8C1A3A0B27E43034CC1669E1CAF5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786055957, "uuid": "d1d49817-d69d-408a-9e85-f328e7ffead7", "value": "6144:Pv+3wP4HvjcGSaXRyDUnARC8CrqPdeUpccoMax0MRaR+ASdSHP:OA4P4rDYARMr6rCwRR+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786055957, "uuid": "3ffb5bee-5ed7-4e79-8ab5-83c6a8067975", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786055957, "uuid": "1081d6e7-70ba-437d-b8ba-de25e8530b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786055957, "uuid": "4c30f1fd-ce5a-4876-bc47-ce44608325b6", "value": "4d24c9c629ce5e5a35544d656228de3ea15b8f4c42ac2497df926b3179ce30cc.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8a954e-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005446, "uuid": "4784acaa-64c1-464b-9e96-ba0afa31d237", "comment": "Malware payload (AgentTesla)", "value": "7e4c1d09d68f95bee7fc820f12c9007a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005446, "uuid": "6372379a-6d0d-4f2e-b17c-728a9384969b", "comment": "Malware payload (AgentTesla)", "value": "4d2d933833407d7a57ca47402808a1d79e22f5cffda0d4bd35177669e987d867", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005446, "uuid": "d893a3fc-3ed9-40ee-9d6d-bd7bd896caa6", "comment": "Malware payload (AgentTesla)", "value": "e98db53888203fe6e2eac4b336252478c33148bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005446, "uuid": "1c268865-c920-40e3-b83b-6aab54b2aa33", "comment": "Malware payload (AgentTesla)", "value": "d7ab5bbaa31eafadd5e23b27a64f4a9050aa896e68f58a100f1886cdd3052df95c7de4ee082abfa66f14df078cbbf3fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005446, "uuid": "3f95f7c5-1b79-4d0e-8d29-01a4b8526fcd", "value": "T19AD5E5912744D0727B21ABAC61378E319A0FA09355D2DF19316CE30877ADD4FA39CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005446, "uuid": "a383b473-14dd-4782-8acd-9dc5f9a88976", "value": "49152:M18D/Ang6nMyIj04ZsC3yHThH7eAVU4gabpqapefHF/Fh28ePSiy5jPj9TgeGpN:M2D/Angsyj04ZsC3yHThbeAVdgabpqaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005446, "uuid": "1e424a40-b8d7-4be3-8a5c-c7a5e90ad204", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005446, "uuid": "32f4a4ce-ae4e-4f8d-a735-68fe45d4f13a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005446, "uuid": "ce9eb6a3-847e-49bc-996f-9d158c18d88d", "value": "\u898b\u7a4d\u8acb\u6c42\u66f8.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a718d0-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026856, "uuid": "4d98e0e0-1ff5-4044-b598-29cc194f28b8", "comment": "Malware payload", "value": "88439104b3c207f17d33ef3160e3b080", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026856, "uuid": "4fd0b473-1e8e-431d-a85c-f3215e4595c8", "comment": "Malware payload", "value": "4d36db3522a7b2dd10e0936e1004373c7ee65f10f7cd7920cd76410459c15a45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026856, "uuid": "c9b57bcb-0684-4fdf-8b51-63528571906e", "comment": "Malware payload", "value": "2eaa6199953a3624601a25e1158fa4a21d9188a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026856, "uuid": "a65c4b68-d49a-401a-8dc2-0cf31cfa6e43", "comment": "Malware payload", "value": "b6b55d5647a58cc72332ea37e793a4b21bfc39747f406ef35bfba5aac0437b87dd0c41eb787a4452cf6c98026d1345d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026856, "uuid": "70789d8c-0ccb-4c0c-9083-02f54a889a2e", "value": "T1F3C08C0348DF418369A321859C1CB273A6EA07BFFE07D14127AA7A362A4887C30676C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026856, "uuid": "41c7a787-0bf9-4053-83e2-68043f6322d5", "value": "3:JS2mb9iFDXKICCUXXdmoTM49KIRVh3R6fGA1X0B7AYg7mb9MvdJcLjRGNZv:Kb90aICtXRMOpR6fdu/kmb9S+RGNZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026856, "uuid": "ce7ceded-88da-4eee-ae13-d3f3ea7332fa", "value": 161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026856, "uuid": "1eceeede-210f-423b-8b36-538e880acafb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026856, "uuid": "af4d6ad7-70a2-4606-b32e-3b60260e5521", "value": "vite.config.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1f6454-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021979, "uuid": "b8b05f46-db24-4403-bc00-d8aee61a8093", "comment": "Malware payload (Mirai)", "value": "b51c4df48a74e41ebf05b5ff45266ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021979, "uuid": "809bd9f0-4a7f-4e5b-9b47-9185ee1a2b54", "comment": "Malware payload (Mirai)", "value": "4d5f56042c16c2040b8736588363e47101b6a12c387f9021e95e3bb381212a70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021979, "uuid": "d8bc8247-fb2d-4e3b-bca4-8da7e17dfc03", "comment": "Malware payload (Mirai)", "value": "12964b7262e003d9409408d93f6c88f024f35a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021979, "uuid": "c7601a92-f104-4357-8756-dd681b1139c3", "comment": "Malware payload (Mirai)", "value": "05b6378525590db1421903b2768b7851a078a857d00756de9825e82e9d6f7b97e362fa22a3b39431be1cb51676a32152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021979, "uuid": "06020c70-b10b-4843-8ea4-75ce977b3426", "value": "T1E7C2C5126653C872C10729F592F2DB628530F8BF6A159546C336AFF3EA551C0A2B337E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021979, "uuid": "95c86fa8-5b42-46ac-80c2-096714d55254", "value": "384:fBPEvcxTwPZu4Kil36GMlqW4WcZ8v17cIXznB96kRicdz/TYUR:ZPEvc5w7KilhYJlcoNtUs1YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021979, "uuid": "91c028cb-fa65-499c-9cd1-78fc4cfbc8d7", "value": 27840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021979, "uuid": "26b33b2e-cb61-456a-9015-8218925917dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021979, "uuid": "8743a9f5-345a-4fcb-967d-612055263b8e", "value": "main.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e74b33-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786045001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045001, "uuid": "7aff0794-bac9-4180-bd41-a0cd7a683444", "comment": "Malware payload", "value": "e2eddae5f0c008977dc231c98bbf68ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045001, "uuid": "a2804079-f590-4203-b79f-25388bbc15cf", "comment": "Malware payload", "value": "4db52ac790d23d428abc37b7d2196332502f26f5130e0081b7be6be9925ce7eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045001, "uuid": "fcad5802-1a1c-4b44-acaa-58eea33a2ee0", "comment": "Malware payload", "value": "3493cf1c598c9af96cdc3c27c822132f8995c57e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045001, "uuid": "5e090e20-2899-4f36-82dc-3d6d44d0d09f", "comment": "Malware payload", "value": "cf2ea4a3c0ef27faec6b3a1dea26b083b2647f50a04166b80f1390e4419a91275ed93e0e81366226850dfc2446627106", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045001, "uuid": "c5f45007-da37-41dc-af13-35266fea5411", "value": "T17DD05E6292202F611F61C704366A8561844339C792471988F5D8CE602F88C8CAA41B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045001, "uuid": "a8aabc58-0039-41c5-9ccc-64a9eb3c8450", "value": "3:QFKIaM3BFDzCLftNIEUFoNYLftNIEUF8aOOdhEbF/Os/yIRwC21LaUnnyVtNJx4f:QOSB1ItcoYtc8a2h2wRwC0WvPdAFfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045001, "uuid": "703d60e2-6ffd-47ad-a4ab-b86009743559", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045001, "uuid": "49cb8f31-11be-44f1-a273-8e07f8517d25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045001, "uuid": "71c71f1f-17e2-4632-a2b6-471756dc9972", "value": "traffaarch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90ad31b-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978756, "uuid": "79b401ce-4412-4bc3-8d2d-f6d2b0cfe7ec", "comment": "Malware payload (Mirai)", "value": "1da83ef242705b19c9a8c0d64b773cd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978756, "uuid": "f7922b8f-ee56-48a0-bd91-14c164b4c340", "comment": "Malware payload (Mirai)", "value": "4e70361a2c27d7da8185766187b3757e1fa966f4e0b1e370886d66481121e5e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978756, "uuid": "1a506c9d-9a3e-4743-8cf7-0b7e2e340d80", "comment": "Malware payload (Mirai)", "value": "08c8f0b41796672c1952808be9564d6a1b09717f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978756, "uuid": "8e1b4e7d-ba82-4067-bd81-04650ddab528", "comment": "Malware payload (Mirai)", "value": "7d7db4586037402339d0a48e2df11b7787637f07001fa6d7a3f28cb7488745f6491a25edd46c5e6e57616c54d48736c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978756, "uuid": "12b91af5-73d7-452f-a3fc-8947a1f0fbc7", "value": "T1F532CF07B7186EE1FA920F77137F11E1EAA76A2A10D4E37F7049520A142B485E31D459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978756, "uuid": "30f8cff2-50cd-4613-a220-2dca81361135", "value": "192:L1Ace22dcx7BO3IXQjLo+bOFBQC6qraoBGbKogNOU2fikhTpWOltZZEaBHKEY1i:1e2h7BmRLAdvrgU8hTp/ftB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978756, "uuid": "b71fa8f1-0b8e-447c-93a9-7730825b484b", "value": 10924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978756, "uuid": "4b941211-6724-4522-8f84-ddcc1dbe967e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978756, "uuid": "04229234-70a2-444b-acb4-9ec6819d2ca7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aba32a-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040658, "uuid": "bafae527-f7e9-44fb-8d3d-a1b75dd2ba55", "comment": "Malware payload", "value": "254b081a776590e6c5f994f261e40429", "object_relation": "md5", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040658, "uuid": "57d14b2d-0e50-42a6-937f-737ca5e2760f", "comment": "Malware payload", "value": "4f92a9fd43f7a96c74b4b6df0df16730886fa2557f074c06cfb925dd953decb7", "object_relation": "sha256", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040658, "uuid": "601927cd-5bf7-40f2-b71d-e8751c1b34fd", "comment": "Malware payload", "value": "2e451ee16e9317f6fe788e54dc669a55090f24f3", "object_relation": "sha1", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040658, "uuid": "f198be06-3c45-49f8-a58b-8b60e317d1f6", "comment": "Malware payload", "value": "e2bb5de9f4bcffcaa4047a6eb1e2fd62abbe419da70f7fdcf9ba85400e8afb31d1127dc741bfebd5390bd1c05c2c00d0", "object_relation": "sha3-384", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040658, "uuid": "879451d4-7b6f-4829-92ae-a0ba7f72760d", "value": "T10001BDE1B43494ABB10B7C597F2802E7C8570B1B83046CA17CDF8C282B2C9A7954CF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040658, "uuid": "ac8227e9-30cd-4c8b-aaf0-6b3314ab40d1", "value": "12:v+hzdAPSMM6JHBh5YnbfiHj1ZjjwfRmvjhpHjgcRH410kl7itF27xF3Zfa4JQGkt:GsPHza63jwIf/lOlGb2dFo2Nvy/FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040658, "uuid": "a9dd0514-f6f6-45a4-9b42-bec5e14efbdb", "value": 791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040658, "uuid": "727fc891-f43e-46aa-bd51-070de0494efe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040658, "uuid": "9d2f8232-2461-49e7-bea7-a4ce0558536d", "value": "4f92a9fd43f7a96c74b4b6df0df16730886fa2557f074c06cfb925dd953decb7_from_104.156.150.223_redis_set.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb2d631-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "d01157cc-0076-4ee1-a4d3-809455841386", "comment": "Malware payload (Mirai)", "value": "bff984a2a072edde7afaa71f79dacdc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "ade5aa72-2716-430a-b86c-f5ae7bebf627", "comment": "Malware payload (Mirai)", "value": "4fb5f93254a76530ee7faf702a4019a860c53016a7e8851211536548ea4cd73b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "ffaa3213-f139-44c8-a56f-0b04cc4ca98e", "comment": "Malware payload (Mirai)", "value": "63b5a0da172392d3d0f2d13be82ea02aba4b2288", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "94669a55-7931-43b2-bc7f-b84823645d08", "comment": "Malware payload (Mirai)", "value": "231373317c3a6b03f12e431dcb865bfc0073394cabd42e243d3f7429c7b5a58738007497ad8b4e68ec3ce494355fee95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "cc000700-3e99-493c-9697-850f0e7b82a6", "value": "T18E041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "c91784e9-0117-4753-ba81-2125c425b01d", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPM/EzvQ6WJ9G2/7ZiYlTBVmJT5:J3CTRdrD5GFnrPU8sNzZt0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045738, "uuid": "e24ec2bc-e968-4481-9b4b-4fe4a353f1e4", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045738, "uuid": "b5010949-b3c4-4d75-a349-107e1c226534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "12ed7d91-370c-4a46-83f1-87f50c70fda2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f056ace-9169-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786001798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001798, "uuid": "80599d63-4253-47d5-8ee3-b8d8d59ebf11", "comment": "Malware payload (Mirai)", "value": "fe4630c243075cbfe65255d5e4290d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001798, "uuid": "0e18ab33-34ba-4927-aedd-567ef6fc5499", "comment": "Malware payload (Mirai)", "value": "4fbc4150ddc9d3e33312377246498d1ca598562edfae0a53b2a0ed2ad84b1033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001798, "uuid": "0090325f-6de9-4a82-a12a-cc24cfd3de96", "comment": "Malware payload (Mirai)", "value": "f22732cf2446519a21dfde019eaea05259ef9ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001798, "uuid": "8785d829-3eed-4f84-a56d-d8a58e3eb188", "comment": "Malware payload (Mirai)", "value": "97cfa52dcdaef29d58581b82aae33934d90a9ac827d1806ec2eec23324e35b828525a03ba5cf1a3b18f40983d64741fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001798, "uuid": "9b684b09-caf0-4082-8d82-e6c71cd7dd2e", "value": "T1CDE36B41FB87D2F1E99305B0001BB71F8B349D258124DF4AEBA92E71ECB6706855BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001798, "uuid": "fa3d452a-dbdc-49f3-8301-59b57f7af863", "value": "3072:5hul5c6EL12WacL4nxJqlBnIUJXFfZo0CSahkTv/8Sf:/u30cWaU4nPIfZyDG/Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786001798, "uuid": "63c1d5ca-cd1b-4cc6-8d13-608d7c9933ac", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786001798, "uuid": "f00962cc-5bcb-41cd-99fa-310714f9e64b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001798, "uuid": "371e4dcc-e04a-4e0b-9266-09f725cc048c", "value": "disconnectraw.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4312b224-913e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785983202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983202, "uuid": "e8b1dbfb-f11c-4138-abc4-d75c8fb503df", "comment": "Malware payload", "value": "147924e0968285d0ac603a7c1df339d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983202, "uuid": "7b2d3ed8-0824-413f-9d08-1c8610bf9434", "comment": "Malware payload", "value": "5015daf6cd5f8b73685b91536a69ed646a510ed97bd70d9bf2c661f501bdc42f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983202, "uuid": "5021b7ff-21be-4757-94b7-e850fae774b6", "comment": "Malware payload", "value": "d15bd76f6182777dc433cd0f428567fdb51662cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983202, "uuid": "6971c053-d7e7-4643-9cac-bea119a2b0f7", "comment": "Malware payload", "value": "d95d0466299898ecd695088b9d80e49ea794281e6dd36d46cbfba6c547eb33b9da361f87a90c1fc7bf6f9f3f662c7a5a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983202, "uuid": "967c627a-1721-4988-a78e-34f4f5ff2922", "value": "T174C27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983202, "uuid": "6b572f51-16c7-43a0-8210-51706f65a4ab", "value": "768:I8vCB+25j6es8RI9FYpMSUpi+20qUpi+20YQX:I8l25Jed2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983202, "uuid": "28616ab8-b9f8-4b49-8acb-16a052d31717", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983202, "uuid": "61a73cda-7e86-4f55-8cde-dbe2324dfc3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983202, "uuid": "5db2794c-5f89-429c-9582-7d40511e5e00", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37445a49-91a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786027850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027850, "uuid": "19c17fb6-dd5a-4795-9e82-85f97fd9ab7b", "comment": "Malware payload (AgentTesla)", "value": "ed4ae654e0bbb7058128fef7bcad32a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027850, "uuid": "0af6515f-ba22-415f-90cc-5d077c028ba5", "comment": "Malware payload (AgentTesla)", "value": "5067ae4261feea16e5b765d748a743eb9f55d86cf795c0213ac3769049e7dfba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027850, "uuid": "8eb0b600-4635-4b57-a112-75648ac5b19e", "comment": "Malware payload (AgentTesla)", "value": "015a1b2d4c10af211b9d400ca44c263d9badc960", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027850, "uuid": "c81a536a-1db3-473b-abc7-1bd4b04f78d8", "comment": "Malware payload (AgentTesla)", "value": "2e30cb6632b5d5c6d6f3fa87694addbcd5a82a0dba991cea39241b3546bfd2614e553e671d1a339daff4f17e137d73d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027850, "uuid": "fbfc1f34-fbbe-4302-8dc7-d186d097e093", "value": "T14535F114629FC806DC5A0772C8B6D7F403A0BE8AE812F2535AE57FBB367AF574844352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027850, "uuid": "7cc30370-988f-4e2f-a972-976860dea2a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027850, "uuid": "2eb17fe9-36d4-468e-889e-f3ce829ab453", "value": "24576:AfsmKoTTc+v2GU50m4Kq1e+ho463tsEbIhWozDeZ:Af3K2Tc+uD5uhendXbIBzDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027850, "uuid": "92aad610-63ba-40ea-8304-3d0e8e4de1bb", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027850, "uuid": "84ab36fc-be55-4c28-bd92-d05c44296e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027850, "uuid": "70ecfacd-05e2-4c98-b3c9-9b833b7afc74", "value": "Urgent Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f5a651-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034401, "uuid": "dd0d2f54-a0d6-45cb-9c2a-2e97aaf70d16", "comment": "Malware payload (Mirai)", "value": "d9a48afcdd32cd20d1130e4b91071f06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034401, "uuid": "ae07f7e9-ab22-4c63-a936-2dab85318ed2", "comment": "Malware payload (Mirai)", "value": "508453aa3bf34a306d0db29d48f919be268a2c0298d2cbd04e39ba57f1c7dca4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034401, "uuid": "ae07997c-c3f2-4264-98f6-968953509237", "comment": "Malware payload (Mirai)", "value": "ecb8211c487a19a63357542adaa89a551e347e5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034401, "uuid": "a8aab276-4a35-4f45-9101-170e6030f6d4", "comment": "Malware payload (Mirai)", "value": "c983b7710542b8f7c923df83dda32ad0c568d536e714c0e1929fce6254c1754b6ad2a1c126654cd5912f5a9a1ddf09dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034401, "uuid": "895a2ae8-38ae-4c05-98c7-d4c60819fa7d", "value": "T181C33906F98180FCC58AC2341B6FB63AA936F1DD1238F2E76BD4AF123D4AE614D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034401, "uuid": "b8421b2a-9543-4d75-8e7e-8d781f625f66", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmfnZ9TzQTRN6Fpjyg5jc:jrguLRkHQo8SsGT74p1oB4n2pvaliPzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034401, "uuid": "4532da63-9f96-40d9-87e3-daa4705bef79", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034401, "uuid": "8c5b2132-db88-4863-85b3-3f48aa3665bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034401, "uuid": "f4c2fa81-cba3-4912-934b-889121743a14", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d9a3f-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048937, "uuid": "1d47ca11-bd63-44e8-879d-3163f0c4f3d1", "comment": "Malware payload (Mirai)", "value": "04dfb44559f58915f6a2fc8ffe9dc5c3", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048937, "uuid": "a8f490f3-edde-4520-ac35-2fe34088179c", "comment": "Malware payload (Mirai)", "value": "50aa7550467e864b0456231b1c09b8f2e11583d22e4ae5674c39ba52c9372501", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048937, "uuid": "4c9ca1a1-20ab-41db-908c-522137ae2908", "comment": "Malware payload (Mirai)", "value": "bc9e76e824ade95c001a15e1660efca520c4dedf", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048937, "uuid": "c9cb5668-a831-4e2a-8dca-975c5ad6100a", "comment": "Malware payload (Mirai)", "value": "787e37a763638346f90d1e85d95cad744225cf7430b36f23971b7e145ce96becfd910ddeb586486b8432a22cbd1d7c9a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048937, "uuid": "cf77ea5f-b876-4ba0-9831-8de43c8ecea7", "value": "T188631257BFCC1FADECDD2AF9076B66DF23519025507340A80DEA4C4A908FAB111DB88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048937, "uuid": "e88f025e-c94b-4ca0-a3a6-6bda218acdf3", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDgMVhrPH:27Mbp2L+Xqdfoz2sZrPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048937, "uuid": "afdf1c0c-58bb-42bb-8399-9f285e3b87c6", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048937, "uuid": "3341e195-ad98-46ac-8b9d-924f7a7aba9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048937, "uuid": "e3cc129b-e3d9-4425-ac1b-60af78f95458", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02333fab-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005427, "uuid": "6880fe36-a4dd-4f31-b6f5-eb59df678ea6", "comment": "Malware payload", "value": "59a5dd1bdfcdc227cff4b4878726a127", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005427, "uuid": "b5f5d445-4c58-4258-ad77-9dba67f30d0e", "comment": "Malware payload", "value": "50b550faebd9e8e28676a307f8b826d2cce0756a97bbaf8e286a20fd044d779e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005427, "uuid": "22599116-a07a-4211-b36b-d6b9ee07f0d0", "comment": "Malware payload", "value": "aa8a1dd1d053f7e4aa3c118c3b9432909c994b9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005427, "uuid": "852f6766-be69-4b41-9abd-3454e85a42ee", "comment": "Malware payload", "value": "960276d539871ff61cab571aff64dc8d287e64494d2077e76f59c9a7f6520638bd36f01bb8db5ef49f05a6235cd3c444", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005427, "uuid": "7d6f03fd-1b00-43ca-99d9-fc1226fd7763", "value": "T1D23572DA8F4778C8919E3587CE26B6B6EF97370982C86A8C3644AC716CF1165D70CB70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005427, "uuid": "94903745-8953-4152-a032-a69244357872", "value": "768:L8SFT/eT9ze/gqhF9N+pp8tpIzqQe9hq+qNOS9NSkpSqQ8SkqhFpe9Q82NS/fS8l:B4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005427, "uuid": "aea61a75-bc41-4626-80fd-55d481c4b7f2", "value": 1069398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005427, "uuid": "fb52c41d-79f3-4436-b7a1-f79e9c993028", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005427, "uuid": "74da25b0-157d-40b9-9946-21c5cd9415f0", "value": "Orden de compra POF0000095.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fccf4a2-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "a69aae58-44b2-40ca-a647-d343022826d0", "comment": "Malware payload (Mirai)", "value": "cf13d592ebfda5fa738bf9335e5510f8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "d5c8bd71-b8cc-443e-85b3-39168b4d827a", "comment": "Malware payload (Mirai)", "value": "50e2b9afa91d224e2d25ac36c9f829cf65cb5bb9ada15df5710096987e73d1b5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "bf030900-0840-47ed-a396-aace7f138b21", "comment": "Malware payload (Mirai)", "value": "6a98cd7fb899c8d79506948dd00844691e58c4ea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048936, "uuid": "a9b51522-a98f-4466-9239-d782f7a15b8d", "comment": "Malware payload (Mirai)", "value": "7af5a2c18f8ee9e2744e4d606a59f4acefd95c64cc2d4b5ae7017eee4c69a13a925d5047e4e5eb30ebf3b78fc211c265", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "0581f4e0-5513-4980-a271-d7f467a14ab4", "value": "T14BC3F185BB6369D1C0A242FDA4C00AC387912E318BE317480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "a99b1849-e8fe-4545-8328-65faf169795e", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnM:0OCDjXG9qTWywxlxTnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048936, "uuid": "f18b863e-0aa1-4612-91f9-58377bafcca6", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048936, "uuid": "ce2cc965-e653-49fc-8801-1e594bd217d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048936, "uuid": "c980a6fc-c268-4229-8ba9-718d4cbf11c1", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22740572-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "afa87b0c-fd22-40ec-b305-ae950270f1c5", "comment": "Malware payload (Mirai)", "value": "bfdb6901df97436fb36d196e6581e8c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "ccccd131-c821-4661-a9bd-2615d578890e", "comment": "Malware payload (Mirai)", "value": "516c4512ef9922821eed1f2489b5a5243b757b30d2bf018a85b27ecdefee5826", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "19abec1a-558d-4904-a857-c4e194f8330b", "comment": "Malware payload (Mirai)", "value": "ab77a10620ddaf64173d604af3a3a63cf27c4007", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "6f4a7384-a8f9-4222-92cb-543901c354af", "comment": "Malware payload (Mirai)", "value": "9b39346271182d91294ad6bc1680423fd28c8f72938f17385202b4da2f2ab874f9ae66b514c168ee56546a0718fa6074", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "668b481f-a310-423f-8625-36671d35825c", "value": "T1FB24E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "7f46555e-5507-4b6c-b13e-4b74969307ca", "value": "6144:B3GbATqHMcX7qloyeJa3iVf5L56WeFjmhCjsa2:B2b1McXOlYJa3M8We9mYjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050578, "uuid": "83582de9-4214-4df7-8c2e-8dd1dba10442", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050578, "uuid": "559ae98c-49be-486d-b203-cf8326c2469b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "60ca5e19-8608-44fc-919e-b2fda8dfdc05", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5262b899-9141-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785984516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984516, "uuid": "7568a368-5aed-4afa-ae83-bc2ad228f741", "comment": "Malware payload (Formbook)", "value": "f32649c7517a120e01f03d2ff7338ea1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984516, "uuid": "45575947-1806-4e28-bd5c-6d73f71acc90", "comment": "Malware payload (Formbook)", "value": "520e8e29ace68efc7f636e4b9722c663e4c81a152db1f3370eb13f889636f5a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984516, "uuid": "7f0146e0-ce6a-437f-8dde-33e47bec5bd9", "comment": "Malware payload (Formbook)", "value": "9633a041770c8755cd753dec7804e650285231bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984516, "uuid": "91d27934-53e1-4d91-b432-492ad298dd2d", "comment": "Malware payload (Formbook)", "value": "9e5d363312bc584aad37d404da725adf67e62bc8589b28375aaa1aa2382c5c57bce41603c2c5d09cf62f2e7344bb4d0b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984516, "uuid": "e29e73c9-6bb4-4f8f-8d65-8698e07a0e95", "value": "T1CAE5F8F136DD7A059E1AB76C980E6A189B09D1710E83E1C4F0EF1FD1AA0F81762D4D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984516, "uuid": "d16cab3e-ea93-4562-b32f-07a1461e28e2", "value": "49152:tuuX1LudDML/wlTSfbILkejdXK0OJIZtcdgiXuN:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984516, "uuid": "a1027940-d0fc-4f82-ad5b-c2ce94f31d1b", "value": 3145201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984516, "uuid": "9af9c650-f6fc-4ec0-af99-d0ebb63622c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984516, "uuid": "6f1bd5d0-a640-4db9-9e40-4f1a566dc916", "value": "MT_LADY_YASSO_VSL_BRIEF_DETAILSpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e6c33c-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786005722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005722, "uuid": "8ef6837d-40ad-4e32-9fb1-f9f22e098f43", "comment": "Malware payload (ConnectWise)", "value": "c76fdf1217f28c57fbe756a661939125", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005722, "uuid": "1628e08e-8583-4a69-8ecd-ac1c6e73647f", "comment": "Malware payload (ConnectWise)", "value": "522d1b1c915fcf7d6e7113bd6c53aa435a01b77b8c12316bb2ca53472cf66beb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005722, "uuid": "e9795286-65e0-48e5-bf1e-8f1630479619", "comment": "Malware payload (ConnectWise)", "value": "267a4a6f4c3b83c818cca048247adc6bcc5b2ac5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005722, "uuid": "5459be85-8256-46bf-9b91-e5a664917b46", "comment": "Malware payload (ConnectWise)", "value": "a9669ab883e99c39cf921b5bf8209ffc18930bb57e36a2d16bd1769b21d05c21e432a9765c364f488e75390fa51565fd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005722, "uuid": "26f31af8-01c9-4c1d-a8c3-3fdbdac802e7", "value": "T1D3226A3B1B0A4E98F79C0F88E95F910118F58956BAA71E083B7B0D633C27C5699387DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005722, "uuid": "c8df4da7-1a6e-4f58-83ad-5b5764136acc", "value": "192:SSXE7GUOK88IE/pPvLrQPfWVe6IunulsSe/ZZTcD8R3d:fw98PExPvLaKYeTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005722, "uuid": "5c5efaf5-3505-4e27-aa26-25464bc41329", "value": 10342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005722, "uuid": "e4d9e882-c81d-493d-a173-85374b6756e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005722, "uuid": "6a1d227b-5ff2-4e9e-b133-b7034a8ba3ca", "value": "Document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b64654-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049488, "uuid": "c5d3f331-0c5a-40ac-8b0e-7271cb50023b", "comment": "Malware payload (ConnectWise)", "value": "a4d5724a971bd46250c60267456bdec9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049488, "uuid": "47a35086-0f72-46da-90b2-9d8f510c1139", "comment": "Malware payload (ConnectWise)", "value": "5273b7575eb3efe33117a8209684e11ca42a66ed779ecd32bc9ead5b2a9f0d30", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049488, "uuid": "793594c4-3c7a-4d78-ba34-b879ff5dad22", "comment": "Malware payload (ConnectWise)", "value": "837cb1d0bd9b2e0a2e18ec5f257064c8717fb94a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049488, "uuid": "707bfa81-8aab-4645-abd8-0c4c0c3d2bb2", "comment": "Malware payload (ConnectWise)", "value": "3adb4a8f9a16ad2942f6a79b2397f9e65c587124f9a33d665fe2bbd377a02c97d330b3061b4c58d11d4a99aa1f9e94c3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049488, "uuid": "bdc82e19-461f-46bb-baba-08ff2db90e78", "value": "T1C9647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049488, "uuid": "1b1fa7b1-0a60-44f0-9302-604a691bb641", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049488, "uuid": "28106ae5-565f-4ed5-90dd-69de33533985", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji97:R1iw7gryNkSV1hy1Z1u2JLu97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049488, "uuid": "7eb818d9-53ed-4681-a0b6-3562a7e744d7", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049488, "uuid": "31f38696-28ca-4c61-9d31-059a91be36bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049488, "uuid": "c96b42b2-6c50-4201-b296-e4c062940cea", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c9967e-91c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040377, "uuid": "f90824dd-6738-441e-be41-0e7605568920", "comment": "Malware payload (Mirai)", "value": "8c42484c831b13cc9a8ed882536bdd88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040377, "uuid": "0555d09f-1400-4ad1-a619-5543b6f034ce", "comment": "Malware payload (Mirai)", "value": "52e614daba0ed8954f4b731640efdb0fadc81ec0ba77923a868be3d1e99a4dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040377, "uuid": "764110f0-e947-4b76-b24b-a3bd86c365dc", "comment": "Malware payload (Mirai)", "value": "54486ba75d5a5448245ef91efc43c88c03191137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040377, "uuid": "dc15f17d-f545-41f9-aa89-847ff68060ce", "comment": "Malware payload (Mirai)", "value": "d090b074d1731d59134532af8489284fee13acf191f62aca5e3be4181f2d535a268440ae159d29ff0f6db4526ddc2108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040377, "uuid": "7c184534-6dcc-4913-ae50-a340d7d6da0a", "value": "T144345903B643F972E15310B5379EA7625821B839682688C2F7A22EFCFDB55C0D64572F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040377, "uuid": "f0acd110-6ebe-483f-a52b-8c08c0d3d76f", "value": "6144:V+ONt7zCE1kh5zVDve/7RS3I4pEYi9LOVqG:Ht/71WRy/7RfpFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040377, "uuid": "2f9897f2-01bf-4e0a-a060-44da136b2d42", "value": 248536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040377, "uuid": "e781af01-5146-49b1-a3c0-3da87a12288e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040377, "uuid": "de144728-411a-41da-9085-0d0fab6cccd3", "value": "pope.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b700974d-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996281, "uuid": "3aa9b637-cc1d-4d34-bdd2-241da04d339b", "comment": "Malware payload (RemcosRAT)", "value": "e2c5e69abc1598ec8b34505a28af06a8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996281, "uuid": "1fe072f5-fcbf-4a90-9706-451c5adc0aef", "comment": "Malware payload (RemcosRAT)", "value": "53116434e0eaa0d143fa77c18e90d08b1c1ccd7b809810fd9fa9be8f56a68671", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996281, "uuid": "f65ad8c0-8a80-4e4b-89b7-e38d16da89b1", "comment": "Malware payload (RemcosRAT)", "value": "a7b698a24c0b304d9cbc54c43d65a59c62d57eff", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996281, "uuid": "616a6f36-72ca-48aa-9bcb-a50de6245d7b", "comment": "Malware payload (RemcosRAT)", "value": "38d69b2ce3852ffc90e338855cec9f04d374f23b75aec77b1875aec57e4ac47bc7e3a18dc9d4e0bf06ca79d2425d88d5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996281, "uuid": "961924b8-fc60-4456-bc3f-f1df702949a8", "value": "T1C614BE02FF959421D94103350BE3B2D2EB29FC2B9E1A4E0E2785773E6D77691D832E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996281, "uuid": "df319ffc-de94-4b30-b585-f20e0c381e87", "value": "6144:oZ+RwPONXoRjZ7SezmfDlavx+aCChyKPd7vCMjCp/9EQTrAH3UNq:7KPdTupRTrAXUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996281, "uuid": "045a3155-1113-4331-a9a0-cb99a31deced", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996281, "uuid": "8c06156a-78cb-4326-a790-9d7cead3ab67", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996281, "uuid": "71304fa6-3b82-459a-a151-c7be91686cdd", "value": "24C S9-LBL(G657A2).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb591ca7-915d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996799, "uuid": "b2be98b4-864b-4fbc-b02b-85c352e0f0f7", "comment": "Malware payload (Mirai)", "value": "b34084ec23cbe91ba358f865834b9da3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996799, "uuid": "b822f1c2-21ea-4c21-a3cb-d62a92e6d8d0", "comment": "Malware payload (Mirai)", "value": "533503dbeaeaae26d370a48e4400d7d2cc823c4ed4ec6e155de3ffd0429e64a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996799, "uuid": "038012b2-ca7c-4047-8aa6-acad1d034156", "comment": "Malware payload (Mirai)", "value": "44ecb646fd63d93a487d28de81e867a6516bbff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996799, "uuid": "7f8c8fa1-d2a6-4bb2-802e-26390bd11e99", "comment": "Malware payload (Mirai)", "value": "fc93103191f3b656811650e26d8ea8ae5c2e859ac393cedf5b0389f3a1bea3f7fcc84e82c814bec12d63df7eafed58d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996799, "uuid": "4a9a4277-a8ff-45d6-824c-dc4a1e981a3e", "value": "T12F53F1FFD4EAF2BCC5ABAB7725148191FB31081521462FA58ADC73FD8C611C93298D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996799, "uuid": "db64b8db-2b29-4768-94f8-9b7a23ea5410", "value": "1536:nMHrQwC2sQjt4rPxEnwBo+5qssI9iUOhKIMK1SI:nMHrRkHWhIH0KIMK1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996799, "uuid": "85bd865e-3949-440a-9a11-1ea3e9dea196", "value": 60936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996799, "uuid": "1af96249-904b-4103-ba05-4e5c3204b3a3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996799, "uuid": "159e4e78-7877-49fc-a599-a03731930e10", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65525997-91aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786029645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029645, "uuid": "dbd71642-9585-4179-977d-b9a9d5342a1f", "comment": "Malware payload (Prometei)", "value": "9cceba8b87485283a56667c74bde412e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029645, "uuid": "d1de72af-53d3-42ea-be93-8719a987621a", "comment": "Malware payload (Prometei)", "value": "5389f5b5a76d2297324e93e00279ca8512d7f87065d2e6579f47a3519c6622f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029645, "uuid": "0ab24a3f-ef15-41dc-9dbe-50cfa1b3f15e", "comment": "Malware payload (Prometei)", "value": "43238be9212487625563f739d8f60db35b33fc38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029645, "uuid": "65a3c7f8-8353-4a3d-99a2-ba94b4d0a2cc", "comment": "Malware payload (Prometei)", "value": "1cb8d8b25cf730ed1b09242069239d53d2bb4e7d758bd363114039899f659f901ceab26c8d151465bf6fa79dc8e1f61d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029645, "uuid": "ca63147f-50ae-41a3-ac66-6f9e46bc272f", "value": "T1D3453369700E4E76F5A36A1E59979051F1BCD88C53323C8F2B38E6CF62990DCF21395A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029645, "uuid": "e9e820b3-89e3-4103-9a3a-0875c1e0037c", "value": "24576:sc6qWRqqRfVMP7Cft/U1QNlMKDZB3EIq5WrSCv55LhFdmQ5Rp6bv:4dFkP7ov3DZeoWCvnLDdJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786029645, "uuid": "41863c5a-2f96-48e1-873a-15263a8c2896", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786029645, "uuid": "72281f89-1b28-4e3e-a999-1ed4a2ee5fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029645, "uuid": "a01611b8-0deb-48d0-9481-27dd85a0d552", "value": "5389f5b5a76d2297324e93e00279ca8512d7f87065d2e6579f47a3519c6622f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8ccfac-9149-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785988127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988127, "uuid": "84cf8020-4244-45f4-9f49-c35d60cb0d97", "comment": "Malware payload", "value": "69fbd460433a9ea51009f40967a68f19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988127, "uuid": "44e2f2e7-28ce-4bb4-910f-242dfba20b7a", "comment": "Malware payload", "value": "53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988127, "uuid": "70895b42-84ce-4491-95c4-fbad4e5c0b5e", "comment": "Malware payload", "value": "77dc31fba83dd448809666ada7f4cab7d2e2b029", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988127, "uuid": "df5bc775-635e-4028-b146-8901ae8f043e", "comment": "Malware payload", "value": "9cf1bd2b5561e76b56c584cc87aca6a28d59d07bbdfda36b1e386519b3002862710bfeab170bfa164b263c013a5c4fa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988127, "uuid": "664bc935-004a-4bf7-a413-da37efd30cb6", "value": "T1232562A396F22C1C6B3DA3D3FD521E0947BE440512A8CAFE702A58DAF3D4656E09C5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988127, "uuid": "7f2144dd-8fad-40dd-a7e4-cdc2aa70f884", "value": "768:g81V2VVCN012KIUi6VESCR6U23WIU1SC12tRUVIU2U12xO1CLtR+qSSX2VSCRUWU:3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785988127, "uuid": "5f608b10-2d0d-4654-8f40-625b000f1e6b", "value": 1051993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785988127, "uuid": "eb4cfabd-f324-4c22-9100-cf3218f491ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988127, "uuid": "a4e4ac15-a708-4662-9302-b9e598a91214", "value": "PurchaseOrder-37851.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444df6e3-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994800, "uuid": "566e8c23-019e-45fc-9731-51b8ef1c27b8", "comment": "Malware payload (Mirai)", "value": "b78e95df68cd9385d27e5e768786512b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994800, "uuid": "c1ccb246-83f5-4fd6-90db-48dad6e49e35", "comment": "Malware payload (Mirai)", "value": "53ff0a39c4d07c49fd92516ab6038d0dca2cabf5b9dc4870294e940d5ffd8aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994800, "uuid": "478b1bfe-c4f5-4b65-bdbc-35c78915189e", "comment": "Malware payload (Mirai)", "value": "678794733c6d3fcd9824b99787481ddf7a3f05f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994800, "uuid": "78575bb0-e071-44c9-a6a7-6ac20fa0d6da", "comment": "Malware payload (Mirai)", "value": "e0eaba178432c20fe5761c5628ff0968a2002781faffc1781b5d9b920c62697be49863ba5316355e893d1b6fef2bb14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994800, "uuid": "29d0eb30-0475-441f-bffd-82da7c3f3479", "value": "T1C8C32AA9F890DE52C6C52676FB4D418C33231778D3DA7105CE149E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994800, "uuid": "e444de4d-1286-4bff-a4e6-43d5e0d512a4", "value": "3072:MNj6juBHdI4ozVIHLcYEEU5ZjMWwNwhA4oj2P7/NiF3Heuzf1Dl:MlQPVSLcYEEU5ZjMWawZY2Pg3Zz95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994800, "uuid": "0462b35b-fd73-40cf-a0c4-7eab6dfe6dce", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994800, "uuid": "4afc16c6-d915-4ec9-b065-8a3721fe0b51", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994800, "uuid": "a895ddc8-a7c6-479d-8471-c3a1905e8032", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc67af4d-915d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996827, "uuid": "598eacc6-48f7-4597-9f00-939e61f8637d", "comment": "Malware payload (Mirai)", "value": "1e0191a195831f0f63a1a5537dd04295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996827, "uuid": "b6b2a703-3da2-461d-963e-e1ac65498f9a", "comment": "Malware payload (Mirai)", "value": "54001c1d46138bc9eae13c60cf59c04d18efd00e99fc88ee4eea5692a9245045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996827, "uuid": "26af72a5-c232-4794-a2b3-404c4d8b8f33", "comment": "Malware payload (Mirai)", "value": "fa39dabd5f50599fc8428ce4b41d70a8e91ba7a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996827, "uuid": "b688420b-098d-483a-a70b-47f7a849e181", "comment": "Malware payload (Mirai)", "value": "021ce8e7d39d61fabfe8e823b2185407ebfa188e9e6b40ad1c6a823f1c32f77a641896b24dfede47aa407c0b9ee11e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996827, "uuid": "b4418237-b218-45a3-bb5a-ba7cef38cc75", "value": "T13FC34C0675A144FCC156C474C77FA927EA31785D13303AAF7B84BA31AE22E355F0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996827, "uuid": "2d6c3814-ef07-4616-bd70-67c38c40b11b", "value": "3072:dV8OOTl5PL/AdG29A6AeyNi1s+eIgh/nG48mz:dV8v5PL4dG4yNi1re3/nymz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996827, "uuid": "c6edd6f1-51e9-4e35-a732-cb7c994ac35e", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996827, "uuid": "4e978b8d-4164-44ec-8863-94a39f2bfd51", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996827, "uuid": "5bb3ad13-84e5-420b-9e6e-473f400ff2be", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e727dff-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993958, "uuid": "3778590c-e038-466f-a9ca-b848cd612908", "comment": "Malware payload (Mirai)", "value": "b8ca7dc9c2494126efade9a5df80fbb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993958, "uuid": "d570c3f8-e842-4dcf-97a4-596648cd3c05", "comment": "Malware payload (Mirai)", "value": "550fce501099392de8e538fa67760f559fbc17503833b5c4518f878b3185ccb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993958, "uuid": "ca26301a-418e-43ae-be6a-9b89e2280d79", "comment": "Malware payload (Mirai)", "value": "e26b330a113b00da5a777637b7d9b1ecc542e10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993958, "uuid": "5cbefb5f-301d-4fa5-92ec-8da3082d5424", "comment": "Malware payload (Mirai)", "value": "005e8165dab24f1de33cdc0deccddaa5c3ba97986db01b083750df107fe6e3078dc7c40ad0c7074597bc9dbcea35ad8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993958, "uuid": "b9d546c8-c8cf-4e50-a676-ddeec1a1e54b", "value": "T1D6148E01FB081913D1931EB45B3B0766E379988318B9F019190E7F565733AFB9AC7B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993958, "uuid": "7ff5cffd-a142-4634-93b5-2b3cc1fb141b", "value": "6144:8w07lcEqVY0YwUymIAoAI+io3tQdnSLZbuNLG:39EWUpFiyGYuLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993958, "uuid": "5502f6fa-703a-4c47-85bf-39273156a9c1", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993958, "uuid": "47efda6a-9ff6-4f00-86be-7a549692ea83", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993958, "uuid": "2fecb1ca-c90d-410c-bf64-58fd49a9c43e", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3882261f-9196-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786020980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020980, "uuid": "a6d977e7-06f3-4a81-8c2e-4bab462016c1", "comment": "Malware payload (ValleyRAT)", "value": "2b1caed38122d1e0336af79b88c5801b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020980, "uuid": "80ff39d9-527c-4820-b9b0-406781816420", "comment": "Malware payload (ValleyRAT)", "value": "552497b4c1f9b3cf5514ce59292a1f715f3673c375fd1944bb5930f646383e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020980, "uuid": "0f2f5a33-dc65-4876-88c0-2b9fa68e5be4", "comment": "Malware payload (ValleyRAT)", "value": "3249538fbf42402e1e5bedddba234e1755b3e975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020980, "uuid": "f3559c9b-2ddb-4827-9b57-1db7075c07eb", "comment": "Malware payload (ValleyRAT)", "value": "435c979d08bc1bb6544f17ad7b4c4cbd9557ccf78cfb8ad8df5f9dc7ebb74806b7635cad7dabb2d338aa827de8046aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020980, "uuid": "401c2a43-7e37-4e41-9a31-9d1808cdb4ec", "value": "T1C5F59E39AA6D02E9D0FB91F4D5296667E178B414233056CB278007FC6B23BD1AF763C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020980, "uuid": "04fbfc8b-1ea9-49ad-8d6b-7cad9a0a4ebb", "value": "54fdff09040d457707bd96611819077b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020980, "uuid": "06ce20fe-c72c-4d65-9d51-0ba85b71e882", "value": "49152:tQy8nitA1iSEVd5eo6ULSsm1y39qZOey8sey0trvktKq3UJZ8i:tQyc1iSEVd5eo6ULqZ5ox0dkgq3UDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786020980, "uuid": "1658337c-a331-4199-bde3-3acb8d71563b", "value": 3642729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786020980, "uuid": "3df519d9-6bb8-434e-bc6b-2b0d435f9f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020980, "uuid": "e33c6e44-9adf-4d90-8ea1-afae06a1ba85", "value": "md5__d4f3e1df9080be9cdcc6f8af7800a2e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e42be5a-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993529, "uuid": "7db14fc2-7aca-40e4-a2f6-5ec989678ad9", "comment": "Malware payload (Mirai)", "value": "175fef94c51d9fe3d6d712b456104138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993529, "uuid": "f5d5ff89-f320-4fb1-ab1c-387a14b644fe", "comment": "Malware payload (Mirai)", "value": "5590778f2300fb6e482ad9fb4aaded56888607ec5bfe8e215404692760877ff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993529, "uuid": "cf8181d5-a204-419e-8a1a-357b8bc0f728", "comment": "Malware payload (Mirai)", "value": "5ad02acfd92b2d97c5afa277b2eb8bb759a3c997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993529, "uuid": "0e792547-b0de-459f-b438-e83eb6332f5f", "comment": "Malware payload (Mirai)", "value": "d89143e2943eacd72f5d1cffe1d4caec9a6582f2863a33d491309f4b474876f19689c46028f9b025b600d806b1c14e51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993529, "uuid": "48f75894-a014-4e4a-9345-0eb0938b98f3", "value": "T1D04302A058C61D16C3E21171C7EDE246B9102BB53B3073342A5EAF99578680FFEF814B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993529, "uuid": "eea605a4-3cc3-4152-a17b-f04a6636cfd0", "value": "1536:Tn47cia83jYUfGzO574bMR1/j7PvVUBLEv2Ybfh:zTx4Mu1rrOZEfbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993529, "uuid": "f86a1b05-e6ac-475e-9d46-5a2a8df1e2a8", "value": 56436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993529, "uuid": "1d443f80-2eb3-4831-8a91-988e18e87d7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993529, "uuid": "efd18c3e-ceb0-4d8a-8526-99e82b553679", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6025349-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998830, "uuid": "a1ea3769-60c3-4457-8fa5-81b03dfe9204", "comment": "Malware payload (Mirai)", "value": "a059139bba07fcec6a9269f27e6cc7ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998830, "uuid": "395eac31-87b2-430a-8043-eb2776bdb312", "comment": "Malware payload (Mirai)", "value": "55ea1821dcb07f568d4f093caf4c438051fbd1e5bfe36cd2329efa1156241593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998830, "uuid": "e876c177-c5b5-4258-9250-9808cee07646", "comment": "Malware payload (Mirai)", "value": "b3145109fb3b90be203a6cfd871cba8d298b7de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998830, "uuid": "9c543549-2c99-4f01-8100-644baa855b42", "comment": "Malware payload (Mirai)", "value": "8935d2b398303eeaa6d108bedfcaca49e92556743e562ddfd523db95d6146ac9a6714fe0e31e0ef74ab01e756c18f3f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998830, "uuid": "68ab82bd-4490-463e-bfba-02f409e7d18f", "value": "T15894C4A1A41055DBCE1048BA7B2C8F7423822CB1C35B1F7D5A568959A2CF9CFF4C6BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998830, "uuid": "ae44bbeb-b7a2-43e8-89da-0d9ac9c96944", "value": "6144:Xx1aKtLhqzN1HxjUJvL70SdELxHBQRZaC+D60/06jI:XraKZhCN1Hxj0H0VBuZH+DV06M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998830, "uuid": "c535e301-60bf-4c83-bedd-eb9b43b35646", "value": 437256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998830, "uuid": "e9e8edf7-630e-4666-9233-9aa7ab4848c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998830, "uuid": "cf94974d-fef5-4f31-982e-7c1de7f00289", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac56a0cf-9132-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978225, "uuid": "b762cc0e-00cb-439d-b5b7-28ff8d559921", "comment": "Malware payload (Mirai)", "value": "13cd6fa2231bf79ae7dfc802baccebb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978225, "uuid": "5cafe41e-ea5c-4523-8a62-60d0b59a5ad2", "comment": "Malware payload (Mirai)", "value": "566e7e389cfed8aeaeb57badfeb406a7b1738fb09a4564a04b907d92f49b386f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978225, "uuid": "a1409f7e-108e-4728-b7d7-b512acc372db", "comment": "Malware payload (Mirai)", "value": "2ca195624b63c1819618561a25eeb7284ef80011", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978225, "uuid": "1128f895-454c-40fe-a307-e10490aa4ca6", "comment": "Malware payload (Mirai)", "value": "6356d8de8efc7e8bbcd7c94003f3bdadabb9f4355a698bbed16b57a26080910713da600b79e90e20eaad6a5f0aec71af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978225, "uuid": "c535294c-c750-4413-adee-9e1b33fbaac4", "value": "T11521834A50106FA2C629DF157132467C4103E2C9D2FB2EC4AA876A74ECDDBC5F485F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978225, "uuid": "1f5ed800-55de-4a73-9cf5-9b174a398fb3", "value": "12:fHGIC9+k9W8X2XzSlmSF/afzB8NLhfUZKJIKKZMMGlOaaR7VRIJ:Y5Tr/AWNVlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978225, "uuid": "88d65f6c-dac8-4240-b5c1-2dc59a55d826", "value": 1276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978225, "uuid": "4ad48a98-4305-4048-9e1f-65ddccbc3ec3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978225, "uuid": "a5406a14-1241-48c9-a673-19296209b740", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9623c83-91a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786028471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028471, "uuid": "d2a710bf-8cec-4775-9f66-5173c522f40e", "comment": "Malware payload (Mirai)", "value": "7aca0e31ca38572789d5b081876e51e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028471, "uuid": "ea24b12f-f259-46d8-ab73-84a8fbe44cbb", "comment": "Malware payload (Mirai)", "value": "56f17e31a97856091fbad7f186caa23ec11ccc9d03c5eaa5855a0fd9b2f5c902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028471, "uuid": "426121fe-e89c-49a8-8de8-34253ea2b68f", "comment": "Malware payload (Mirai)", "value": "b188e6ba0ec2a0b86825444d45c5f5df644077ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028471, "uuid": "ba238316-6814-4db4-bdb6-3067c3a7d0cd", "comment": "Malware payload (Mirai)", "value": "1e87f78154bee35ed4beb6889d434257231038c9b09cad69e83d55ed07056f87958699e1578d858514b85aa939aeab98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028471, "uuid": "6585a497-07a0-42ac-9c92-b3bb384070f0", "value": "T1B5B43B51FC419BA6C6D12ABFFF5E828C732317B8E2DE71129D154B2073CB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028471, "uuid": "42101b73-cce1-4cab-92f7-f57f032e6412", "value": "12288:eqNN4hKdJnMqlEJeDIzh8NFQ4zTPe5EdId+4RuIIFSpne:P8KolzYJaTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786028471, "uuid": "c059c07f-5141-49f5-8546-18ac3a10fefd", "value": 516320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786028471, "uuid": "21ddea7a-641b-4ccf-9113-175ac620cc0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028471, "uuid": "f9a04290-cd5b-4b0f-a3a9-9f3b9ecec68c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99022748-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979481, "uuid": "d064ed8f-1bca-4b15-9770-149a71619696", "comment": "Malware payload (Mirai)", "value": "fd6f57843dc972cde2020742d28fe910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979481, "uuid": "65ad2ac1-1b51-46b8-8152-8b9b31418c8b", "comment": "Malware payload (Mirai)", "value": "57255dd221323efff68cb3f00710edc4a6b404eb0561e49fa03d2b2b1dc1639e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979481, "uuid": "72a7cdd8-41ab-40a0-8f27-3cc1596480a5", "comment": "Malware payload (Mirai)", "value": "ea1a158d836937efbdd93de14deb474724e94a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979481, "uuid": "dbb19b6d-189d-4ba3-a179-9eed689af60f", "comment": "Malware payload (Mirai)", "value": "af4a3b3e7acfa38754800f25505f9744c7519d0c3f6c87982669928fc93a3d0c360ea9901b22891da68c1a502d677b8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979481, "uuid": "50384a99-cca1-4026-b66a-59accc91c637", "value": "T1535302DEB7CD9BFCD6BF047491AAF82F2428E67A12045CD5F7AC50FDB480E68101424A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979481, "uuid": "bac9dc57-4b1d-44a0-b8ea-c144095d37f5", "value": "768:lN+L/obPEAHI4Xm6JEDt6JCKClfzfLLRcTeexQ44nM3+xFmfX+v6QVuB/GwrcEgF:l2335cofjROe9vMvPlNqA+Inouy8DMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979481, "uuid": "b835fb1f-53a8-4048-9d28-17d6b807ab1a", "value": 61492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979481, "uuid": "e70829d2-339a-4fef-a1d9-c75516ce82f0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979481, "uuid": "35a78a59-4d42-4eda-b135-9703ba2da3a4", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bfa96e-9197-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021616, "uuid": "1de8755a-e46a-46b4-ad4b-a3f684cd5e3f", "comment": "Malware payload (Mirai)", "value": "3e7dc57f7f4afad554d14bde246227d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021616, "uuid": "0b2e32cc-7c7b-4cba-905c-161bb75d2cd7", "comment": "Malware payload (Mirai)", "value": "5726d54e763c5c754b422eee1dd59cf3635889c71b77bb4bb9fd46d8cc969e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021616, "uuid": "ac37b24d-b780-4ca6-bffa-09f5ce113c9f", "comment": "Malware payload (Mirai)", "value": "a861492c94e91e4ddaf74bd8dc8ce18b61154eef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021616, "uuid": "de15d2be-1c23-4d09-b381-f46690112707", "comment": "Malware payload (Mirai)", "value": "de0f5001c9bd2613e7501e2bde1e39e82d6710a3c96b661b40e03cf49b793d6297f8867d775154fb1a1d9883f11e00a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021616, "uuid": "9983a14e-ffea-4f80-9728-c68c5a8b8da2", "value": "T172E41B0AAF500EFBD82FCD3746A91B0635CC695733A63B363534DE14BA5A50A89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021616, "uuid": "f8612e9a-6b13-4e44-84b5-98354980dfd1", "value": "6144:54wZtYTVP3VkIcCjerR94mIuUOELbD/xgZnzY8YotopfiXjVJRKOARHQ:54YRBR9IuUOELbeF7W0jZKvRHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021616, "uuid": "1d933622-c8f9-404f-aed3-351378efd285", "value": 681352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021616, "uuid": "f10ff0eb-e93d-4997-b39a-9c72566ea67d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021616, "uuid": "7c0364ec-3383-4b63-9b2e-7eaabf9b1bbd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8056d25-915a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785995451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995451, "uuid": "0523b6a3-f477-4588-b43c-58740d5939cf", "comment": "Malware payload (Mirai)", "value": "6ec32bfff2acad081de5cfd51119086b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995451, "uuid": "f5996a57-87a9-4b01-80a5-bc87629176f3", "comment": "Malware payload (Mirai)", "value": "57a6606aa4794894d72be744994a892172e655fe6926a20b4737edb36caf3a58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995451, "uuid": "8bc44f8d-4985-4ac4-aa7d-b53de5d923f2", "comment": "Malware payload (Mirai)", "value": "789b41c18e1898a7ba2b919d7b32466a2a0c6e64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995451, "uuid": "117dbe3c-2215-4cc8-b3c6-98f9cbc8b727", "comment": "Malware payload (Mirai)", "value": "00b55e7396ebecb97f7a23ed442058712176ac4ac3e7642d7b171483e811de7f2aaf08d408f6bc9b8431a25d137121b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995451, "uuid": "29fd8a1d-4c32-4346-8052-f2ca918138c3", "value": "T11FD35B81FB87D2F1E99705B0001BB71F8B349D298124DF1AEBA92E31EC76706855B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995451, "uuid": "10155fd1-2c1a-4a35-94f3-f995fd76bfa3", "value": "3072:MFybYaBdDLxqWawg4nxaoymDYWCtds3gr7aTJThfNz:MFc//cWaD4nEdsmmvfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785995451, "uuid": "2f20d036-a4f3-488d-8540-57b31ac8ba5f", "value": 136572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785995451, "uuid": "4b56150d-4d05-4a33-a908-58f2cde5d966", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995451, "uuid": "c51f7bb9-b620-46f4-8a3c-414e0c141b87", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6667f555-91df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786052410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052410, "uuid": "00f2cc4c-c8f9-442d-8b29-ff482dda23f8", "comment": "Malware payload", "value": "ceaebe010931012da100e0f99cf1d4c4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052410, "uuid": "5c8e0c79-abdc-432f-960d-cbc91e7c5fb6", "comment": "Malware payload", "value": "57bdbf20404cb95dbe39e87043159e6caf2a44e1a8881775e465f68210bbe644", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052410, "uuid": "ab868ecf-abd1-46d8-9e3b-bb1dd233a444", "comment": "Malware payload", "value": "33c67444509a6dd48172b06634d8fc313e3a62bd", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052410, "uuid": "c1056559-00e8-4ee7-bb83-198eaf3e6aed", "comment": "Malware payload", "value": "8c64d475fa0ae7853167854eaba696125ec7d6185fe2266a8cb722ed196118c593f0f29157883352db3e7e718943db38", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052410, "uuid": "c6a06064-8aa5-4813-a119-7099939ed5de", "value": "T15C967B03EC9415E9C1AEE23189F69652BB31BC494B3263D31B60F2386E77BD09E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052410, "uuid": "c9a5e041-724d-4921-86b8-14c9cf074380", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052410, "uuid": "213936b7-6fdd-467a-a72b-dfdf032fcc0b", "value": "98304:6tg298ahqVvY0HqlUEo5TWdqZGGq8yC2Pjy1U:650HqXACPCYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786052410, "uuid": "895b4d9c-2941-40a8-b746-d829f4c5b13d", "value": 9312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786052410, "uuid": "41bb6cc1-a6b9-42fd-b9dd-a33cc5cfef10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052410, "uuid": "3668c08a-fb5b-458c-89a5-b34129f25bb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511370d8-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026175, "uuid": "544c1efa-58d5-4ad7-9b89-b817ebe25683", "comment": "Malware payload", "value": "e1f4e5a42f58eb7e72cb4943c304f715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026175, "uuid": "85dbd1f0-5da3-4318-a0f2-adb60fa9362b", "comment": "Malware payload", "value": "58c82c9228092f04aad7de7429f5529940d5d08ab8352691d68887ca24699e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026175, "uuid": "c76599bc-e7c2-44a9-9277-81ac5cc226d4", "comment": "Malware payload", "value": "eedd308951d5d7a246faf3fa939347c5fe89d3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026175, "uuid": "26438c37-5e9d-4d01-9d3a-3764052f9680", "comment": "Malware payload", "value": "8df17fa8342ec60ae6c815769f2fcce7516a4bc5f836b6df7b12392377ea2f443c10a31fa4ff6ff1279c92a78e6bd906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026175, "uuid": "6c92a046-953b-4136-b35f-adb2b943ebbb", "value": "T1DED52388BDF319B4C43AC7B6EFC3D46DB16A77858A328E533ACC29454E56004AC76379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026175, "uuid": "984b6380-7b03-4add-930a-e85afd9304bb", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026175, "uuid": "965c5fcf-0824-426d-a42b-72104b6795d7", "value": "49152:e8TP3y2S9+t3I+gVjgMUyJesOAhedhB/un+Vb6tefdMpvTAB8zce+KYsJK3dauok:jq2C+pO1vJehA+fmYbyefCpEmzceYfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026175, "uuid": "ea85eaa1-404a-424a-914e-e30cd3a88911", "value": 2973184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026175, "uuid": "14978091-b06b-4acc-8ff3-70e73dfaa4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026175, "uuid": "42222112-d9f8-4022-8114-273a15d32e89", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9f2b97-915d-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996610, "uuid": "01cbd628-152d-4226-a6a1-a0c4d7c657bc", "comment": "Malware payload (RemcosRAT)", "value": "1942b6e6bbf42cd9c88879921c9abed3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996610, "uuid": "749fb180-4c1f-4c97-a32e-f74918f55677", "comment": "Malware payload (RemcosRAT)", "value": "591c06caf5213c5c0ed508696e1eae0fd31c90928252f4bd053e2399d7a0027e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996610, "uuid": "1fb5a775-ae6d-4a4c-a3df-48546323ce91", "comment": "Malware payload (RemcosRAT)", "value": "a3b28dfc1aead6ea489c3c61335efad7a8c5c626", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996610, "uuid": "4cc16827-1617-4f82-91d7-d77e2678ade9", "comment": "Malware payload (RemcosRAT)", "value": "02ba62d864727fc536d73f5855b8978158fa1b9a1f95b87445f62b222d89fd10cb5d8deafe4198d617e1aa9e96aa5fbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996610, "uuid": "712dcafb-d159-4f10-bced-784d70307cd5", "value": "T15F25DBDF6BE33A8C2408B71AC9F9BD9D1842CC510452A07AAFB41BDAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996610, "uuid": "5b801ce3-ed1a-4209-bbf2-3a8afd8296ce", "value": "1536:Dtsn3lh5DDHCpQ1tdfO5OnlhtxprxcYUFk6Rrlh4gWKGscuxiB/:DtsnZDHCpQ1t5IOpxp9cYUFdDlascj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996610, "uuid": "26274248-5496-4db6-96c6-fb74df0c935e", "value": 1024021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996610, "uuid": "e375c45e-121b-4986-b112-05731d334ce7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996610, "uuid": "e47c533f-eb08-4ed1-8d63-5686db51fe81", "value": "DOC DHL 655.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8babdab1-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026703, "uuid": "7f31dab4-3451-429f-bac7-e6214863fe18", "comment": "Malware payload (XWorm)", "value": "c6c6f4d1d5edf14940ce8427e12d252c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026703, "uuid": "a2abce36-ff3b-45bf-bb93-32d03047c5f2", "comment": "Malware payload (XWorm)", "value": "5a39e0d2de10ebb4b2fe2ea71fcc53bc491985033004b8de96537896bc44dfbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026703, "uuid": "74145ee9-bcd1-4f39-9324-6676b079a894", "comment": "Malware payload (XWorm)", "value": "13b38ac1b8a5591fc67884043e28566dc7d20f30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026703, "uuid": "61dba339-d9bf-4ed0-82a9-ff548919b26c", "comment": "Malware payload (XWorm)", "value": "bf83f75f72966ebc2ebf5e3c646a4fd9cf94bc9f779c12527a912eed7420a2c52c7f9b0f6610592f5335a888c3300c66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026703, "uuid": "5961be80-ac53-41b6-9aea-e2dc70a339dc", "value": "T17235EADF6BF33A8C2408B71A89F9BD9C1442CCA50452A07AAFB417DAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026703, "uuid": "7d2f5f3e-2109-4713-80fa-4ece16324bde", "value": "1536:ScXGI7HdJAnMzYLIoP5+Vl0fE3gilmMpoPzXdaHY732lCRJWYkxf4T:NGI7HnOLxQvgPzXdag2GSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026703, "uuid": "f7ea5848-f0ff-41cc-bcbf-360656a4d935", "value": 1060235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026703, "uuid": "200417d4-c689-4fbd-893a-472317c4ce56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026703, "uuid": "b426e5db-b257-42f5-80c6-0cae68d349d5", "value": "product_specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984ea629-91bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786037462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786037462, "uuid": "6fa1637a-f693-4baf-9fd0-85e39b52ae1b", "comment": "Malware payload", "value": "b2ea51d4e2de8c3ff794e083623d5394", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786037462, "uuid": "ecb584a7-a79f-4181-b6ac-bd9499e92c98", "comment": "Malware payload", "value": "5aa0339a6544700fd9087b54b701c4f2d8ac19b2865dec4640cf97fc704cc8ba", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786037462, "uuid": "5d412713-296a-4bc8-90de-1301b79d260c", "comment": "Malware payload", "value": "2dacc786c5da7cb43518cbf6d432d61f06c160b5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786037462, "uuid": "e99eae9d-087d-4826-9e28-b80c341e2f60", "comment": "Malware payload", "value": "1da929aabbc8cccb6a6a12052716f31d1e33ba16d9800937df87e8139e0a3ad8a63d76c1644dc6fa5471d54e5e597f1a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786037462, "uuid": "a66e95b1-3ba1-401e-9a42-2cba945c31b8", "value": "T174A2F84A7A4D63B609731BF8DE876016FA20983F81651488FEEDC4C37F7D492A958E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786037462, "uuid": "3c99aa30-7897-4687-9741-7b1cc72c5b1d", "value": "384:45vZpmt/t/T/n/7/h/yMWTmCMhpjIQGbE9qj+sClS7lLPKTNl82wn3lFJIWqJ+3+:41mt/t/T/n/7/h/yweSA9PowyMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786037462, "uuid": "fb4db16f-66bc-41d3-a613-1b27af413da5", "value": 22011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786037462, "uuid": "06edcab4-bcf0-412a-bd49-4db07ccab787", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786037462, "uuid": "fc5bc447-b153-4cf9-bf90-ac41f3dfa9d7", "value": "ps_loader_decrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb22f20d-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050512, "uuid": "47d7b34e-7dab-4f2d-92ea-1be45f69ff60", "comment": "Malware payload (ConnectWise)", "value": "fe44783ba824629a0e2b909a6a9b80a2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050512, "uuid": "ef5f2b3a-278b-4a1d-9b48-60cb7ab2f838", "comment": "Malware payload (ConnectWise)", "value": "5b2d48b4ea0599e4cfa18fd532be04ce24fcb559d789432a64708feea05bf83f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050512, "uuid": "da68b56c-50e7-4eec-9bab-633a8b8b5f12", "comment": "Malware payload (ConnectWise)", "value": "1fbd1a082a9ee5c24578e77d913b6461c48f7411", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050512, "uuid": "3bb93219-3bed-4701-9745-1e2af123f5bb", "comment": "Malware payload (ConnectWise)", "value": "b466c3da9c1e9361a526e3d7c2e3fa0a3aac324a8c0b469cee2abf158e93710785c10742019a1367b40d6ec6b6769171", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050512, "uuid": "fe727ff6-385c-4b1a-9eef-6bd32172cba5", "value": "T12246E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050512, "uuid": "b005c019-6fae-45fe-b42c-4fb9539a868d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050512, "uuid": "7579d749-45be-48cb-837e-5c14a0d290e8", "value": "98304:qzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:qhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050512, "uuid": "7d0b5ebd-7648-46d8-badf-f89c1cf6a409", "value": 5641720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050512, "uuid": "44e0d06d-9fd3-48bf-8eff-e0bf4956c7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050512, "uuid": "b5ede2e7-505b-4797-9de0-948e7551ecc2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca748b7-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996345, "uuid": "af26791f-285b-4f5e-bbb1-28b371056ae9", "comment": "Malware payload (RemcosRAT)", "value": "22ddc61b7b5a71544563b5d0c640ddd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996345, "uuid": "5b2aae01-6ac7-4fa2-8057-57a105530fdc", "comment": "Malware payload (RemcosRAT)", "value": "5b6dd7d1749c50fd6bb306055f570f78e9fb939f2dc7cab54e1bb69b8cbb269b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996345, "uuid": "90f5951b-cc2c-4aa9-b9a5-877bede2415b", "comment": "Malware payload (RemcosRAT)", "value": "724c180d2e68da7394c96f3f7e107edc2ede8da0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996345, "uuid": "86efbd0a-3c66-43ef-8a0a-fe3bfe3b2269", "comment": "Malware payload (RemcosRAT)", "value": "e511c20226a7f62f771c6bc3ccfdf003f177c66ca595ae1a9f05308e888ce2f09c53c032298ecd4f0deff5cf1a3fc0d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996345, "uuid": "8841de17-c687-43a4-9a38-d22c54de662e", "value": "T12E258E4D9522D9B576984FF12C5E4CCDF15B5FFD8CFA662E1018E090783312CA2AE87A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996345, "uuid": "4676ada9-bdf5-4883-b90f-9f8d8aa4654d", "value": "24576:v4dpUxFgVK8qj5fPaMbi0kwsEicY6rW1ncOvGCVLj3FWs:wpUL5BfjbrkzUK1c8vpj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996345, "uuid": "ba1280a7-31d4-4456-991d-d60e5e5f4283", "value": 1012862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996345, "uuid": "e3fbe757-dd7d-4ce5-89b1-7fb731c303bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996345, "uuid": "f1069f3e-2052-4008-bbf1-0363cdd25c5f", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5377805f-91ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059250, "uuid": "02d03c07-d8ca-4fdc-9378-fc82c548bdf5", "comment": "Malware payload (Mirai)", "value": "b53626b25238a22e73e57eb5956bd2d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059250, "uuid": "17d937cf-06fc-467d-b4ab-b6a285d27d69", "comment": "Malware payload (Mirai)", "value": "5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059250, "uuid": "a8b6e122-ebcb-43df-abea-41d3c9194e27", "comment": "Malware payload (Mirai)", "value": "047bfab761e1a2d47818f94408a80d118e67c192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059250, "uuid": "b62e3d83-91b0-4ec6-97c9-baf8e040d96d", "comment": "Malware payload (Mirai)", "value": "22e823953578634201cb8ae0daee9ec5258925d98bc1db0c0123ee7dea2bb3a25db13c19950cbcd46686dc76b062efa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059250, "uuid": "4678e3d0-6114-44cc-bb23-7fbe9bf0e341", "value": "T1C78312D9DC6756B1F657BAD3082C6FE12A42C0AE5E0C51831F4873A14E86DDC9D36D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059250, "uuid": "9ccbd994-ad0a-42ab-bab9-84f8610d21b2", "value": "1536:p2r7eCANVC3phe+ThBwhPhomPMjoQD0QrxUI2dJvmQNvYiZDt9L8uojWxUXGuIjN:p2HeCEC5nLW50MQFrx4JvmmYiB9oYOGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059250, "uuid": "0b450304-c7cf-45f5-a9d8-dcd1aabbb9f1", "value": 84496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059250, "uuid": "eef79447-88f3-4990-af8e-3abb64cf81a9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059250, "uuid": "f858b2a0-e6f7-4079-8855-b1793587cdda", "value": "5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccd88f9-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786027269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027269, "uuid": "ca4ee368-0c59-4c2c-994a-f3bcf55d1d7e", "comment": "Malware payload", "value": "a62012dcc8e0bb09d3b31c8a6366a0c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027269, "uuid": "923b488a-f176-42d4-b36b-d30a87659bfd", "comment": "Malware payload", "value": "5bac8a83b38ee26e4dfd153e80830c627aee438938b0edc8ce05c618ccccd4fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027269, "uuid": "704abf11-17a9-419b-9a48-bbcc85895858", "comment": "Malware payload", "value": "5b36c775a32eff123546a413df14658fbb055a82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027269, "uuid": "f92b7cb4-ef24-4381-9b8d-ba885e785f85", "comment": "Malware payload", "value": "cbe10a527498b8ff9e700106ca6ce4c1b20aba4781624cf4e6e3e604ce38a44cc6d3dc8e614c42b5d0ace76e6e2d5ada", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027269, "uuid": "18fa2651-96c9-409c-ad63-56359d2162a3", "value": "T1FF235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027269, "uuid": "5f7291ef-338e-49e6-95ae-dc234788548f", "value": "768:3+L9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3+8cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027269, "uuid": "3452f013-9496-4860-9695-094bd916d27c", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027269, "uuid": "7bd9c362-81b2-4b3b-9523-55c226f8f750", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027269, "uuid": "c71765ce-5a30-4073-9ab2-abf6473cc69c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b683bd1-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048983, "uuid": "04da58de-7cc4-4608-8aee-a7192da8c4bd", "comment": "Malware payload (Mirai)", "value": "0f609f7aee33e265bf58d2a1129935dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048983, "uuid": "69f3d2ae-c2fd-4cee-a6f0-e313eb8a5d3f", "comment": "Malware payload (Mirai)", "value": "5beebe7ca6f753ab031772b9d32eddadd340355bab04fbea4b19da9d32e23fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048983, "uuid": "c8723ea7-ff04-4766-a922-c5216de08706", "comment": "Malware payload (Mirai)", "value": "e77f8b80d387c9587a4462e5ed06a934d66c17c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048983, "uuid": "209d9ff9-38f5-45e1-b58f-d72073e6d645", "comment": "Malware payload (Mirai)", "value": "23f51e67bc185c6e90c132b6e435299090e15c6e04c7961b996cb5de422a6b962487bf92943de4f8a1f48b49c051639c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048983, "uuid": "67c68964-ec51-4525-91bf-404e5c8f5551", "value": "T162148D68FE4F68D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048983, "uuid": "e17ec0b7-cc69-4fca-a5e2-5173a9662422", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxB:bOVfbEdxm4iubz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048983, "uuid": "e19340b3-84e9-4902-9037-15ad75a1af40", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048983, "uuid": "ca5d6f0a-93dc-436b-bfbc-6a65f96421c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048983, "uuid": "6b13b84c-81ee-49db-b2ea-51ad999f0be0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da74e0b-91b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786035162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035162, "uuid": "b63b75d7-5473-4484-9d02-8d0b8b4f4234", "comment": "Malware payload (Stealc)", "value": "6d3ec0d0e31dc8d2e52d545f317a88fa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035162, "uuid": "77562437-f9eb-466a-8168-e4648f1cc416", "comment": "Malware payload (Stealc)", "value": "5c113804b804fb934afe84965e69a2bd912cef31203b2e4f367d8986b8783c93", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035162, "uuid": "2d57af76-cca7-4dab-97c3-a72a78737d40", "comment": "Malware payload (Stealc)", "value": "f8f6dc9dd47c48a9e3ab66cf07bea628e4c06b34", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786035162, "uuid": "d16b3da6-0aa8-42e1-b01c-e74f547ed691", "comment": "Malware payload (Stealc)", "value": "5ec787a1bea6528283fd37928a43eb4f8cee2f70c9c291416c9ffeed44dc6f94872c3a72d460f4da04da8c210e6d5e49", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035162, "uuid": "e7d57731-b3a8-4072-9e7b-e3b060913ec8", "value": "T1B9968B13AD9148F6C099A731C8B74256BA70BC4D4B3523D32EA1BEB82F727C16E76750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035162, "uuid": "689cbf99-c095-417d-82ad-172dfe0e4f6c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035162, "uuid": "15f1838e-68db-46b2-8787-a1087fb98caf", "value": "98304:iYhWGQAd48yxltJMYYXyWgq8yKUU6FlvTAHSxXyhq:iEQsTyxlrYBgp1Ubr8SxXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786035162, "uuid": "54e3e9db-4c02-4a8a-90a3-f4c0bbcf0462", "value": 9382240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786035162, "uuid": "b6454a2a-1989-40d3-938d-0912696df461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786035162, "uuid": "86678a4d-1d7b-462c-b140-718fa03ad152", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aade2c7-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994489, "uuid": "718a89a1-bae6-4a25-b9c2-57a5822853a4", "comment": "Malware payload (Mirai)", "value": "42c4b95e5a78f5fb25cff58547b62a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994489, "uuid": "055f06d9-2492-454a-bf33-e675cb647258", "comment": "Malware payload (Mirai)", "value": "5c45dce64e3af6c945e0ba8e48144e9cd14b3f7b4595eecac543b6eb5548c31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994489, "uuid": "ec9baee3-865b-4060-8967-c129cecef8d0", "comment": "Malware payload (Mirai)", "value": "0522fd3b841932cb75036d5352f8e7d8c255a3d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994489, "uuid": "689e4ab9-f7e2-4c01-9b91-62b3a0b7c3b4", "comment": "Malware payload (Mirai)", "value": "8fd17dc8998eaafcad4b06c6a2a0db6affd12016b252a507c3a23f6a0dfd1b833f3ab5d56210e688425fb399f82b56e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994489, "uuid": "af0f551b-8cf6-4ab4-9d9e-74387aac75fa", "value": "T159E31856B9519F12D5C321FAFB9F814933136FB8E3FA3102DD246F60238A99B0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994489, "uuid": "23a019c4-4676-4188-a0f4-6db06b0225ed", "value": "3072:yL+HUM4LD4anyQbl1X7aal+FaeIifYIVA6Zs3XvaYFq9x3PUVPs:ys74LDZnyYz7nUaeIifYIVA2s3yY0/PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994489, "uuid": "fc407812-73f4-4bff-8ff3-7e2278376487", "value": 150308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994489, "uuid": "52756308-2261-4376-ba73-50edaab8b361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994489, "uuid": "3499c45c-b1df-4dd1-ab61-0e61bb6601ae", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032f3db4-919d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786023897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023897, "uuid": "428514a1-4bc5-4a02-ad02-c963ae6d6607", "comment": "Malware payload", "value": "edba0411ed6d877a31fb5008398598d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023897, "uuid": "3cea6493-a3c4-4b2c-b160-e5573aee2eaf", "comment": "Malware payload", "value": "5ca996e9664fa0e9d37fe47a30044123599e97b93781c708e79009ed6cfe9f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023897, "uuid": "9476aa00-1272-452d-955c-59bcf457b6e4", "comment": "Malware payload", "value": "9df4493d696a93d3963fab779834654141531e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023897, "uuid": "52c5015a-ea2f-424f-a143-b2c94943bc74", "comment": "Malware payload", "value": "033c7dc4e4dbc55c1f84b8cb13139ba7864e7b66beb87c4f5496c4af368c1cb5d081097c8af70aea25ebc2e3bbe1528b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023897, "uuid": "e2c2048b-d969-4ce9-adf7-9d4a4a5c4394", "value": "T1B3258C983115F59EC8178532C9A4DEF4A7507C66C30BE20390D73FABBA3D99B9E141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023897, "uuid": "f556ee22-0d94-48be-b722-d0398deb0bfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023897, "uuid": "b95f372f-2858-41ae-8cac-2d281dad1f22", "value": "24576:3AmWesmJYtUiJKAfz/40xVG+X61jYnJf:3hWe3JYJJKAT5G+XUEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786023897, "uuid": "f029eeb4-aa4e-4e43-b21c-9e43ccd7d21a", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786023897, "uuid": "e9dadf85-c763-4a1a-a598-f8e1f3ef9d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023897, "uuid": "e98d45e5-4fd6-499d-a9f5-18df364a91c2", "value": "New Order B20262745 RFQ.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4889f055-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048065, "uuid": "ec2fec5c-25f3-477a-96b0-71c11e21fc77", "comment": "Malware payload (Mirai)", "value": "412037aa285bdb1fa8a352b07688fcf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048065, "uuid": "d53b8382-043d-4f95-b50d-e789d2c2b7d2", "comment": "Malware payload (Mirai)", "value": "5d6002b10e24b0dde3ba76501b0ebb6f83c50b55aea75b789334b8ee4a75c29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048065, "uuid": "1fe5424f-acbe-4c14-9d30-f704a01fef10", "comment": "Malware payload (Mirai)", "value": "89adc72cac10d1cf22487c90cb7784c787c1fe5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048065, "uuid": "a710f9b5-406d-47e0-b153-1d7ac494dc7d", "comment": "Malware payload (Mirai)", "value": "f32070dd5f82b1137e73247b9dda42c60abcceb81586221906dc70be3c49f29dcd39ca72b67fd07f086adfb879695502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048065, "uuid": "4448a7ac-54ac-4f77-9609-a112ef9d5d6e", "value": "T177F34B13A48080FDC49AD27447AFD137FA72F88A12357B1F2F906E712D2AF61671A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048065, "uuid": "51355595-e82e-4028-b928-356ca825d68b", "value": "3072:UQv79wlHGPj+92kCSsDr+8Tb8bIkOu0knGyNr5bFP:UGaCxf75kOArNbFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048065, "uuid": "8892fa31-ba4d-4b2c-8660-092c559fdf0c", "value": 157824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048065, "uuid": "5938f0aa-6c5e-48fa-9bda-b9e197368fe4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048065, "uuid": "aed11cc0-91fd-4320-b523-5528b7d813cc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8f3297-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983917, "uuid": "575ed47a-116f-4e7f-826a-3bbeebbcae68", "comment": "Malware payload (Mirai)", "value": "d6554d2f05a8201b908211b1c43b0a94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983917, "uuid": "87b509ed-61be-4bf2-b52b-3e305fbdee28", "comment": "Malware payload (Mirai)", "value": "5dc7cef8a389cbd45cef863b10f2657e471101c1b4db34acba289b33066886ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983917, "uuid": "3a87007c-7598-47b4-8e7e-d0dfa2a84dea", "comment": "Malware payload (Mirai)", "value": "2aeea2d93d31481edf1ae55552f8c9206909c17f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983917, "uuid": "fea54350-2cfb-4509-a510-a089c4eb6d0d", "comment": "Malware payload (Mirai)", "value": "bed64bd0836df62441a18416f64f1e473d79671d562b3795a0205da2dd36d9910d24dc90c8fd44d83cb951270c4c59ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983917, "uuid": "95a3885b-9687-4de5-b80c-335b78549f1f", "value": "T16163033AB3E54B9BCBCA5D7FB45B1723E50852F310D897AB49028D4C4A9453B783E81B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983917, "uuid": "2185a9dc-8179-43fc-81cd-80253562091d", "value": "1536:S5nG3+T8Pq0FoEoXRzIIKNSNrK+ej/UJAzYPD8CfZoT/692Naq:S54hPqZzV/rGdknu/tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983917, "uuid": "3abfff58-5db5-4e80-a732-ceb5390d4b34", "value": 72360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983917, "uuid": "6c7e43a5-4eb5-4862-85d5-8eb2d8001079", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983917, "uuid": "cd90d1e4-ec3f-473e-9d9f-da74f7d0b7f7", "value": "killbotx.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0814e6-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045551, "uuid": "7d7af578-3681-458a-ba67-946211687028", "comment": "Malware payload (Mirai)", "value": "41b793a232e301e966e1f3c40719dd0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045551, "uuid": "adfeee57-d402-4cee-8d53-6e04f4231b9f", "comment": "Malware payload (Mirai)", "value": "5e6b66f119f0e9a7c8572a65b2dfc2cbc507dec8cc5542fea370155f6955b4d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045551, "uuid": "b0e86bc3-38cb-40d7-a144-2b0d8e30d9e3", "comment": "Malware payload (Mirai)", "value": "072bdabe96b730a9963b7c9f40ce017b56b3de12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045551, "uuid": "911180c0-1ffd-4436-9081-9028f3d7dd7b", "comment": "Malware payload (Mirai)", "value": "8ada944b8d2b027d517fd9112679647776a7abf79a3460c42b2e2c39a8e9144fee409d38cd8a083a49cb10948e5c3066", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045551, "uuid": "8cd90512-f668-490e-8cc0-9f253a3477c4", "value": "T1E4A3C60D2E215F7EFBAC823857B78A21A64833DA3BE1D5C5D19CEE001E7024D645FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045551, "uuid": "41c5f01e-3616-4acc-9bbf-2d46c3cf4716", "value": "1536:wP3N+wUSi3Hzp7hYoKF2fDrYW1JAluRhpwj2EzfTVKekZ0JD/r:qLi3TpNPbEWUuRhpwj2EzfTV00N/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045551, "uuid": "a5767cd4-d0ce-4a68-aeec-f3891e644c59", "value": 105636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045551, "uuid": "b9eb5611-e0d1-4574-97cd-6eeba1694c1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045551, "uuid": "05ee1668-06fe-44f4-b0d9-d92a68a7f1a0", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607a4728-919d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786024053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024053, "uuid": "f7a44347-eaef-4d7e-976e-294ea5345b82", "comment": "Malware payload (Mirai)", "value": "2850bcabd265dc7781af1dfd59c2c1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024053, "uuid": "79a08ed7-9c88-4b5d-ba79-729fde959981", "comment": "Malware payload (Mirai)", "value": "5f22c8e716abde3c060fe9c7c11177208672285679a5808c4eb4e42913830b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024053, "uuid": "dd893253-10d4-4191-81ef-d47498247190", "comment": "Malware payload (Mirai)", "value": "db90302b13ed34a53c3945ca87ddefc86a282b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024053, "uuid": "0e0f656e-49a5-477e-bd76-04aaa5975b5f", "comment": "Malware payload (Mirai)", "value": "fbc7dcbbd2a1663e81f5bb4d0be0efa7bff3ae0445c8a17d58a73854bf0059bdf74fe5184fe5a705f5f0671b9adf014d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024053, "uuid": "bdb94e24-1075-44c1-a43e-3c6c7b2f8bbe", "value": "T134C32902B70D0F43D1232CF02B7B1BE1879ABEA215F5E584751EBEC65275EB12242ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024053, "uuid": "b139b3a5-267f-4358-a78c-fbd9ee43bd35", "value": "1536:MjUjyVAMPhxYavR6QhDZ8+1uZFheYlBtMOqbwGjdUzaiOvJjBaweM1ci+p0W6a8r:njqvPLV18iu4ssdagNBci+2WzWOiU7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024053, "uuid": "3157932b-a5ac-4f3d-b5ac-9f06e6ec9ca2", "value": 129716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024053, "uuid": "390ad5fe-2ade-4b4e-9714-545f960bfcf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024053, "uuid": "16f21cf5-f4cf-4b27-a4fd-79eecd4d53bd", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d1e15d-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "3e1ecc92-d062-42dc-80ec-f12ee7c8e329", "comment": "Malware payload (Mirai)", "value": "acadeed043d9fd1d52ae7af652cafd6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "01f877c5-44d6-45a3-a37b-0f96f270d75c", "comment": "Malware payload (Mirai)", "value": "5fb744c3983421724443599492d9d5f0667fe1fbcb8a80f0879488983320f06e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "191aee3c-60ab-417b-8927-dc5c55564ac1", "comment": "Malware payload (Mirai)", "value": "9a3028282e3a2125bdcde270ae90df8839777d20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "5f2309fd-91dd-4336-92f5-ea2d13f366cd", "comment": "Malware payload (Mirai)", "value": "1e3b56fb301b738e16ead321e3bfda3a1dfb9a18cb9c78712527408d4e34c5777a36e261dd49eeb3a17a823fe94bddb7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "99a2ec88-eb99-4c30-88d0-044bad5793c0", "value": "T15314E946BD519F23C5C311FBFB9F429C3B2667A8D6EA3102DD256FA437864DA093B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "3b48ba9f-4531-41ae-a262-40de7b7bdccb", "value": "3072:/+ajkQJQMtbE3bDAjg1Yct3TidXTNrkR6CA5584wx1Kjh7nGPdL:xJJJsb081FVedXTNkR6CAP871Kj+dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050577, "uuid": "54750859-fe00-486b-a2fb-f78550225175", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050577, "uuid": "4a9a3b79-5539-48ca-8eac-511bf25a20fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "54d9b549-243a-48d4-b5df-9d203f7490fa", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48914611-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786027020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027020, "uuid": "8feeec56-ec98-47d9-9587-7a5dff97bf7b", "comment": "Malware payload (AgentTesla)", "value": "c4151e8d1c19dc549be5ffd51638bd14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027020, "uuid": "3e33d487-ddbe-4493-874f-25997d5a806b", "comment": "Malware payload (AgentTesla)", "value": "5fc8146428d65afc46a1138d4fd7f9cf50b3f1afcbe444659dc6e29cf60b1679", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027020, "uuid": "f7d200f7-3c74-4d7f-a64e-7f071ca37d14", "comment": "Malware payload (AgentTesla)", "value": "a4aa7aef1ba06d804c8a70edf700eab360ddb8b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027020, "uuid": "b74dab51-faef-4f33-a841-0725769985f7", "comment": "Malware payload (AgentTesla)", "value": "a1283d11c6cea2e948f55b2b4bd0a0bbe4a46c6b07d0a73f83c4ea94a9fd3fa855a7978b3f5e745dae6d5f8ec52b3003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027020, "uuid": "738ee03d-8e8c-42d4-8785-c37456d3b59d", "value": "T176A5F8F2377F6A4D1E16B356948D11A18F5E903555D3E2E4F0CE03E81B4F989AAC0CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027020, "uuid": "d83d6d41-de7f-4045-b883-830db4a3b4d3", "value": "12288:gD5g0uz9OCZgl4OKR6IAU1i6Ah7iAe6YUCkdOay9q8z+7pgy4EmQTdhJsBNWiOKV:g1g1HZtR6IL1d6Z4EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027020, "uuid": "b38d0339-08d8-4f50-8f2b-04b8a195a298", "value": 2218413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027020, "uuid": "66a8c86f-8bb2-4546-9128-428d3162c4ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027020, "uuid": "de48180a-00c6-4091-859b-6d6b0214976f", "value": "Urgent Order #PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b18b2b-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022155, "uuid": "7611b13f-3315-4490-a553-14432ddf51ec", "comment": "Malware payload (Mirai)", "value": "8b52e36f97da948816a3913aaaf4d4ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022155, "uuid": "22b371c5-0f71-477c-a1be-42976041546c", "comment": "Malware payload (Mirai)", "value": "5fdde879e2d203e52b76780ff8320d24939712bd86fa1784f4920b5bb2cfecb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022155, "uuid": "974d4f3b-61a1-47ee-9e31-75c37aa6317f", "comment": "Malware payload (Mirai)", "value": "3bdb0daa2e9a9a494183376f82c85b2c5dd51a7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022155, "uuid": "615534e8-39d3-48ce-ba54-257e57744b6a", "comment": "Malware payload (Mirai)", "value": "1937627712690fd29a32a9f193b3116ef49f8b36b4312a7410924dd8900f57285a14c399001f3b3a722d71ac6734f631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022155, "uuid": "20f8028c-4ccf-497e-a755-13d15a4196cd", "value": "T14823F998F8449635CBD475FAF90E43DD33024FA8E2E671118E21AB313BB79194A3B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022155, "uuid": "8d6a94a2-5ff2-4a97-9b87-57a346ae2a9f", "value": "768:Z1AOxKR/ONsvXE2WK0pFAusJIPl3pn8tb9JiSSQNfPsvOLH0jKp:Z1AtR/ssvXE2VKF3GIN3pob6SjNsmLHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022155, "uuid": "77f04dc0-9a3e-487c-96ed-5a7ce87d1b0b", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022155, "uuid": "e8c0572a-a5e4-431a-bfe9-8da45ea6972e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022155, "uuid": "b734c9e8-9ecc-40ac-93f1-c08e12a19667", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973e082a-9161-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998376, "uuid": "50befb8a-e93e-42d5-b9f7-b331b1cd5151", "comment": "Malware payload (Mirai)", "value": "440a99cb626cdd5245e4274a8e6b04db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998376, "uuid": "18d4267e-30b5-4bec-aa6f-9e463ddcc6cf", "comment": "Malware payload (Mirai)", "value": "603251bb94fd45fa5640ba7d3dcf17e54b565646019c1ec1ab7f59f38a4c0879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998376, "uuid": "c4ed584a-9000-4265-a9b4-96bce80d8284", "comment": "Malware payload (Mirai)", "value": "8854843906be3417f5256e50f79ae1b5c793216f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998376, "uuid": "0b494457-aa85-45bd-abc1-07884bd7b1bd", "comment": "Malware payload (Mirai)", "value": "0623654040424759273960a71de8887fd4608bfa73eda30fb7021b3d0e671ca1ff15caac732e454990625d46ca20b152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998376, "uuid": "0eec08dc-c17c-4d30-9a80-f04306c9b1bc", "value": "T140C32A9AF890DE52C6D52575FA5E018C332357B8C3DA7206CE209F34B7E7D5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998376, "uuid": "56b47c8b-70cf-48ee-8c12-43c6a83c4a9f", "value": "3072:BXNsOkobiEkmyVUQ4g8OzC+q+xS+5/JDhhds44f1DlH9:BdXPpyVUQ4g8O++q+9DhhN495", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998376, "uuid": "fa544821-b485-4249-bf6d-2c095d17c6ed", "value": 120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998376, "uuid": "73ef9405-080f-4762-9bf7-e82064abab23", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998376, "uuid": "ebbf101c-8bb6-4579-bfd8-cb1946bdcb24", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71189d2b-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048992, "uuid": "243b5188-a812-4890-9d3c-8090205811a7", "comment": "Malware payload (Mirai)", "value": "9f8e29e63a8b2c2701df4970be0c6034", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048992, "uuid": "2fdbde5d-32fe-4817-a7b1-8a5f21d84f8b", "comment": "Malware payload (Mirai)", "value": "6053aed50e7c0b84ccfcadc124ffb05ae884f14eb780afc3f9261bc66dc803d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048992, "uuid": "64345165-7678-4090-9402-170effb769b5", "comment": "Malware payload (Mirai)", "value": "26b76cf70397145553ed619e50482355fccc3df2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048992, "uuid": "f7dc088f-d999-4311-86b9-5c831b561717", "comment": "Malware payload (Mirai)", "value": "8c520785e98a10b935c9ae9138c300f1f7bc102136fef78a7163f261a060a36a6051cc7b6b49b140baf5d4e6d1cebf4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048992, "uuid": "50d1b5d5-13e9-4e8e-bf36-0bfce737d39d", "value": "T128145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048992, "uuid": "80e356d0-4849-4e7c-b20c-baa5c1c3c973", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXUUaN:HZ15BTYCrYq1QDY6l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048992, "uuid": "a55b115b-bfb8-45c7-8e4e-5274c834fb40", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048992, "uuid": "9600edde-1885-4193-a951-67d59adb0394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048992, "uuid": "5be857f1-7d17-4e35-9f4a-97d0980539f5", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b6408d-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048005, "uuid": "71b06fe2-8677-4217-92b9-2752e5b15427", "comment": "Malware payload (Mirai)", "value": "030395ad5cb7302b99553e0c7289a727", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048005, "uuid": "9fc00f1e-ad3d-477c-94a8-3f29363d2aa2", "comment": "Malware payload (Mirai)", "value": "6058c04395b017bcb68befecb58f2b8bbd60f57a53a2650285108a2c847b69e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048005, "uuid": "0ab7d949-5e39-4eed-8184-852b3c071834", "comment": "Malware payload (Mirai)", "value": "715701e0f7dac0a320625fa70ea9741c47046352", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048005, "uuid": "763440ce-2c7f-4674-9e37-39957ce724ad", "comment": "Malware payload (Mirai)", "value": "f66c68d693c8e2a5741298d67d180538e5ec2ded72f23df9f5c0fd925ddf6258ad58674438dbb441626208df2734881d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048005, "uuid": "f1fef31c-7933-44c7-bf85-3d8ecb939e75", "value": "T1B4A3022A5E8BC51BD7668C3D0C727770B6AA1FE844778D0772E4D872CD007A66887CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048005, "uuid": "a46bd01d-7e46-41b6-acb2-e1c349c1589e", "value": "1536:7GQr2Yg1gUK1Lx+mF/Wb+Lci+qP7U3F5NV9SsSjryqcJ0wmbcc1O2sz7VEW6:75Fwg5Zx+m0b+Lm3fFSsSv6741zsPVER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048005, "uuid": "c999d90a-0a9d-4f88-9483-d4299ca15e32", "value": 99880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048005, "uuid": "82ef063a-ba71-4041-ac6e-30a80c41ae29", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048005, "uuid": "ff381e50-66e4-4196-b4a5-3d133c2f74f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8a1f91-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004079, "uuid": "fb904eb7-87ac-42a1-9abb-bdedcd73acd1", "comment": "Malware payload (Mirai)", "value": "10748271079763d0c4bdbc7e3464d3c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004079, "uuid": "f5d0e965-ea89-423a-889b-965c5ecc9e33", "comment": "Malware payload (Mirai)", "value": "609d4dad043796f9be8db28cb3a7312c82c4478bb99f0db71d8b48f43db5ce54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004079, "uuid": "d82c899e-3eff-4422-a0cc-4d1671753bec", "comment": "Malware payload (Mirai)", "value": "4ffbabddd1a49903794887f7ff0fba62faaf1809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004079, "uuid": "ae6e97a5-0a1b-4e9b-b699-08f70c8fb97f", "comment": "Malware payload (Mirai)", "value": "dd275956dda243ce617f8559f8f1fc89dc438f179436e1fa2a27580372578db6378f4ca747acabaee6c276b1ab850261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004079, "uuid": "d929c4e2-5a39-4420-a1d0-3e2a8903f5cb", "value": "T163133BC0A603E9F4DD1A02B53177FB369BB6F03E1129DD87C7D9D973A882A02914639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004079, "uuid": "5020a23b-6e83-4761-8cd7-c6c732c0784e", "value": "768:cRf4XcNZdl1JhnZh0ozbTIrbEQO/vYg3wjBUm0DaMEe46R:8fymZdl1JhnZh0ozbTIrm/Rdm0DaME1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004079, "uuid": "0e79b673-6a1b-4557-8a46-e6a44fb49070", "value": 43644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004079, "uuid": "5765cb64-6bb4-4375-a046-b75f5e6cbcf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004079, "uuid": "cdf47e8c-f802-4977-8271-15f0e5d4161c", "value": "911f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49ab3db-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026852, "uuid": "42b60448-6bc4-4f69-a6e8-0c2a639f455e", "comment": "Malware payload (XWorm)", "value": "c8ebe975d818be21f3b78a3b1f36c71b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026852, "uuid": "56675a46-0830-465a-94e5-d108bafa16fa", "comment": "Malware payload (XWorm)", "value": "60b6d33f3c8e7321b712489c201910042b3f082e93ecba0fabb25ec1718c706b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026852, "uuid": "472e76c9-dc1c-4c75-a526-54b46781c227", "comment": "Malware payload (XWorm)", "value": "f3c77b751ea4cae5493652096b001ff06c8ed7cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026852, "uuid": "aea1c21a-dcb4-468f-a951-f592655e16b9", "comment": "Malware payload (XWorm)", "value": "c364b51c750370865443b6b1605d990cba729fbb435172ec8d2efd6891d2c71568f66bcd0e20e99e0f34e95d9fd1a8fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026852, "uuid": "c3f0a304-3143-4cb2-bc86-811d84e346d5", "value": "T1773588313AAA3A4D9BA62404ED180137E6E0646F63E71C0D7DBDF5E0156B98D76BCC32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026852, "uuid": "b2c43278-7e8e-4828-a9c1-c1e06a11db09", "value": "768:c85TaapKxYWxrTex0+HUKxHSuTT17H5P+xuTxDl8DQIx8HxuxjljwmxyH6llTxVu:vs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026852, "uuid": "42140684-1ddd-44f6-a009-6aa8ba20e24d", "value": 1077225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026852, "uuid": "508f19f2-eca9-459d-996d-f45ee4faf8bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026852, "uuid": "22c09512-b749-43ff-aa9b-41c4598066bc", "value": "Factura n\u00ba 1FVO12026001543.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf48356-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050488, "uuid": "7785039a-26c3-45c4-8941-3b276d1e09cd", "comment": "Malware payload (ConnectWise)", "value": "9f8c1135c656b7b91f1da74cbfee5ea2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050488, "uuid": "269d7be3-a1c0-4d3e-a83e-6081a55c5741", "comment": "Malware payload (ConnectWise)", "value": "60df12c872628826a9a5289474082ffe1ea55819133219dde1d656bdb0d502fd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050488, "uuid": "8fecd715-e8c6-4cbf-b16a-9712c32ae4dc", "comment": "Malware payload (ConnectWise)", "value": "e18b8195f4b99f8f4d4b2ab72f52ff479d26b33d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050488, "uuid": "6ed977f8-11b2-4822-bddd-bb4981a34779", "comment": "Malware payload (ConnectWise)", "value": "131d56a52a035419ae4eaa0a5dfe63343a8dd47643f1d07b830e08a5364ee9aed63125c72c429ed8f471dff863347ad9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050488, "uuid": "bf054015-4b1d-46cd-9e0c-38c1d4e7c504", "value": "T12546E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050488, "uuid": "ad9a0ce2-799a-4653-9d64-0b2af17b7f24", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050488, "uuid": "a45c87ca-0f5f-49fc-b6a6-d3c0190be6ab", "value": "98304:XzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:XhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050488, "uuid": "3ba4c407-3b6b-46d6-a0ec-cee7a4a8ddff", "value": 5642944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050488, "uuid": "fd1a0d1e-c43e-413b-a452-ddbe40af158e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050488, "uuid": "5c512c02-13ef-4db8-821b-8981d79566d7", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b69b2e9-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048929, "uuid": "94c01dc8-ec5e-4df6-b5ea-c9d15daa85fe", "comment": "Malware payload (Mirai)", "value": "b018d46246d471da2bb6278c299659c3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048929, "uuid": "484a3c6b-ac12-4d7e-a3b2-8c0262605f26", "comment": "Malware payload (Mirai)", "value": "60e8ff4261fe1a1193498a25d182d041158d5e8af1a960eae89a08d72ca37356", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048929, "uuid": "10dcbdf1-193f-4d8a-ab70-b6c9ec8967c7", "comment": "Malware payload (Mirai)", "value": "47bc746f19fdf2948af4594525aee677e23033ac", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048929, "uuid": "c80105e0-92da-49a2-9203-5d19371a81aa", "comment": "Malware payload (Mirai)", "value": "82e22805fed93e82f71f095a0d26333763cd51831a3cd3c98e41135be522327402553f3127172fbc1aedd40d1d1ffe3e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048929, "uuid": "72c09950-a298-4629-88f7-09997bfdc2b1", "value": "T1D2B3E085B210AA55C02672FCB1870990E3B17E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048929, "uuid": "56730153-9f35-41ac-b12c-65006f4fe02d", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuP:as5zqhr5Nzy7w8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048929, "uuid": "c2fbc62a-e329-482c-99a7-9ed487b364e2", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048929, "uuid": "2c02d071-b388-4f4e-bb8b-13c11e6a3115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048929, "uuid": "cc423ce6-3ade-4ad5-8c21-d2f4242fa3da", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c994c746-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005332, "uuid": "6226c1ba-991d-4447-be23-0eb1390d240d", "comment": "Malware payload", "value": "0275af680544de962bd9085be3a5b565", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005332, "uuid": "1d15707c-fc26-4b97-b8ed-8c45a7908861", "comment": "Malware payload", "value": "60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005332, "uuid": "472697a6-2f97-4e8c-81d9-4235dc470648", "comment": "Malware payload", "value": "d5ed4ca73c044512aa3c8a7349ce6f11b7d81201", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005332, "uuid": "6fc0f6e9-e380-4450-96e0-e09f2b091fde", "comment": "Malware payload", "value": "3573ad6bfd296b0cad1270789fec6aca481ddc7689f8125a636041a4e7e439920572bc4d2c3c664975d405861e7a230e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005332, "uuid": "deef97e9-35fb-491a-b86e-de582a81e92c", "value": "T1C035EACFA3710D1C648A7A0FC8386E8E7A57CF930510BCBABDA45947D50C64253B9B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005332, "uuid": "817adcf1-9a88-490b-9b69-f6b2f3261976", "value": "6144:z/3KQUUcBEneCb8fpTCuHYVVgIqqh91vXYbdUF4lwEB/:bKZCrw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005332, "uuid": "061ec60b-0405-4e77-862d-3391bb2087e6", "value": 1059889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005332, "uuid": "50a5c523-9cc1-4809-a366-f3ee946aac3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005332, "uuid": "6081a773-4137-445b-9bea-2b5fe9e175da", "value": "RFQ-2026-00806_Supply.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ee19c1-91ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059275, "uuid": "c7b3dae7-40bc-4edb-b843-0e88b01be28a", "comment": "Malware payload (Mirai)", "value": "2ee58d073a67f2e1837006815a43a0e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059275, "uuid": "017eda7b-266f-4b99-bfbd-52e1fb10f527", "comment": "Malware payload (Mirai)", "value": "611c02afa2bc725622b7c5154f69b4d5b4f409a46f93ba67dbddcb224d90efc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059275, "uuid": "dbe14522-1fd1-4bad-98fe-799733723580", "comment": "Malware payload (Mirai)", "value": "7d34bc32c19d3be303df71e3f5bf007a0326e8bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059275, "uuid": "69fcc473-2987-460c-b2d8-89e1e4d2dc2e", "comment": "Malware payload (Mirai)", "value": "e2db7e8126b8e04ae9984c6f40832695510d679713f686bd3485713c6e72d48d1b5bf82a4d10c1719bdb87ba027ef6fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059275, "uuid": "42d992ca-4d4f-4558-ab0a-14308e823ded", "value": "T19A042A4F7721CF61C72CC93009B3CB4656E522522AE18889F31DDE08BE65349A96FFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059275, "uuid": "83bd6c7e-33fc-4264-8d49-36e1ac22724b", "value": "3072:+2vvDpgOZfcLfjZaiNxX/iU8hOjQDhd8r570qxGKdSPnlf1DgjjF7:16PivhO681Z7U/l9qjF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059275, "uuid": "b5c7da92-f6f0-40cc-8d2c-08191c9566e8", "value": 185240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059275, "uuid": "be9ba5ba-34f3-4bf7-b46d-88f99a551621", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059275, "uuid": "b5fb63ae-a9a4-49a3-935a-cec85cbd5f63", "value": "5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d88aec-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "9962ebc0-dce3-4719-ac3c-68f79612cb66", "comment": "Malware payload (Mirai)", "value": "9c46c8f13cd7fa9dd1bd2777e8055a56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "e785ec0e-bfdb-42f9-b5ec-3162ad30d402", "comment": "Malware payload (Mirai)", "value": "61c14afa6a0e10bc6bde13bcc16b14ee0be3eaa843306f8096438a2303496e8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "9ecfb790-b8f9-4007-a0fb-7419ff7fd799", "comment": "Malware payload (Mirai)", "value": "95a15966d0cc5bb1de0123dd09a6d637d9a2158d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "06fa0a8f-a73c-4c06-9deb-dadbe622c698", "comment": "Malware payload (Mirai)", "value": "88c60eb3ebf2d0afa747f66c9c17c147594560b5870d894cc0895810d11bc0e8bcf58d6f674ff62a6ccc4cbd0842f4b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "b34e584e-90ca-42aa-8630-f819e0aea4ed", "value": "T148246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "5b5894c1-850a-401b-a8bb-fa863edbc9fa", "value": "3072:qw91KScp8270maXvvzau+Upy37PbKi9P9/KMB5ZboqN3y:x/KScO270mafvWu7pe7PWE/K0Zboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048374, "uuid": "97bf0256-43ba-435c-b9cb-09084ffbf0f6", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048374, "uuid": "33769abf-0d99-414f-87f0-541e2c9ce1f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "1af34107-ebf3-4b62-a4e6-b6e31b1f1ac4", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a468dfb4-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998827, "uuid": "7afa632d-df95-4668-8d11-620604610f99", "comment": "Malware payload (Mirai)", "value": "168e332115a261af441b9224ffffde9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998827, "uuid": "09e3467f-634c-4f41-b05f-0716dc554ace", "comment": "Malware payload (Mirai)", "value": "61dd9a16126a0e5714373324558cea6dfc0993e8db1e32bf7d32c919b9b0dde1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998827, "uuid": "a47076bc-36ac-4c60-9981-d61a6ae03a02", "comment": "Malware payload (Mirai)", "value": "8ad1d10ffe3b774b8b11b3dacb0fbb4c43b07294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998827, "uuid": "66f27db5-092b-456f-88db-9063bff48014", "comment": "Malware payload (Mirai)", "value": "260171702f7424bf8a75ac34495fed1d1144493be7f1e2b250052a40a6b1bba0b2b00acec058fb688511104a9921fe35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998827, "uuid": "3899da12-9ad1-42cb-a265-de2dd38ebed6", "value": "T1C1C3129B4495AF78C0F50C3C8AFD9C8775A0A717F0F530D399241365A96220A8BEDDEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998827, "uuid": "a7ac371c-1c9a-4684-b092-76f2d9b52452", "value": "3072:AbP2yexPGDr9TbP3v8lW0754C9MIUasD/RwekK4WtpSl5BsA:S2yex+DrBP36Wwv9dUaU/RwpKlt47BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998827, "uuid": "c78b00f4-cea2-40a1-90a9-3bca0f30d77d", "value": 126360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998827, "uuid": "b6cb416c-01ed-47cb-857f-17309d00563b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998827, "uuid": "865fe863-2d09-46e7-b3c8-5b9fff676deb", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1b3340-9141-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785984645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984645, "uuid": "08fe973f-ff63-4063-9bd9-1d00f1775c64", "comment": "Malware payload (Mirai)", "value": "714f66cf57a6859cea8b7e5ae350ceae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984645, "uuid": "f758bab3-0138-47fb-8a39-a66f7affe1b3", "comment": "Malware payload (Mirai)", "value": "62885ef62f5ce8dbb0df9f8a8a9955f6badc1ff303d5b9c5b1338082f1c5b5f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984645, "uuid": "0b573282-a2d1-47ee-824b-25149024076c", "comment": "Malware payload (Mirai)", "value": "a51e6e8b872c93d33db2d07a04776d65237ada53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984645, "uuid": "b1bf2faf-21fc-4e4d-821f-1c9f63f83215", "comment": "Malware payload (Mirai)", "value": "79adaa9c181a93316378353ed095f5843d2c44ff08733b3c0bdc5bf3676289f474238d8a46dee7983ef5a2febbfbd138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984645, "uuid": "fc53b6f2-a95d-47ad-9a88-a7d25646a66e", "value": "T122B30855F880CA52CAD52679FF4E428D336317B8D3D93102CE24AE3577FA99A4B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984645, "uuid": "cbbde783-a4cb-4b48-96c8-5d4405ec934e", "value": "3072:k4h68rMJxEB6b1nhalD/ljR8kI/iKbU4:k4hlMJxEQzalD/ljR8F1U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984645, "uuid": "61461190-cf97-48e6-9e4a-aa7e5928d437", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984645, "uuid": "44265f94-af6f-4d48-8885-3faa95f48977", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984645, "uuid": "fd62354e-2898-4316-944b-59625b699240", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45caa41-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786026744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026744, "uuid": "d4bce195-5dff-40c7-9c4d-c1b471885da0", "comment": "Malware payload (PureLogsStealer)", "value": "81cd889d80efc320e5aca36662724181", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026744, "uuid": "83e965c1-2946-47c2-98e4-5e0a59f28e3e", "comment": "Malware payload (PureLogsStealer)", "value": "63d9ee9be6336b953a7e82fd8d951db99d4c0518a98b7a49a2b6f0b3b4ddcb7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026744, "uuid": "a50f2bb2-c8d9-4085-b499-3c3058426ab1", "comment": "Malware payload (PureLogsStealer)", "value": "3572bce20e14ad04160bd5ba76cf662c81b13666", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026744, "uuid": "b9387179-5244-4787-9c89-1dfba5b6fe44", "comment": "Malware payload (PureLogsStealer)", "value": "cb498a23f50309df09f177eba21c7e3030084605c2cad589c2927732a1a43be9607c36268e5b6fa2247e24f95ce5f814", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026744, "uuid": "34c7c472-2964-4403-8ad4-0db14f34a3a8", "value": "T11BD578F06700DC82D53A6B23F5EAF658B23D172686CD5EDC00B8AAD50E97A11F94DCC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026744, "uuid": "2d5a366f-efb2-4931-843a-7fe9f3f17034", "value": "24576:/UWKRrl0MOLx+OM4TcXcqRHbErrY/R6emh1JudbmbP4RrR54Yv9OLvHG6k0:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026744, "uuid": "d36a888d-e67b-4073-9272-5112d9601dec", "value": 2899516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026744, "uuid": "9b2316e8-b5ce-4a34-8968-c4797851c735", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026744, "uuid": "7e1d19e2-4f18-471c-a52b-75a7fe7bf5f2", "value": "WHM P.O 20261199 - SIGNED.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b74ae7-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786027047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027047, "uuid": "920dbef0-6b59-4ee9-a371-4ba643fc0378", "comment": "Malware payload (LxBaseRAT)", "value": "c99353c20ed00e6bc7a22503dfea9884", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027047, "uuid": "1ad5c6f0-ee6d-4fb0-aaa6-1b1961109715", "comment": "Malware payload (LxBaseRAT)", "value": "64a3f7ce905035fd8f86d59fd09cb0920ed03574be40e75dc5b2496541003d7d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027047, "uuid": "08903848-5578-48de-8f39-54dc14157c64", "comment": "Malware payload (LxBaseRAT)", "value": "c193964b891520dbd6a3749293af25d592873242", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027047, "uuid": "e9689b51-3fa8-49eb-944d-85c555418632", "comment": "Malware payload (LxBaseRAT)", "value": "1f7241152c6327886eed0fe468962243fcc7f85b006f9f5247de64b74d0e4042bfd1a79e28d8cc0526946c0195de68f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027047, "uuid": "3a98e81c-3927-47e2-a71f-e2ebce2bedc6", "value": "T193056B50D0427A78F0FA8B905CFEBE584735BBD7060ABA015B012A940B3B7E7BD95D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027047, "uuid": "7cc5236b-41ac-4e70-b2a5-da89575f93b1", "value": "24576:6ey4+S+VtDgFryhZW6o8gxGtiIm/oDiZGNsv:jyPThc1ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027047, "uuid": "6eb8ee45-0555-4393-a5fc-480f15ef1a5e", "value": 821464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027047, "uuid": "0f0556b4-5db4-4e0b-a54c-ba4a8babb3f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027047, "uuid": "bedb28c5-17ec-4d9b-9e07-8f3d67551c95", "value": "PO-06-08-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27303136-91e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786054452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786054452, "uuid": "6b11582d-3a68-41b5-8800-09b52b0400d7", "comment": "Malware payload (Stealc)", "value": "e79ad54bd794375224a5d76d56f3180b", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786054452, "uuid": "22421886-7df1-40df-953e-1205c98b22ab", "comment": "Malware payload (Stealc)", "value": "652f91bcf60dc148e7af64bf509cd4f7e4ffac685030bc260c59c7b869585ac9", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786054452, "uuid": "bb98aa28-5411-4bac-b273-63c91500ba21", "comment": "Malware payload (Stealc)", "value": "7c43762eb07a44ba9add9301546b77e4e6d5bfa7", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786054452, "uuid": "6498c846-8005-4ea4-aeb2-c3e8b42575d3", "comment": "Malware payload (Stealc)", "value": "ad86786193688aaa5c16e3eec427576f6340620b7efe31a7a62991dc181f639e38b8fd4c43febf4674435c3284489016", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786054452, "uuid": "2eb97c73-cdc2-41bb-81f6-9166433df724", "value": "T1F3A533D653E41AADD4B8B3B854E115676F31F8608F36924F13F09A8D6D22BE2D936303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786054452, "uuid": "cf6c651f-6883-40ca-9c52-ce6fd009c8f5", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786054452, "uuid": "9e390c9d-9d73-4289-8065-dcec9d21087e", "value": "49152:MSHHf/Y9l1UAuC6uOknC129b8PiW7kRscXcTmfiY4p:9HYvnuCtC29b3W7kRxXcSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786054452, "uuid": "c46168f8-8928-415a-bd5c-c50cdf1f6400", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786054452, "uuid": "26ffe143-bf04-4621-afa9-c89a061c21b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786054452, "uuid": "dc7be2f0-f149-41bc-98e6-9c18ba1ce6bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6ad974-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022003, "uuid": "a765c849-9a03-485b-bc0d-f86b5a55d06c", "comment": "Malware payload (Mirai)", "value": "b53881f9ac3e07af390bb0e7591878a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022003, "uuid": "f1cf624e-bdad-427b-b574-b3f870d87ea8", "comment": "Malware payload (Mirai)", "value": "659524ce4fc21df3f40342cb8ed64800a774944870d1e485fa386978318ca494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022003, "uuid": "7c63164b-c59e-4d83-9402-ff0e9e824370", "comment": "Malware payload (Mirai)", "value": "2e6c1eefbb502e6423b7c16485d4faa71f06c024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022003, "uuid": "3836fc55-f031-44b1-bea3-14e27b432637", "comment": "Malware payload (Mirai)", "value": "4447b3a808f833870a709cc1569c893214e8a0ac182b3b477ffabd41195e447da3420a6378a09ea6b83ad61ced6de1bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022003, "uuid": "7bb4f25b-c2ff-4fcf-be2b-9cdd00a73517", "value": "T17303D981FA1D8707C2E272F7F75D428D3B2D6EA8B3FA7212A9306FA133C25D51525162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022003, "uuid": "8321f963-6aa3-443d-bf93-73ed1474e3bb", "value": "768:jkZJHvmPzRy9OWFldPvUpMXR6F3fVng2rDK7DGgLB27:IHMfWLVcpMsFPVnd50B27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022003, "uuid": "56b1545d-7d2b-4e4f-b308-b434c3326019", "value": 40080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022003, "uuid": "991acdf9-77c2-4ad2-bafa-a7b896a6c32a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022003, "uuid": "2fe4a272-14d7-45c7-8add-add149ac1eb2", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8ac21c-919b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786023077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023077, "uuid": "4885d4a9-542c-412f-b14c-75fbb493788c", "comment": "Malware payload (Mirai)", "value": "0bbfc0aade7e4c49097df2642698766f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023077, "uuid": "b9c80038-d85f-4ee0-8a46-79a6141d97a4", "comment": "Malware payload (Mirai)", "value": "65e48718b14854d888dc166cb8712e42ee504f00613db7cb40209230f756cedc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023077, "uuid": "fbe79e2d-0637-4f5f-8bcb-9e6a6406af22", "comment": "Malware payload (Mirai)", "value": "33e33ed3f11a3b1c5d2486d98ef761a9848782c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023077, "uuid": "7d65be3b-8929-4fb0-bc58-c9ca9e700a32", "comment": "Malware payload (Mirai)", "value": "f16e9db985869d3e0437b6f4959f3f992f6505e1cb560011b39d4c1bbf4556af0ac24991232258aae95635974737290c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023077, "uuid": "74d763a0-514f-46fd-a8f3-a1d94c94a648", "value": "T1BFB43965FD819B95DAD12ABEFF1E824973130B78F2DE72129D051B3163CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023077, "uuid": "47b98f0b-fdc0-4f68-a528-a522cff634a2", "value": "12288:Ies4qs+yt2+SayoybCotDBAXanT4qZ3N0fgCJLPazczB8Aofn2Dx:cxqsNLdy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786023077, "uuid": "d47ecaf1-669f-420e-8122-669350a230ed", "value": 497344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786023077, "uuid": "cd72f9b8-3f5f-49eb-8480-2d576c60d475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023077, "uuid": "0b8a28b3-7b08-4bb1-bf0b-cb6e8ae8aeaa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2518cf0c-915b-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785995607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995607, "uuid": "cf0311e6-4500-442d-9cf6-11efefb6a98c", "comment": "Malware payload (PureLogsStealer)", "value": "a2e05f06e620f98ae42eff6f982cb702", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995607, "uuid": "917a42d1-d860-49d5-bb43-e153c9201ae7", "comment": "Malware payload (PureLogsStealer)", "value": "667c7447f3dbc2a30430d131a076a3aff45284c719e3aa8bd2316a562ffba5bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995607, "uuid": "7515736e-f489-48f2-adfd-deb29ac514b3", "comment": "Malware payload (PureLogsStealer)", "value": "c2b27afa0bbd9a6e172a9f33635f8fcc50959637", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995607, "uuid": "49f2dcb6-fccb-4f7b-825c-d2235731465c", "comment": "Malware payload (PureLogsStealer)", "value": "f119d0eb74f9a7c86cd6fbbbafac8130d7f840146212041f668e08eb3f703f8dfeece25efd9aa654440cd2d2a42ea7de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995607, "uuid": "6c61c5cd-d63e-4f6d-ba25-5e910aa1a8c3", "value": "T1E7362782278492723720EB9D6636DD34AA0FA05355C6DF00329EE718771DD4FA39CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995607, "uuid": "8fca4f5e-a592-474d-957a-6f2118c06ae8", "value": "98304:gXhjX3V00RC7yWm4zPtX2QODZ+fxqIHVOWH5ozRu/+hkTC2asTSbgsFb8g/CoTvO:O3C047yWmUPl2ftEqoVXZodpk2sG7FbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785995607, "uuid": "4c8d043a-7be3-4b3b-9149-5b4295521336", "value": 5117082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785995607, "uuid": "0ac61983-bfa7-4f18-97e0-e7c6bd1a5eef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995607, "uuid": "0ce54ae3-85c5-499e-8530-d96a611c15df", "value": "Purchase Orders For PO2608-018.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b70193c-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022005, "uuid": "6e02c957-daac-4e41-81c8-6d6dd31255c1", "comment": "Malware payload (Mirai)", "value": "66b4016fd1e2f53986a05b6c3c571c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022005, "uuid": "2d827342-39a2-41b7-8630-b160492d61d4", "comment": "Malware payload (Mirai)", "value": "66821e5e5a4412eff9dc12b311595306f7625bd2bfcf01d2fa3f95813526bfc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022005, "uuid": "62720933-c60b-4b43-b638-693f1b22c6f1", "comment": "Malware payload (Mirai)", "value": "81dc2b414002382b3717a6313a35bd08865e6e45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022005, "uuid": "1fece1b7-0d60-4867-b071-9811eac9044b", "comment": "Malware payload (Mirai)", "value": "52183383a03cd1cc40750c4fedf67f7a22aaa52ff414bf2809de302f78d7935db3bdc9c85043229aed51a54f9c351cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022005, "uuid": "1819b8dd-b681-4653-afe2-fa82704acb07", "value": "T16DA36D47770B2880F82202F157DEA3E03F1561CBAB361EB7586A62F76F731991D06B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022005, "uuid": "c230b349-bbf9-45b2-8b38-19d99bcb3549", "value": "1536:EwbnZf51pGMalunqD820afA8ZAG34jgLJUn5p5M/LW:Pnb1pFaltzfAngVhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022005, "uuid": "79b1b475-58b0-4089-9354-17e2ecb29608", "value": 99824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022005, "uuid": "baf044c1-2a8c-44e8-a3bb-9c43e4db4cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022005, "uuid": "803e8bba-bec5-4a5e-a9c5-2a4864543b4e", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d5e464-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786040133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040133, "uuid": "ae5788b2-152c-4cba-855f-cd78fc0e1903", "comment": "Malware payload (WannaCry)", "value": "6506c1b800a28853ef8af5a466e12e8d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040133, "uuid": "9b92d947-c48a-4546-9933-82f19b7708fc", "comment": "Malware payload (WannaCry)", "value": "66b98067cb4b20d0da1e9459f5851b7d86e046afa9a78ff87b9bb1c641e3a771", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040133, "uuid": "efc8bacd-ff6d-4844-9571-ec439703cb07", "comment": "Malware payload (WannaCry)", "value": "617210d8feb0679a0f675269300fc19b4c49e66c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040133, "uuid": "c1a7bd6f-a1c1-4569-b147-a92319b6fb0f", "comment": "Malware payload (WannaCry)", "value": "cef0eca88afec3290f7b07315b887ecd55e73284698c5d45227701881b811415d8472c7a9ce233dd939d2a043bc8f685", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040133, "uuid": "0418d85c-785f-445c-821d-4168aafa9221", "value": "T19E36230A31A8C1B8C0051575CCA7CAFAA2B27C5A9EB9560F7BC07F5F3E33755AA50712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040133, "uuid": "4ca9392d-4305-4d34-b845-98c6040eb688", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040133, "uuid": "1c5ffe91-82a1-4a86-b959-79869849632f", "value": "49152:jnsnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAR:DMlqPoBhz1aRxcSUDk36SAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040133, "uuid": "582b267b-83fe-4e74-886a-0ce41dda67eb", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040133, "uuid": "ca8b75d3-3314-4059-8721-41c4ad3ecbe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040133, "uuid": "b56a4c4c-9e4f-447c-b3af-652bb5fd290c", "value": "66b98067cb4b20d0da1e9459f5851b7d86e046afa9a78ff87b9bb1c641e3a771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32419959-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996059, "uuid": "fbef96fe-f099-43d3-b122-315560ae7290", "comment": "Malware payload (Mirai)", "value": "80535704f060b1eb104f86156ac06590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996059, "uuid": "376d23cd-43d7-4985-afe4-f189c3584691", "comment": "Malware payload (Mirai)", "value": "66e9aa24eb9f00590ceddf13af2837e47b0ba43a63db2091081c30c8ef4c3651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996059, "uuid": "75faf852-ea9a-4c56-917d-c6a03671b232", "comment": "Malware payload (Mirai)", "value": "faf35f11cd6a9dc74c23cc91cbd7835e0595b324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996059, "uuid": "b8e5f2a4-e60a-4527-b534-7eb2bc64c084", "comment": "Malware payload (Mirai)", "value": "2f80cfaa1438553aaf1bd1d7be2cd4da4ce9f76793c6d7dc20b28b0ee0a50e2afc7c6ec4e782980a29109416a6296839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996059, "uuid": "2dffa76e-7d81-434f-8844-9aa03728e0e8", "value": "T13B9302BA8509295FD97FE1312BF40B8FAC5449B994CB4F1A2C83A127AF259747C48FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996059, "uuid": "c8e9479e-8ba7-40f6-a934-91ceda35ea84", "value": "1536:i0c/h2BuNUgwziaUumRgRn/MDXb7Gzz9xmkafY1ZXExtlnqx0EL61klDHYKdZwV7:i0wuuNUgwiaUugGn9xmHYExtlqSEW44l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996059, "uuid": "9a905b6b-642d-48f0-9777-55e4f3261c3b", "value": 92652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996059, "uuid": "f2a4cabf-f1ca-4823-b3e3-72f72ccaa0f5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996059, "uuid": "94beaddd-9aa0-4639-9c83-1b0a983bc9eb", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d24293b-91e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786052770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052770, "uuid": "1eaeb35f-61e9-4e0e-9858-f74b9d439e7d", "comment": "Malware payload", "value": "edb7a959d708d5140203cc3dfffc0e95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052770, "uuid": "a9508071-96de-4f7c-beed-32722577e194", "comment": "Malware payload", "value": "670e15d21d6ffa4f89be367e9c0007eab1d123f8f92d1af8ac95de8a935e7332", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052770, "uuid": "942c9393-e809-4ee1-bcbc-8f94e0b48077", "comment": "Malware payload", "value": "f21d9785056ad3fc871e62348689465a4d8c80a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052770, "uuid": "1ebdad17-429b-45ca-abb3-7fd1fd02b3d8", "comment": "Malware payload", "value": "e1d9e3d1152c4abdb4eb5a206316caee815972e3bab706c195c4bc815f40d35fcf96fe3acad136a08d3055134355137b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052770, "uuid": "b2a303a1-2412-4af7-87a7-9319984fad36", "value": "T1D2B733AB12715059D25AD83D87373FC93AF2676B8A40BC78D4FDCDC82639DD1A123A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052770, "uuid": "4b083e19-373d-4d17-956d-605eca3c345c", "value": "631f628884033ab8daeff2f8fe3a83c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052770, "uuid": "b26ddd33-3ace-431b-8cd4-07f3c084cbdd", "value": "786432:d1nF8hbglPRoPTIRWNZ86LRTqjy80enDTLMjaLHag5BA5UFROCTCuIOZJlkzX:dNFEbaRaIReZDLRTrveDTrLHBzAKBrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786052770, "uuid": "2036ae64-3f01-4a2b-a6e5-fd12d8a1c708", "value": 50499584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786052770, "uuid": "693898ad-e8ae-4dca-be46-b9b4ca1bb996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052770, "uuid": "5c6bfdbc-c1dc-49d4-9869-c41d8f977af4", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b175e7e1-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996272, "uuid": "fc6f728d-e40d-4f0e-b9e9-4d11d522d47c", "comment": "Malware payload (RemcosRAT)", "value": "13693ae0e177bbf3896b5450ee763387", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996272, "uuid": "2b47a46e-13c4-46db-81f2-6398d643aae7", "comment": "Malware payload (RemcosRAT)", "value": "671c01c2dd70bc8f367cae2b177ef2b65f7ec0e88da4e812fb89f09f3e48b9c4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996272, "uuid": "7ef4540d-460f-443b-9e5d-bec8c9204ad1", "comment": "Malware payload (RemcosRAT)", "value": "9b5306908cc7dff9aa83955ec1d77dd1abd387ed", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996272, "uuid": "b46431d6-5d37-4d8e-ab64-dd1216fc3faf", "comment": "Malware payload (RemcosRAT)", "value": "e24bcb76c49cb06c3789a27447d3dbf98b5e100a7d32d441a07eeeb78d4a79f4cd7e2277e0fae1a54d0f4bdde0d16632", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996272, "uuid": "128bc555-6295-42da-82d6-767f4d37bf2c", "value": "T15824BE12FF45D465E94457300BE3B1C2D629BC2B9E1A4E0F2386773EAD77A90C472E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996272, "uuid": "9bdc681a-d9af-4cd4-9d93-c55ecba20c4f", "value": "6144:8Z+RwPONXoRjZ7SezmfDlavx+aCChyKPd7jpl4Lpl1r1mO15FD:fKPdPpErFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996272, "uuid": "fa0ba3a5-81b0-479c-ba03-ce37016f673a", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996272, "uuid": "c1aee7cf-3fea-49fa-a175-d1e40ad07b58", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996272, "uuid": "ff69258a-aabb-4981-b9cc-9ae18f41316e", "value": "MT#2605-8.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12285bc-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040188, "uuid": "c6918b66-6cf8-4ddb-9144-4c908308282d", "comment": "Malware payload (Mirai)", "value": "9a693d680e787394ecb1318781c839d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040188, "uuid": "794c2744-6247-4767-ad1a-2e7ea67af006", "comment": "Malware payload (Mirai)", "value": "68c13cbe5190875bb2ee0602b3934361d4e9a7ec478d412fa2f8bdd51db2ce29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040188, "uuid": "edd81bec-4aa4-4478-afed-9980694816d4", "comment": "Malware payload (Mirai)", "value": "8f30305851281699605f4bdda678985418c1ca9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040188, "uuid": "c5662cc1-0cce-4274-886a-2ef801f437ef", "comment": "Malware payload (Mirai)", "value": "79a358eaedc1a75c10ea39125d6a94d3020f7be379fee7b267100c61f2611d406d3060eb852cd86ea3a3816b0e17abdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040188, "uuid": "c389f859-878f-4888-972e-2be2a5891fb3", "value": "T146447D42BA4FFEEDF147B276815F4918EC14EF2584010E7161E77946AA762C38F39E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040188, "uuid": "c882292a-0271-46fd-8455-a826c82250d6", "value": "6144:Glje7r7pv0eYS680G1yxqBzMazUVYd/d25r:GlEBv0E62BUCv29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040188, "uuid": "67103fbb-da1b-4a08-9949-2de7e5342817", "value": 269088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040188, "uuid": "0489412b-d7d2-4e43-8f9c-c6f1dc9008e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040188, "uuid": "115e5d8f-948a-477f-aba4-c41840752cb0", "value": "pope.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559e00de-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048946, "uuid": "d71cc0c6-2b1a-4d97-b548-36ec4c312046", "comment": "Malware payload (Mirai)", "value": "324212420df466b639028ed508799737", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048946, "uuid": "5109cf98-accb-4342-b4e7-3af0e3bba877", "comment": "Malware payload (Mirai)", "value": "68de6ccfb347d813d084ca44d6857a4bd9e4411e23484e3353d0b9cece2dbb64", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048946, "uuid": "a92efc0b-f5ab-4e96-9708-a0fed2bb47d8", "comment": "Malware payload (Mirai)", "value": "7c6c003f656f20ac9ed9687feb17bbea05a5438f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048946, "uuid": "96f5034e-63ca-4c82-b3ec-470a5f6534c1", "comment": "Malware payload (Mirai)", "value": "0d194bc3043134c35f3792ac20bea7be4b6568d9fe1f5c3165c52de761d7f2ea5b70f8505dd8a90aa65477391b15de12", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048946, "uuid": "e5d64596-9ce6-459f-aa74-be812172a286", "value": "T172146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048946, "uuid": "e54a0d3c-a10c-4374-9895-c2000383b321", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtV:BZAyFzQSdS7I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048946, "uuid": "916eefdb-54f1-48e7-827c-00c228379fab", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048946, "uuid": "38cb4e40-b3f1-4eb4-a46d-025bad4c4334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048946, "uuid": "7126b832-c105-42c1-ba78-c00f77a5c2be", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74187c46-9150-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785991015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991015, "uuid": "ba33189f-efac-40a6-86d5-297283e38b92", "comment": "Malware payload", "value": "09c6ba569cf65eecc3015045ae3bfdb2", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991015, "uuid": "e3e6f565-3d58-478e-b754-c9a1e909b59c", "comment": "Malware payload", "value": "6a7f14da5dfdfa1a88e884fd744ab569cbd99c2de97d5fae97c48bc6e5c1f34a", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991015, "uuid": "299f428e-53ab-43c0-a2b1-0b152518c39a", "comment": "Malware payload", "value": "1dc0e3e775f9bc0586de6bcc26cd35da64fe36e7", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991015, "uuid": "424d17fe-00b2-42c1-9cd3-ea15c8b7743a", "comment": "Malware payload", "value": "ea0301151ee93b7a2d3b30391dec89e8ad1d44f20fb96393b5d2caf85514172537db7322d28103b97298f50d9336b895", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991015, "uuid": "60628d9b-aa11-4341-ada8-2e5c153264f4", "value": "T16701289CA1BCCEC20DADC985B5B099459491E0C7B2F59BC5F74F0820BF48A8D365334E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991015, "uuid": "deba41f6-48fd-4656-9735-8bc59a231e3c", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkkjta53F45hpnv:FzY8k1/sWi2jkwta9F4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785991015, "uuid": "8894e825-b163-477d-b732-c6218f46b42c", "value": 697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785991015, "uuid": "3bfeee33-95c7-414a-a417-c126bdcdb394", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991015, "uuid": "68e21048-1169-437b-abb6-67cd80893a6d", "value": "ipmiv2.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b01ea0-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786046844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046844, "uuid": "2b1486f4-fab4-46d5-a5dc-5e6b2339c03f", "comment": "Malware payload", "value": "cdffbebdcab69edbe8b42fd15544a1fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046844, "uuid": "cea3ef3a-6c59-44bd-8c9b-7ee4cc4478c4", "comment": "Malware payload", "value": "6a8c1190d015949e3451cf38c2a5373b1def1bbd24b9599cfe533ae956356c72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046844, "uuid": "f97273d8-d812-44f9-afce-1078af3927e8", "comment": "Malware payload", "value": "56091319dc4606582ce869dee8879b745a8600fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046844, "uuid": "70ad14df-ff11-434b-b693-60a8e4637e3b", "comment": "Malware payload", "value": "459fedb17c56e3067acf9f6f9a99ed0f9d6081af5872f0f1f4609d7fe3ad74a37361b44daa14af72ff34128d9dc65b74", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046844, "uuid": "3aadc795-deb1-4ba9-9893-ee0cdd4f6935", "value": "T12731548931716EB18A8CCF09B0E146E45247EDC5B2970AF2F4C21E2BA9D9E40BE15A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046844, "uuid": "3995f549-535c-4f3e-bf36-44353aa04b72", "value": "12:Okfc0dt6hLNaKOOQ6uODOqCDUffrMGOK1uk1ZuVbNVb1LBquN04N0KvtI0Ve77Xa:jfxcPFO0Dwz3KAkmPz242MtQWAJoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046844, "uuid": "1d602b94-c9b7-48a3-bbbc-a0850e105125", "value": 1875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046844, "uuid": "d74186ac-4737-4c79-8d08-6384672c7367", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046844, "uuid": "46375a52-12a5-4df9-b3f5-b5ceed79e9ba", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f836c1-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978754, "uuid": "f2a071a1-21a0-4679-80c2-fc1f0272754c", "comment": "Malware payload (Mirai)", "value": "ac72919d425cf574c6c6ae1abcce2b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978754, "uuid": "cde08000-30b7-4b5d-aec8-82343758548c", "comment": "Malware payload (Mirai)", "value": "6abb06e956ce2bfa05920c0c13857ec6aa11ef2810e017d5d44f51b018170d10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978754, "uuid": "6c1b7a80-ac93-4d20-977b-9d4576cd6d2b", "comment": "Malware payload (Mirai)", "value": "95d55a8899c48664ac2514c9728ccfbdd2366d15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978754, "uuid": "42160c86-485e-4bb8-8ceb-0c8fefb0a2df", "comment": "Malware payload (Mirai)", "value": "4776f34b56b3c452a8f29e9423511b5d709feaab5a69b72d642132eaf4a759fc14d9634597fd3a13e36cd066a635e7ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978754, "uuid": "b9220c2c-6251-449b-b183-0f712d8b2f9a", "value": "T17C63F14D6A070386C17A997C81439F37EE007E55D81698CBBFA0C24B6DA38E971E77C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978754, "uuid": "c8149522-6c88-4158-842c-61b95be8c676", "value": "1536:EJve2CUQK68FWgghtR4z9GnCM8FFioLz0ySru5cieKV1clS:N98FMht+zlXiOz4ieKV1cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978754, "uuid": "4ac5641b-afbd-4fac-8883-b8e9aefa5097", "value": 72248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978754, "uuid": "c35c6c16-1291-44b7-82c7-be779a1ca1f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978754, "uuid": "0b7e4a76-fb4f-4278-a451-11af9117991a", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0315df69-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "cc8c3f3f-0d59-41ae-87dd-665a56b85c7f", "comment": "Malware payload (Mirai)", "value": "9143e638be77b59ba81232f7d9094966", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "009ffb0a-0dae-48dc-927a-070335233615", "comment": "Malware payload (Mirai)", "value": "6b0f0118ddee42acf3daf0208b1ddc36e0038704d6e7193af0483066a69afd11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "f1c6f64a-65e6-4364-a76b-417dc0f00f04", "comment": "Malware payload (Mirai)", "value": "7a8944748762030dd4c7b633c9e01f206105c4b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048378, "uuid": "4aa38b99-baf5-411b-a15a-c2ba33296416", "comment": "Malware payload (Mirai)", "value": "b6dc4309e03c4407b51c322ffb4bca9fbdd83700568fe9f2ae9186870e5a9e603fb46349918a07b705c6a387c5aafa50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "a796a57c-8d88-4f46-be03-397886225e8f", "value": "T1D7F35B1274C190FEC8E5C2784BEFE236DA32F4495134761F27C8AE262E9DF212B6D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "9dfb1c8b-dfb4-48c7-acb7-421bf984cac5", "value": "3072:U3Y4KAGZpQVplHmN1gqr8ODAyn5ylj2Qb41Nmk2s11I6:U1KAhXe9Gq/3mkO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048378, "uuid": "39ae37bb-a6ad-424f-a735-1c5570dfae62", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048378, "uuid": "c318fc28-736a-4df0-82d5-85accd016cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048378, "uuid": "2ad17d3b-13ad-4383-9bd2-5f54ddd71e32", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3c8264-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005548, "uuid": "ed2abfd6-52fc-4059-961a-48c0e215e402", "comment": "Malware payload", "value": "0610da27d3f863d8a675eb0d99a46bf7", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005548, "uuid": "0beebd13-dd5a-4204-bb18-4399c6661d1e", "comment": "Malware payload", "value": "6b4aaed608bf71ccf32299c11fc57b31641a019eeded96bddc59870423bb8f2e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005548, "uuid": "da2bbeec-a7a0-4977-8a6e-e26f69b75101", "comment": "Malware payload", "value": "40cf6fb5589dd0e3fdfc0f099f243220b62b54d1", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005548, "uuid": "45903eca-e878-4c5b-b9ae-753cf90f2fc6", "comment": "Malware payload", "value": "5e6634a4f6f8079ef7ad574e771a73e16c36c68cd30fb0e79759f8d9ce270d2643f65bb442ab4f332a1d8615537e3bef", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005548, "uuid": "41c0bb1b-6f4d-404a-82ae-854a502881db", "value": "T182D26D503366C116E0499A764DD5C1DF0B25FC63BE96C74B33D0770F6839AA2CA27A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005548, "uuid": "955c5716-f711-4690-b77b-39d50d3f1f37", "value": "384:SMiCqo8Ir85ZUeEKV2zHc+RVYD2IdMUUc2h/MNX:Sgq4rkZUKV2bcueD2I+r3/MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005548, "uuid": "088c42ce-c479-4cfd-9f7a-1ed829e3d8e1", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005548, "uuid": "c336c6eb-c4b1-4512-a3c6-4fe50837381c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005548, "uuid": "f2a555de-da6a-4e1e-90c6-3491356ef6b1", "value": "MEHS - INQUIRY.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09acf993-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026914, "uuid": "2a1709df-b256-4620-9efd-08aacac36d82", "comment": "Malware payload", "value": "9f3598ecaca6bf44c275fddd58a778b7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026914, "uuid": "d5118b5a-a6b3-4a75-8807-5ec5714a7307", "comment": "Malware payload", "value": "6b56330453cc8a4b161ac71d6a9438d0aa8b9ff9971e42e64e2645e313445dbc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026914, "uuid": "491f9bf6-2edc-46f5-b61a-92f97ae828ff", "comment": "Malware payload", "value": "214cbaf1898e221814930c742b42dcb5db8b298b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026914, "uuid": "b44323ac-fc0a-4ef1-ac8d-3cd7968fac47", "comment": "Malware payload", "value": "a9b6d0059ec8888504f2037760b9597aa62dc91b3ef915f450b0f6265be2c0b5fbbd5bf4b08dbf630d068aeb80bae36c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026914, "uuid": "4ad9c27e-823f-41f9-90a8-5ccdc329ad07", "value": "T149628CC66C285C0A84F073793CE3D419E025268022402611F0CC68AB0FE9B14CCE36A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026914, "uuid": "cc3a63dc-b4ec-4c62-8f07-6e9e595187f2", "value": "3:PouVKzEHjJXUIk+OgIlqFbWR0MBqBcMBhc7FgrpB6MH/XWAIMwWKBcWWGb:h4I3ighWGWqqMcKP1/+MwWXfGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026914, "uuid": "fbf0d46e-8a41-4be5-8149-9c4b0e7ef946", "value": 14625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026914, "uuid": "6c7b378f-33db-4273-99d1-ee2bc1742dc6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026914, "uuid": "7f159932-db82-49c6-8843-44072ff580b7", "value": "verygoodthingsarecomingentiretimeforbest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ed367-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005407, "uuid": "093ac77a-6f8a-44a7-9b2a-7e92fee6e9a4", "comment": "Malware payload", "value": "8beeacfc686648f11351e776bfb5b032", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005407, "uuid": "19bf8c4e-d739-44bc-be26-45efc6106905", "comment": "Malware payload", "value": "6b5a230e03f211e89ddad52a30d65f5cdaa0e1acd4cf31824d9919deae751965", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005407, "uuid": "dab6babe-8773-4ba2-9a55-c03df5adcaf5", "comment": "Malware payload", "value": "d2fdb2519bfb2311fe60e1607cc724a3ce6563e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005407, "uuid": "269e1500-232a-42da-af0a-fddb080d286d", "comment": "Malware payload", "value": "89df07c46084acf3f91633b4e79ca61dfc205445470e6bdbef70495689a8194f50f7f795f312ed6489b0a7d0f4e0c7ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005407, "uuid": "904846b5-1839-48f1-ae4b-0c9cddd0cfe3", "value": "T1ADC28D966A867C44BEC98A3E4CBD2B4D6DF4C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005407, "uuid": "77bbe7a0-e1ae-40b3-8f65-6d5f9175a37e", "value": "768:l8vCB+25j6es8RD9FYpMSUpi+20qUpi+20YQX:l8l25JFd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005407, "uuid": "457e5cd4-6ec0-47f4-abec-a4b19085b6f2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005407, "uuid": "954c332d-b651-4edf-b946-b6a1b2b2099b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005407, "uuid": "54d53045-2d85-427a-80da-3f3f081645f1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6b117d-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978579, "uuid": "b84f43f6-20c1-4694-b7a0-070708c8ceb7", "comment": "Malware payload (Mirai)", "value": "29d2f48a6f63824578c7471363551bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978579, "uuid": "19258f8d-1963-4a2c-a16c-61e8cd755777", "comment": "Malware payload (Mirai)", "value": "6be33d68a77ca5185614457fbbc16fb0e877b8e17760be7277c8327cc4e23bb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978579, "uuid": "7f778d62-9a0b-48b0-bdaf-9d656385befd", "comment": "Malware payload (Mirai)", "value": "ca8502ff22ed31ffd6254966daa44ce5115de673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978579, "uuid": "a627ff0a-16a1-4971-8453-e4d8eef395f3", "comment": "Malware payload (Mirai)", "value": "fe1b04eb99425fa02c20b105c8789f8b83b6f26b882b0c3843b905bdc822947ee23f5c17207026ac47df888d18224137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978579, "uuid": "03aa0112-759f-4229-99cd-193250489577", "value": "T11943F1D35105EEF6C1EA1036E62CE3EA341946B8EDF63896C52108ED66FA2078B75D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978579, "uuid": "43bd7df1-6521-4571-a62d-4a76b039a93e", "value": "768:9v6h6u1yyGeIYG6mbYyVpR/tG+0zpiPGHF2TT9m1Ok7FyL6qZBtu64MDGRIw2Zg1:9w6u1yyGOzYpRlJEHsTxGy5nQynfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978579, "uuid": "75c61b28-47c6-46ed-9fd0-e9010ac92829", "value": 55916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978579, "uuid": "b211a682-ac99-44ec-aaa0-97fd602037a6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978579, "uuid": "74f714e2-3f63-492d-b3fe-e5b89424b71f", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e1a275-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786048646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048646, "uuid": "155d683d-b220-43b9-917c-fe9ebdb07fee", "comment": "Malware payload", "value": "8bcb7645143c0526a2b6e21eab4a53dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048646, "uuid": "62cc3f8d-4338-499f-96ae-dd3ad8a871d6", "comment": "Malware payload", "value": "6bedee0651587750379b68ce8e6b5025e5062f39c914d683b77dcfc53c8295d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048646, "uuid": "03a95333-1ff4-44c6-b152-2c72093e6d30", "comment": "Malware payload", "value": "92a52c1baca33c8a4cf3ce6a015f6a58227d0e9c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048646, "uuid": "37cc26b9-95d9-46f5-9e14-5b64ea92c7d3", "comment": "Malware payload", "value": "bbdd9365450e0dd715afdef229638b5b457e8702f35c0f8c65a6bdefa1cd5bdd6ff5b7ca30f1a7b8f539217c725adb5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048646, "uuid": "4fcd3609-01b9-4b3a-a700-5f0a05037bb0", "value": "T18EA130E6E920E231748E457DBE8EB6629683147F0D513900749FAE1C2F4CA5CB168F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048646, "uuid": "ba55b9ae-c199-440b-8a9a-2ecc37b0612e", "value": "96:c+rzxY8Ti2x+a1kba8sRufbJ+AnTlJ5NH+/YL:c+xRG2x+a1qajufbJh5F+wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048646, "uuid": "5fc67c88-2f81-4ea4-a50b-1d14d4f11513", "value": 4845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048646, "uuid": "a98ce25c-fec2-446a-985b-8aa7b3a0c074", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048646, "uuid": "5dfc246d-e5cd-4390-9573-3d53c5f28cb0", "value": "d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f08f4a8-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049499, "uuid": "46161b4c-8f62-416c-81cb-ff1d28971ecb", "comment": "Malware payload (ConnectWise)", "value": "327a35bb8db59c80c7aca194e04a9578", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049499, "uuid": "f1f67931-9715-479b-8688-69a39c3d0d5b", "comment": "Malware payload (ConnectWise)", "value": "6c16fb794b6ae6e193e5ca07e5bec0aeeda83d61ddc45f0a66944dde69b210a5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049499, "uuid": "646c7a9c-6426-4ffc-bbf3-fe191cbfa834", "comment": "Malware payload (ConnectWise)", "value": "626553675e5f326a8251e880d5032e793382416f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049499, "uuid": "de68ae33-594f-4e10-8f10-00f65d7ad938", "comment": "Malware payload (ConnectWise)", "value": "d4a0a1584bb626ab4944a07fa98534219a3511cdcd0a516e8404e6d60c1792c841b82a0f71a9d45f84c19a7640aa3593", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049499, "uuid": "c621d3d4-c4e3-4ad7-b89a-eea20cc4748b", "value": "T16446E101B3D295B6D0BF0678D87A56696774BC058312CBBF5794B93D2E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049499, "uuid": "2fc674be-c3f2-45d7-a1c3-1c1ba3ac6123", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049499, "uuid": "9912d1e1-ad11-47d7-b29c-23cd2601b460", "value": "98304:hzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl5:hhfefPtHxcp9ym3nltDUJVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049499, "uuid": "fd17ac45-ec92-4059-9ab5-dd84cd732b93", "value": 5716224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049499, "uuid": "23e092c3-d06f-40a7-a1d1-b8219bc5b2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049499, "uuid": "6d33651c-a3ad-4a04-8d23-f6578c808922", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdcd8cd-916a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786002277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002277, "uuid": "2c115546-7779-4565-9efb-a2c5f08a47f5", "comment": "Malware payload (Mirai)", "value": "1935686f4dad2a3bca689284fcbccbfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002277, "uuid": "a7f8e060-62b5-4e0a-96c7-a33c51e8eec5", "comment": "Malware payload (Mirai)", "value": "6c5c765cee5aecf2695cd1431129cb97cb79cc8372a3c536a7f3085a8a6f355c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002277, "uuid": "74daa58c-d530-4161-9a19-76bc69975a94", "comment": "Malware payload (Mirai)", "value": "25b0b420a1e65f29740d9c65071c238f437e397f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002277, "uuid": "3a74e7f0-f24e-4a69-91a1-cec6faae1b36", "comment": "Malware payload (Mirai)", "value": "a8969eeef56ea3a339dc9f7d773dbb0c72a2cbfa10c933d4dad26d8e1ff14e11972e3835d2ce4ece1def798bd55d4f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002277, "uuid": "cab82eb9-4112-4a1d-8e0c-44493f4ae021", "value": "T10893027EC4517E8DFAF2C1F2417C757BB2A30991F24F53CD92426C68DDA1B89D982A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002277, "uuid": "91657a64-fa65-476f-962e-f1953f185d98", "value": "1536:Mtjk6N8blqcoUG/az1BJ73aVaunD0910zMcc4jo0j3HRUmuUxBqTPrhv9ZNbJ:Mt8lqabJTedD091t4jo0j3ygoTPDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786002277, "uuid": "b784aed1-0f76-4a9e-8ed8-45f06b3ca306", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786002277, "uuid": "ea253cf9-3ae4-49a5-a647-cfcb3f559a32", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002277, "uuid": "08009de9-2321-493a-ab75-762c13733d98", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271eb4f4-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "48f8d48c-2918-4d10-bae4-9baddf8f31aa", "comment": "Malware payload (Mirai)", "value": "ab946227b2955ca11a9370bdcaa76fb3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "7f569a10-fe1b-430e-829e-d092831546c9", "comment": "Malware payload (Mirai)", "value": "6eee92142627b47cadb3a4833b18fa1f850079a4e643db0ef2a462fb2cdbc6f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "664a7541-5fca-4907-81e5-901a31bafe26", "comment": "Malware payload (Mirai)", "value": "a75303a50632252a373f0dc26d7e3efe26a81902", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "389fc33d-d6fd-453d-99da-1520b776be61", "comment": "Malware payload (Mirai)", "value": "76d3e518c2c956572a57f299f5af8946e63c1ce2bf7887963e059cb811021f7f0f0459875e9d9f7acdbf32bb72505030", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "5bf5e97b-683e-421e-82c7-5bbfee414927", "value": "T16C045B22DD25AF8AC516A1F0B1F18E789F12BD2548470FF9A5B6EAF44143DC8F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "dd6c5366-2f81-4029-b665-6244b8faa101", "value": "3072:lRKxvYNGszJHjBYLjuvIH7l8WDJWAv8gVmjG7nGw:lRKxvEGsVHjBYLjXtoAvJmjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050586, "uuid": "34e283bd-ea76-436f-b9fd-19cb627dc340", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050586, "uuid": "ddcc752c-ed8c-485c-a607-c994624af7b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "f9de3569-1b46-48cf-9fb5-c1fbc41488dc", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baae9e2a-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026782, "uuid": "4eaf4d73-3096-496b-be0a-109e8f9411be", "comment": "Malware payload (RemcosRAT)", "value": "7cb6b94bbddd4d6a0c846df770275664", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026782, "uuid": "66d13870-b7b6-437a-ac0c-eaae27be4587", "comment": "Malware payload (RemcosRAT)", "value": "6f69e704739b26996cf7b5513e9e121a622429c6973b4c8fd1144c6f71d6758b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026782, "uuid": "512f94bf-e4b9-4e5c-8d1a-8c417880b175", "comment": "Malware payload (RemcosRAT)", "value": "4a318519799b85e0f48c3d0a62d9d6713edca522", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026782, "uuid": "844b4447-b07a-433d-bb43-18c4c680a5ef", "comment": "Malware payload (RemcosRAT)", "value": "7d62a09ae92fd9fe03ef04f4c552c9a49afc064c00044904ca16cef037bdeb6b4a2b48d1009b55d0a1a4d69efb0ed973", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026782, "uuid": "043c1ff7-2876-4cdf-9520-60691c5554d0", "value": "T1C3155F1F5E43865580089C6CC863DD1FDFAB068A0466FC9EBAED8DC54EB0406725BAFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026782, "uuid": "9cd6bdd6-94fb-4e26-a85d-2233d6a51229", "value": "1536:rMPZqpYzL211pYqTAq7SYYnzOzlzGVYzGGzzqpJ/ZxGpk0Yqpi1wqYzA1p+YbyC/:LoM0M9MiF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026782, "uuid": "3c8385a4-f50e-4ec7-8696-b159b92436f7", "value": 951561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026782, "uuid": "3f0c0d36-f11d-40f1-82e0-9d0597e3d807", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026782, "uuid": "26c569be-cd54-4e01-a9fe-a608669bcd91", "value": "Ref-00145_0608026_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0c8de2-9142-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785985071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985071, "uuid": "59a78ed9-075b-4236-ba5a-ba53f1a99ede", "comment": "Malware payload (ValleyRAT)", "value": "e5e9f2eeb4f5a44fe672d74c53959577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985071, "uuid": "7c1e3a44-5786-41e0-87a3-c18cbf8cfb43", "comment": "Malware payload (ValleyRAT)", "value": "6fcc636637d758b1068ebcff7363ab4aefa39b93e278dbea825eebeb8a9357e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985071, "uuid": "e84649b9-e990-42e8-8fff-d2e36733012b", "comment": "Malware payload (ValleyRAT)", "value": "f094702af184cb7df67f3885451e212a954a88d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985071, "uuid": "ff1f0f2f-dbcd-4a22-8b2e-52037de5783a", "comment": "Malware payload (ValleyRAT)", "value": "0143bc0b8863282a340e83aa29230d74aef4aba4337e4ab8cd764e5fd5d360d036aa138b6b25d5555c4bbeea398caf1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985071, "uuid": "fb8e9b39-222b-4752-829d-b90b54d28015", "value": "T161E78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985071, "uuid": "5622f45a-9fbe-44d8-a1ba-49692962dd1a", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985071, "uuid": "1918e20f-8530-4e0b-9d85-1205f14af522", "value": "98304:duj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3rr:MRnmW2s/m3xq9a2l8/QX9EfM3rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785985071, "uuid": "1393d601-4f8d-44e9-83e4-018a444368fe", "value": 64691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785985071, "uuid": "590fb4f9-adea-46f9-9314-4640d3942b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985071, "uuid": "7adcb60c-2599-47f2-95c9-de24136837b2", "value": "setup_r8013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d10d5f-9139-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981215, "uuid": "60ac6aa1-3729-4036-b1b8-1b5751f743dd", "comment": "Malware payload (Mirai)", "value": "ba806962eb865ca08edb60d15e9c37fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981215, "uuid": "c4c0b904-317e-4f4e-bfeb-79d212ff273e", "comment": "Malware payload (Mirai)", "value": "6fe059ee63705b742a2a3b3db9e81e6158c84d66dfe3f01dcd5ead853ed1c180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981215, "uuid": "784e7bf8-1876-4bfe-aa77-c912f11dad78", "comment": "Malware payload (Mirai)", "value": "8a6e473e3d15a9eb21ff0698cf2d59da8fb2edab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981215, "uuid": "357e9af1-0bbb-4c6a-94f4-388ec3739eb4", "comment": "Malware payload (Mirai)", "value": "fc308e1662fc563459cb4fb757c78d326484ba7d04b54ebd27caf5d9ce2a3f7897dab84f5d648b11bd845b6d43a41781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981215, "uuid": "2d5c7848-bf33-4c2c-a663-b6efbaa1f941", "value": "T10863028CA145BCEADD614DBC03290333E2A19B7AB2620C0E3537DB46CF3555D79EBA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981215, "uuid": "ef789dd6-83ab-443f-859e-8e89830f9edb", "value": "1536:O6lq0XXFNVfxUtdBk5WQV2NkDwgKZpHdpf5wnbF3E8EKtm2McTNTVEWS:OERXFNVfKdBVGEnZ9Rq5RE52ZTJVEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981215, "uuid": "bd5a26d1-8511-47a0-ace5-0bf4b5fd9e37", "value": 72856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981215, "uuid": "698698e0-c5a1-4d40-8105-f1f18a442d8c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981215, "uuid": "d0bc9817-6e1e-4452-b416-2e99b67b1425", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf7c9f5-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "8dd5ed7a-dfb1-452b-ace6-d03524f3e3a4", "comment": "Malware payload (Mirai)", "value": "feb50f645c19497812834016fa241ce7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "fd14b51b-1246-4ea4-adff-eb013f908e01", "comment": "Malware payload (Mirai)", "value": "6ffdb870eaea7452681c041c942842a8e7d476d374518bc51ca75283eb95ac78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "f60f595e-2c6b-4670-987b-633712aa66a9", "comment": "Malware payload (Mirai)", "value": "999025111d9a4b1a6a2f1051c21ce75f44513111", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "f4726437-7b46-4f33-a790-ab07e141da3a", "comment": "Malware payload (Mirai)", "value": "80af535614d92a248b9fc9fc0ef029ed1ea6cd73dab99bdc9cf5859a9b5cb46642663e3c3920e688c3c53015f999358b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "e0e3b990-0614-45f6-b37c-b5293bb87e99", "value": "T18BC3AE73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "033f5890-c7ab-40ab-b285-ac3d17bb1c39", "value": "3072:hfpZykqkt436I+9eIHUmNOkSMPXeC4GnHC:hRZ0F3BcvNOkvZhnHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045739, "uuid": "765b2cf7-5e58-44e5-a80a-e93c7bd83e67", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045739, "uuid": "5752fa04-f3c6-48d8-8205-60f9d444b6c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "aed122ee-5c4a-4ce0-9128-22e96edc6ed0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35eb331-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996275, "uuid": "27a87086-72a7-460b-af7e-b1d6dd6622ef", "comment": "Malware payload (RemcosRAT)", "value": "fc81c47918bb08edd4c66ae62c421a18", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996275, "uuid": "1561f495-a6fb-4545-8fc6-dafc994cb845", "comment": "Malware payload (RemcosRAT)", "value": "70578458bd187ad7640c391dd06d4ac61d5e51017fadf163cba2f789b0814e9d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996275, "uuid": "ff492d42-3c74-4aac-ab56-6259347e0f30", "comment": "Malware payload (RemcosRAT)", "value": "ae94b0b97386c3c9ed28ae285fa8caf669ff039a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996275, "uuid": "eb36eee8-a27c-4698-8f14-8eaa3ecebb9c", "comment": "Malware payload (RemcosRAT)", "value": "a04162f0e9141b31dc87c13e4feabdadbe60faf87ff5e6b6509037fde2b33d41d2b69bcdfd9f8ec59addd7593d1de858", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996275, "uuid": "7ae78efe-8e44-4be7-85c1-0fa874592d58", "value": "T1FD24BE46FE898030E95457304BE3B1C6E625BC2BAE664E0F2385737E6D376D0C972E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996275, "uuid": "a1fc9b1a-f3b4-4e5f-a32b-4bd74f7ff33d", "value": "6144:9Z+RwPONXoRjZ7SezmfDlavx+aCChyKPd7V8nECOVv/meoQmOuKe:GKPdeOVvoOuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996275, "uuid": "9457eb4b-4039-46d4-bfea-a18b46087f87", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996275, "uuid": "cd3f2497-2a25-4c8e-9751-7c9c35e74307", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996275, "uuid": "8d2fe008-6f61-4443-907d-73caafc3029a", "value": "HT 1301965060.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094765ce-9187-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786014458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786014458, "uuid": "41f5b0df-13b7-44c3-82b3-fea348fc89bd", "comment": "Malware payload (RemcosRAT)", "value": "7e42a0c887333346481ecfe34ee0e06d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786014458, "uuid": "920ef2da-db00-4345-a358-12151e4f40f2", "comment": "Malware payload (RemcosRAT)", "value": "706010061f5682cf131c7be3e1ae82a779994ec61ab2efec5d7921f08c6abe8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786014458, "uuid": "1bde71e0-7c84-4e34-93a4-7142944cd9a0", "comment": "Malware payload (RemcosRAT)", "value": "d7feb6aa40539b18f2efc641e3bba53f4710f06f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786014458, "uuid": "c1c7190d-a8db-473b-9170-b20bf7aad0ce", "comment": "Malware payload (RemcosRAT)", "value": "637d6f3f7bda02d7f9b38d48a2ec08880bf7da89f19a64a93599927da8f7d22c32f0897589b13f769218fe7d34698fdf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786014458, "uuid": "d3ede0f2-92eb-447d-a8ee-7415de28f0fd", "value": "T144475EB065A5F5BF82EDC1A7E131E3E14ECF95048E46EE15D84ABDE0CB5C481AB84CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786014458, "uuid": "eaf67647-0a91-4e3f-8baa-17d8a6f259fb", "value": "192:rMGMvPRyWgJypUjTZOENEWBUxClkWWX1mk02G5G5JEU0LBBFAXeteWfWWAgVILOy:Af41Mo/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786014458, "uuid": "bc8f21b7-bbca-43f6-9e32-fdacda421a18", "value": 26008780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786014458, "uuid": "5480a23b-fedf-4d94-821d-db61276d7f84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786014458, "uuid": "23845e84-ea68-4bec-be5d-0c5164753cf9", "value": "Payment copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c65d8d-913a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785981764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981764, "uuid": "b6e4dabe-283d-43d4-b312-6c39f0147b2a", "comment": "Malware payload", "value": "5149aee7429a4e87eaf73c615208c72b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981764, "uuid": "802f9bfa-4363-4e2e-8de2-b7a0e78bab87", "comment": "Malware payload", "value": "707e752878d6f836c80cee34643e99a676c1c6885d9b7443709528d9633c0f23", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981764, "uuid": "5298e37e-e5ae-46b8-8271-efc0c9f4b6a3", "comment": "Malware payload", "value": "4a0467fea75f0d55d2b3350d2ca3bd1285034e93", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981764, "uuid": "bd9d7f18-44ef-4856-add1-bf2b338eae37", "comment": "Malware payload", "value": "6c56f1f80d53b94dde449c22dadd44883e41440fbd75ccd2af59893655c40df35e6c50d3057760cf8ef3dd0177712975", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981764, "uuid": "25f96b1d-529f-41d0-9166-07d370fd5e01", "value": "T10EC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981764, "uuid": "956c16ac-891a-4e16-8935-abd442fc2010", "value": "768:H8vCB+25j6es8Rs9FYpMSUpi+20qUpi+20YQX:H8l25J6d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981764, "uuid": "30f230c4-3f1e-4d26-b28c-15516fec3310", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981764, "uuid": "35b48366-e213-4a1d-a716-24bccc13a6a3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981764, "uuid": "9fbdce06-272d-47d6-9d65-5be07e3c346d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f365822-9138-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785980672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980672, "uuid": "f979b3dd-a369-48eb-b115-ea626f866efc", "comment": "Malware payload (Mirai)", "value": "6793a370caa387d45e2425c005c9e6b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980672, "uuid": "80f8ab06-f4a4-460f-a854-926f7b8bd118", "comment": "Malware payload (Mirai)", "value": "70beea3dbd4deaa71bff2d2da10b30f1617abb1167922aa88ae96da064027de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980672, "uuid": "0d11c208-5f6c-4d74-87ac-89ef98f9f07d", "comment": "Malware payload (Mirai)", "value": "797e5d7aab3303f4d359ef328773c575d71aeee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980672, "uuid": "39aff4f4-6f55-44a4-8067-0d775277fba7", "comment": "Malware payload (Mirai)", "value": "52d8c22c3f3344ba50d9d7fcc060579f7a5ac82664b4f05e7f158f41ac325862c742b00e078b30a4abbc70b283622e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980672, "uuid": "ca7609d7-6590-4d2f-a9c9-e2634101a6f6", "value": "T1DA73028E69566DC7C90DAE38C94C2206663340A5B3478B7C9601EE5DA7F1D2E709ECFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980672, "uuid": "dc133173-e9f4-465e-8e72-ced2767b1b87", "value": "1536:CkuWUz6q4PVGmbhoU8r19A8OEjzATaln+LqhGIBxf7oE4yNxKl:Izj4Ps9fOEjzATaUwGqyCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785980672, "uuid": "29f4e13f-0582-4926-a239-9bf345672733", "value": 73472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785980672, "uuid": "0bdb53f2-9f84-4aff-bc63-7e47a2b9635e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980672, "uuid": "e4e78221-9277-4985-ba50-4e4bc21e6db0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81ca1f7-9176-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786007450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007450, "uuid": "d0e74ac8-ca5b-4f0b-aae4-1df379dc071e", "comment": "Malware payload (RemcosRAT)", "value": "b975547dd90e06f19a66d324a70c4a32", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007450, "uuid": "9aa51008-60b0-44d4-8f40-f68aec877572", "comment": "Malware payload (RemcosRAT)", "value": "70c0c96ab942433b8a5965ce46ff9a582e7f532ee19f865d1131aa688f178da1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007450, "uuid": "18c91202-5255-4e85-9f1c-a110dba1ecb9", "comment": "Malware payload (RemcosRAT)", "value": "ce7c35f5d594a1a723cf90a4a0bde45269b9bed7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007450, "uuid": "cf17bdfe-fdbd-4b71-bea1-7f1446c38753", "comment": "Malware payload (RemcosRAT)", "value": "63052779452a228e3c50c54a19d20f08869ed0982fa4a51f195126911a9f7a7456e2a4904eaf83138979bbb1713292e7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007450, "uuid": "e2379dcd-dc78-4880-9d41-ded35af46327", "value": "T1D6528CC57C285C4448B0737E18E1D45A8157679062012A21F0CC74A70FAAB68CCE35A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007450, "uuid": "4ce73a8f-ae9b-409e-b8cb-9b47ddf537f9", "value": "3:PouVKzEHjJXUIk+OgIlqFbWR0MBqBcMBh0udCmX0aH/HWAIMwWKBcWWGb:h4I3ighWGWqqMZX1/uMwWXfGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786007450, "uuid": "96a05845-779e-466d-9d4b-8cb3ca5f124e", "value": 14133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786007450, "uuid": "5b811f79-c271-4d75-8443-0389cd12ceaa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007450, "uuid": "e71047e0-1c23-4142-a56f-0939780cf911", "value": "goodthingsarecomingfromthebestplacescomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26238e2d-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "be907c4c-6422-438d-8a28-26008a1f7f3b", "comment": "Malware payload (Mirai)", "value": "5c281c4f55cb4dcf010789db84af38cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "753db6f0-7d60-4829-bddb-7c76c4b62a4d", "comment": "Malware payload (Mirai)", "value": "70e6321443d11cd384022b2bf5e1c7594266070715d1c4f0815a13ee329e2698", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "87a4c9f6-57e6-4f5a-a01b-9facb6db662b", "comment": "Malware payload (Mirai)", "value": "792e3306dda84d83a2d3a022729ef11a7aeaa268", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "041dc4f4-5eeb-451f-bcde-cd24b3f4a27f", "comment": "Malware payload (Mirai)", "value": "b232ec71bfbb639a7bf57aa14fdc940021ef80af4a7fffbe3eb8f8ab819a270e4502efccc9f4d6cd5f454f4f0067d75e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "07c25eed-b240-4313-b30a-b04ce706d54c", "value": "T1332439027B0D0E03D1532DF0273B1BE14BEFFDA128B5E681755EBEC59271DB22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "c1ee6348-58b9-416c-999a-6f4303b03330", "value": "3072:saQzEan+o5ED6tK8ezqDgc5oAx8mNMAbpnFCnVFS/k1jUMnGIq:S+o5lZezoz5bxZMAbpnwzSWj/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050584, "uuid": "eca91762-7032-4b22-892f-6a2c0e776e69", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050584, "uuid": "f50be2d1-4ceb-4f96-95d8-f86df21223e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "a28ac287-d02f-44f4-a632-a39cf8132294", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fedde41-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "71a5e7f2-9d78-4317-9b03-3237b2f192fd", "comment": "Malware payload", "value": "13f24a6ba6bbdd6be5126ce615982783", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "8ccfa349-11d1-4155-812c-aa720dfb3d80", "comment": "Malware payload", "value": "7140ae8a17f4ba4de0755dabec9103fe96cb2b1db62e1134eff35a743abd1fe4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "412ddbdd-61c2-480f-91de-0de424e790ad", "comment": "Malware payload", "value": "86edff9d16202e66eee9f51bd75a87dec29b2fb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "508abdf1-92e7-4934-95e9-2ca4042b013d", "comment": "Malware payload", "value": "c0b11f4c8cbf3434ca7fbad1d6ea190b58b39099ddba281a034602c82c4a75d1cd4321ada1cefaae3a0a2a94dd75f42e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "d71006ec-db9d-4648-ba1c-6a05c0159231", "value": "T113B57C077CE119AAC0AA93328DB251A27BB1FC490B7123DB2E50B3782F727D46E75754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "8b0c97c5-e75b-4c6f-9508-bc47c9a6ac15", "value": "24576:0nsCy/LAfdersRuD3JX5t00g9L1mb244T4wipypsQApHFUKOVDoIKWtpJAgET7mk:0ndecfdSquD3R59g9ZtUHpejAd7MLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044991, "uuid": "6da04a1d-548c-469a-b469-66e0b075d607", "value": 2391513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044991, "uuid": "76785ebf-c934-4770-8705-292f6c408205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "127f82f0-f684-4266-b7b2-896c0c818dcf", "value": "boss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a661d611-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983798, "uuid": "bb08595a-d082-47dd-8051-a96f7240ff9e", "comment": "Malware payload (Mirai)", "value": "834069b0eb309178129491f3c7c013f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983798, "uuid": "aec3cd4d-da91-47ae-bfa3-079c47dcb789", "comment": "Malware payload (Mirai)", "value": "716119c3bdd05a5a7d6d1033418919561030038081dc5f79ffc8bda6ca002923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983798, "uuid": "92833393-5b9d-4504-8f87-ae0a079eef03", "comment": "Malware payload (Mirai)", "value": "b283122bffab256d9ec24aeafde45cfd5b555c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983798, "uuid": "6b9e0f19-92fa-43a5-8a67-a03d2665ffd2", "comment": "Malware payload (Mirai)", "value": "a436f0abb073d5e8c23281bae855cc8bf915b69dc44d3b53565306caa1a9bd9d03299ae162e8fd1afac1bc3ed5367500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983798, "uuid": "b72246d1-2f4d-48c1-b1cd-0eb947d591c4", "value": "T123732B86F343E4F0ED4A46B1009FB37EE6348E525024DA6AEF91FDA19D23A12601F75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983798, "uuid": "da93be58-ae2e-47cb-b7bf-bb22989ace7a", "value": "1536:xW1K5YnYMnC3tx5CeG4qpsQp+li7gdkBUx31cJIxcMMr:xWfYtx5CpMiWNip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983798, "uuid": "4dbf5dae-be0a-459b-bad2-bf6021d27b5f", "value": 75308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983798, "uuid": "2a7723a3-d979-44ff-a895-3b206b5dc843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983798, "uuid": "a10ecc8e-dd6e-4eb8-ad84-a280a63aed24", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf835deb-913b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785982122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982122, "uuid": "4ba1b465-8f99-41dd-a6dd-1769c592e7a5", "comment": "Malware payload", "value": "1bf84d7c62c30854a25359eaf4021a29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982122, "uuid": "86ee8ccb-99ea-414f-9411-a635b42b5b3e", "comment": "Malware payload", "value": "71b77cc8813142f076b260e70f5ac5979f6ddd620f9705eb0f3b8db5012dbb8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982122, "uuid": "8112a322-bba0-4632-8561-30affc63c0ce", "comment": "Malware payload", "value": "ed1ff12097a5990b0eeeb00444e2a62b206782fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982122, "uuid": "4bf167e8-d4a7-497c-abc7-b941c1553c09", "comment": "Malware payload", "value": "970284c5789527443227e6960f3e863e5d4a4674090c756833fb515128f44d0ed810d22956b707f1c8316f9bfb829490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982122, "uuid": "dad2afb6-daee-478b-8bfd-01d7f98de877", "value": "T1EAC312823AA847FEC82D547310DB75F78A04864CF0957A529F4F2997EB287106FF6A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982122, "uuid": "c9c03f54-9a2b-4c90-b6ac-09b5b1eede39", "value": "3072:i+Qasc1vsCLcBaDYWAUDtj122Q6g/v9nIovjmloutF:nsc5LYBaqwtp5/49nRvYoSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982122, "uuid": "64c21612-1b18-4427-a4aa-3715babe09d1", "value": 120584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982122, "uuid": "c065e47c-68fe-4c39-b95e-2d62470efa9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982122, "uuid": "77fb64a6-5600-4fcd-8399-dbad4b4244be", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8503ad46-91a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786028410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028410, "uuid": "6bcca4cb-74a9-409d-a063-a8dd48e65214", "comment": "Malware payload (NanoCore)", "value": "6e0da4c118ec3a4e2c78f2382c7cf70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028410, "uuid": "1de70217-83c2-4efe-9248-a7abad423c83", "comment": "Malware payload (NanoCore)", "value": "722635285b6ed905f035850ac097bb619e4f6cf805bbd5d468f053e8f362bcfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028410, "uuid": "67f57ea3-cd18-4c0c-8b8e-8c2326cd6eaa", "comment": "Malware payload (NanoCore)", "value": "e8eedbbae67af06f0b7929eb8be036c70015b0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028410, "uuid": "827eb974-03ca-4046-87a9-53f01ed2ea49", "comment": "Malware payload (NanoCore)", "value": "964aa41953558dc24d445135ef8a7b3cfca504f2a90320c27bcac89284b1a8babf9dd218b315ec0bbf91512e95d5c43f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028410, "uuid": "a1744082-95c5-491c-9a71-927f6899cf8b", "value": "T17814CF2A77A84A2FE2DE85B9611211434378C2E3DDC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028410, "uuid": "4658e99e-4b87-4204-b86c-2c12be3019a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028410, "uuid": "fe1f8a98-b4cb-440c-a7c2-84dc88fad805", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIEdsvu1SEImfAF8V7m8CJvflR6:MLV6Bta6dtJmakIM5GuvImfVqflRj0vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786028410, "uuid": "d0f4174d-f01f-42ce-a748-baf48126e8ce", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786028410, "uuid": "bad6aa56-0b83-4b6e-b26d-02eba2bb7b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028410, "uuid": "cdb2fe3a-0bb9-4365-8e9d-8c4c204f77c7", "value": "6E0DA4C118EC3A4E2C78F2382C7CF70D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94025852-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021992, "uuid": "85a45c0c-6268-425a-9e63-81b89e5d4dfe", "comment": "Malware payload (Mirai)", "value": "349516ca34a7d42f8741503ec4e08bb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021992, "uuid": "6c47b292-ed3f-466c-ba5b-dcdcfb066be9", "comment": "Malware payload (Mirai)", "value": "7290b8236a71c07e509ff0f6b23f0fbb3bc8da70869359fe6d609fc6900e1130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021992, "uuid": "e9a3085e-2650-4d65-8594-64f5fa291fb2", "comment": "Malware payload (Mirai)", "value": "49ebe3f3f733cdc230251769c6357bbd41ef2c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021992, "uuid": "8d563ac9-d0cd-4986-8534-2abaa4415ffe", "comment": "Malware payload (Mirai)", "value": "0ed5d834580bbfec8d2208505ea48c4b2a9cac28932e4a16e8e34a10d4d89e387f76985b3032d4defee94345094a2645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021992, "uuid": "56ce3589-05de-4579-858d-49eb4b30aa58", "value": "T1A243E73B3584A3F4F58157B076E7A3B27C640BFF2096A09B6A4216167AF077B603C947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021992, "uuid": "20230d97-26b2-415e-aab4-025593bb6f8c", "value": "1536:RRwlhol6MM4LxgsQp1zLTEi6PECyVdtIJlz+u9p:RqlhO5RQpdLTZ6cZPtYak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021992, "uuid": "47d39dcf-5e7a-49ad-b20e-3451d991e800", "value": 58140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021992, "uuid": "deb64aef-db77-479f-a17a-2fd159908996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021992, "uuid": "5b448528-e15f-4427-97be-114f6abdf4e8", "value": "main.openrisc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216023c9-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050576, "uuid": "20852fa1-2c15-4f08-8df7-4ffb406c3d82", "comment": "Malware payload (Mirai)", "value": "de10cf62d704b9e3c05ff05053e0dc63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050576, "uuid": "ff1ef0e9-9084-4163-b8e0-36956a1660e2", "comment": "Malware payload (Mirai)", "value": "72dd47f7eedc101f63f5f557651a388013319bb73e96a0c821252b75f2217169", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050576, "uuid": "f813bad7-d68a-4e1c-b009-a9d7c1ed7b1d", "comment": "Malware payload (Mirai)", "value": "98e1872239863df0e842dbeca0af885911574d57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050576, "uuid": "81e0d601-e910-4dec-824a-3171ee8be39e", "comment": "Malware payload (Mirai)", "value": "aa8cd373de7ae86ba99313464850a8b969eb10b489b80933bfb48b0a4c78fd85c450a36ca50b66f400104045ecdd0319", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050576, "uuid": "0b2341a6-b8f2-46f9-9a5d-0ed80e0e648e", "value": "T1C4241990BA59EC32C05E1D3667FBDB593B4369D14EA39104C460EBCCBB871C0AB6857B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050576, "uuid": "ad5aff6a-94aa-401f-8ad7-2054bac1fc25", "value": "3072:nDbfo8kLrr1j5kQts04meSPuBThOdAAVR47WKhSjU7nGGrz22:nfYLX3kQS05Pud4VR4Hwjurz22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050576, "uuid": "7ae5c6be-c0ae-4c49-820b-c579368589eb", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050576, "uuid": "60e5ad1f-c472-4edd-991f-ff3f03b40bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050576, "uuid": "59ab9e86-4b08-4428-bdb2-9f29fd757bd6", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46eb326-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785994613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994613, "uuid": "144681fa-3a44-48be-900e-13e3db5b13e8", "comment": "Malware payload (DDoSAgent)", "value": "a6cbadb04e75a12c87427b86257c29a7", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994613, "uuid": "18bfa2f3-f134-41cd-9fe3-65d994e815c2", "comment": "Malware payload (DDoSAgent)", "value": "7326662e29abdd3dc8cedb6adb0fe394b111221e18ee24c14d2c15dd85abc1a3", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994613, "uuid": "9f265507-e701-4927-8609-d63d4a07742b", "comment": "Malware payload (DDoSAgent)", "value": "fdb65de4d59b685beaa7072ccd8dc12b7ba626ad", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994613, "uuid": "164b34bb-2ac0-40ae-aeb8-c82399d24784", "comment": "Malware payload (DDoSAgent)", "value": "1d595c8d5f35b0890f58da839ba77a60c58586677de1af7127ad6763cd70bf7b62309e3fcf377cfeaf2c2676977726e8", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994613, "uuid": "57973df6-5c5a-4aa2-a552-438d97261f58", "value": "T1E6D58D03BCA515A9C0EA673289A292927B71FC450F2123DB3F90B27C2F72BD45A79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994613, "uuid": "1a606ee7-ca33-4b9a-97ae-e529da7fb3fd", "value": "49152:E+Cbqmh0CoEDCUgFk6d0FGS3eA5hHyQ+Q24nvkO7n3+UWIdIf:gp27X1dAjZ5RyQ+F48OjCIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994613, "uuid": "3327b751-2e85-48cd-bc22-7f6eaa010baf", "value": 2747357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994613, "uuid": "e43d2843-d36a-4c33-b23c-034ce5663e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994613, "uuid": "c728d037-ae55-4ac4-91a7-b2c8aa7a53f2", "value": "phantom.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbadbde-918d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786017231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017231, "uuid": "a11259d1-e03d-4cfd-9b18-8a62792fc861", "comment": "Malware payload (ConnectWise)", "value": "9dbe6595bb6468477c47b7cfa091295c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017231, "uuid": "7236f364-45a4-4ee4-8ecf-25e3c2caeb52", "comment": "Malware payload (ConnectWise)", "value": "73b27055b72328828d5b84e444872a14ef775f6dcb9fbc3b33888d7e90f0b301", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017231, "uuid": "2540a654-de2d-4c8d-9fd2-959eee5d21d1", "comment": "Malware payload (ConnectWise)", "value": "2af0b9aa7b0d9f1bf45f4f63ea1e5bafc3f57d23", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017231, "uuid": "dbe6a643-3e84-415f-88ae-d2ca11a0c45e", "comment": "Malware payload (ConnectWise)", "value": "42abb3b07c2ca40d78d188d6a943c3a77f7fa86303c5683da5735efeecf8460b2510f8957b7b3a231233e2fe66fc6ca7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017231, "uuid": "51ea7e50-0f7b-480e-8b14-ae85ac1e990a", "value": "T16536023FF28B653EE0691A3A39B2A110943B7A6165134C1696ECF88CCF255B01D3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017231, "uuid": "50fa6c3c-071c-40a7-be2a-89f0ba8f4d8f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017231, "uuid": "cee10ed4-71cc-4336-a66f-4cd049483d56", "value": "98304:45OKj1V3Bhzh5UwXeH+wM5BVOFlczCllt3bX493Z8nJ:c3PxhzhmwOH+LBulkCFIBSnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786017231, "uuid": "21ccc963-f52d-4667-8b93-5f43b96b256a", "value": 4890873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786017231, "uuid": "bce87854-a42e-454a-97f5-4429308ffa84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017231, "uuid": "f9e4a858-dcf0-4b8f-929f-9017aa12cad1", "value": "SecuriteInfo.com.W32.ConnectWise.AE.gen.Eldorado.29017.23829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00e97d5-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786049581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049581, "uuid": "45173574-abc7-40a7-93d6-d54090a8c642", "comment": "Malware payload (Mirai)", "value": "9f5cba4674287afbed72c63c9d6185ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049581, "uuid": "5488b8b5-0442-4652-88ff-67f5c5abafef", "comment": "Malware payload (Mirai)", "value": "73c8b883889a87c6844c8eab2f3540141eb078d44b741c843abc7fda2ccf2bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049581, "uuid": "30d44bf2-4902-408b-b71b-15b46559bf4e", "comment": "Malware payload (Mirai)", "value": "8de7ef98123e999d700c5fd39ec0b845fca9cd92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049581, "uuid": "159da52e-dcd3-459f-b48e-afd6c2e8eb99", "comment": "Malware payload (Mirai)", "value": "189106b52cf673ce7c4fb9d76417122243a7a61cb2d2cb305e399f00a8a965bf13fcb9bf1125c46c1fe177a9fc2ea189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049581, "uuid": "9f6ffe4c-4078-46d7-a028-799cbe55949c", "value": "T1D2C30749ED41AF11E5D636FEFA4F028933531B6CE3FE7201AA245B2123CAA5B0F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049581, "uuid": "8fc7e36c-4f17-444d-b256-4dcf6e27512f", "value": "3072:zsJCzu/SEG4z8hMZnda2rbdrodpGQQ8e4t+ox4cvACH:z4CSKC82Rda23drodpYytfx4cvACH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049581, "uuid": "c70892b0-485b-4261-a78b-285c3f95d768", "value": 129672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049581, "uuid": "3ef1f795-7576-4fe3-96a8-c70be295894a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049581, "uuid": "373f9bb3-d47c-4aa6-9b24-009dcc0b661a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c01512-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786027037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027037, "uuid": "377e3b86-0bc6-486c-8512-dcd89d2203c1", "comment": "Malware payload (Mirai)", "value": "c512b1cb3073eaebb94f2506b5602a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027037, "uuid": "d4cf18e9-773c-4f09-880b-e93df9cab30a", "comment": "Malware payload (Mirai)", "value": "73e69529ca0b80f92dcc55df32a348fe63a3aecf656ae13426773b2e39dbc629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027037, "uuid": "c10a2e19-9953-4ecc-bfe2-d35a0d9324e6", "comment": "Malware payload (Mirai)", "value": "0d293eb62b5fb96ae567c9d2e76f9f9a48ee1a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027037, "uuid": "ffef9bee-0cc0-44fe-8dcf-4d9385784357", "comment": "Malware payload (Mirai)", "value": "d1507bc7f3a2e5d558d71354e8774668668e0506f0a96ecb91e63be09fbe426d1c9668fa1fc601a16b38599c2864f15a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027037, "uuid": "a1b4136b-c73f-40c9-866f-cba84fad98f5", "value": "T122145CA9BA0F6C41F1C2D3F9DE8C83E13E1735E3C77689B1791212EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027037, "uuid": "37b30727-adb3-4c64-8a1f-e6ff013c1475", "value": "3072:RZaB4aCZPfTqLHon9rmiuf5i7wmEZMbpjhMXxnoq:RZaBTCZPfTqjo9rmBfE7wJSjhknoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027037, "uuid": "fca19d58-2145-4ccf-8d9c-f05be3547c88", "value": 198640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027037, "uuid": "fb95aedd-8cfc-432b-86a7-856bf1e1336e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027037, "uuid": "3ce8e6ef-ffa0-4551-8be6-8392add6bdf7", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500d0432-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005558, "uuid": "75873e35-9109-413f-a77b-3e0adbf19473", "comment": "Malware payload", "value": "c46b06db7725a4a3da2bbc9035ef40e5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005558, "uuid": "97b97419-4ef8-4d60-b958-f6786848699a", "comment": "Malware payload", "value": "743df1e79a2486a69aaf25a1814906a7c1e043dd7687a9fe5bbdf5fbe892cc59", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005558, "uuid": "ccf5a2de-1ebf-4dbe-b710-6437fc5f7d7b", "comment": "Malware payload", "value": "2207e79d6affc10b1ef1526e561d3637f2838906", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005558, "uuid": "303efc47-84b0-4f4c-bc14-80eb5e89e299", "comment": "Malware payload", "value": "1b540df422145c48df03da5fe9ccaa4c4c8293354b449c4778229ab52fa0740b6e50382fb6cc1e858a0ce8da852b594d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005558, "uuid": "da7d61a3-2ba3-4074-b9fc-ca8da63ece14", "value": "T1E43104354BFF4A99F1F340B49B31B7230576F411551ADB4F80DE138148B2980E66EF56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005558, "uuid": "a0c64bdc-5e32-4266-a706-968cdd9ba879", "value": "24:8FHd5pxeQA6CrR0deBdeFgdeIZzBfdeIZV5p25Dm:8FHdnIn620dwd7drVdrV5p25D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005558, "uuid": "07f1645e-2fae-449e-8117-6633feb0ac11", "value": 1716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005558, "uuid": "5af5e0d9-1abf-4633-93f6-a16c30e632b7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005558, "uuid": "cab307bc-88d2-4a90-854b-84fa52a8fe4f", "value": "FirmaEC.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feea6a2-91c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786039031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786039031, "uuid": "0f5f3c05-a11a-4489-9dec-8a3cf00375c3", "comment": "Malware payload (Mirai)", "value": "3d4c3a0ee78c9577d4e88e6a4e95eca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786039031, "uuid": "4ef75c2b-f0f6-4d62-97bc-932179683f93", "comment": "Malware payload (Mirai)", "value": "752f78cd6c6693a8faf7a33e8f0fe5a0f89bb6653ce73a8387ddb82b852a4698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786039031, "uuid": "a58033cb-bab8-40c7-84f3-db8b6b45cc40", "comment": "Malware payload (Mirai)", "value": "2b4ea03596e2167469205bb39470ccb6f2a4d350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786039031, "uuid": "6ef1d924-3933-4bed-bcb1-fb2f2308a247", "comment": "Malware payload (Mirai)", "value": "3443ba409d9c52618bc4cfa3b0d8e89bc26fe03484f35fc3bfc06860b2169e787a409b6e733d1a9f20ab869c43299d5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786039031, "uuid": "776a5e2b-7cef-4fa7-9d5a-f67e29d3d79b", "value": "T139E31856F8819F12D5C155BEFE0E128E33131B7CE2DE72129D24AB70778A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786039031, "uuid": "31fc26d6-5934-440b-8905-a5e550b3e2dc", "value": "3072:bWL4YP8QMhWhCteOIzdavQK3MOVwwf3DMWlVVGWKPr15k:bw47DhjtBIpaYK8ONf3JlVRKPrnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786039031, "uuid": "fa200aca-b46f-40ac-ad7c-62a37096b108", "value": 154228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786039031, "uuid": "4492c780-7030-4381-834a-c5b6ff5810a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786039031, "uuid": "2f645034-252b-43bc-832d-e92579a3c598", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada5a7d3-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026760, "uuid": "40f88ad6-1b9f-47cb-84a2-0816350bcda5", "comment": "Malware payload (RemcosRAT)", "value": "67e4a731b054e19f406ba5d52dfc19c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026760, "uuid": "e33e373e-2fda-4487-b8f1-a3bb588a49f7", "comment": "Malware payload (RemcosRAT)", "value": "753d9d15ce2409f6381f6ac02641db61a86d3a44790db82e28750b5fee75ad74", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026760, "uuid": "ef75f754-c580-41ab-8e7a-d024d2f1621b", "comment": "Malware payload (RemcosRAT)", "value": "50fb638e147e985a3146975701636d1988a63997", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026760, "uuid": "5802f211-2925-43e4-97b2-7fc926306749", "comment": "Malware payload (RemcosRAT)", "value": "8daab94da85b7917f2f68c98c80b2eda08a016a59be23da662061871d17778f69534347bc3a8690a4612f9611e717b6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026760, "uuid": "9dbd6d6d-9327-4975-b00a-82ebe6c4ea96", "value": "T1AD25DCDB9FB6D69906287D6EC43CBE9D248BCDE004D0AA5AFDB84147F70E64901C4B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026760, "uuid": "ae2db076-f888-4e34-acbc-12f3a798c11f", "value": "12288:4RKqmm3FYjnb0HBIFm4xtOHqdDXedK5XgJgP9HvgSdBMGf8SAlouMUHB3t/QDdQd:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026760, "uuid": "122240e7-b091-4889-998e-2dbc06e51cf0", "value": 1031574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026760, "uuid": "736f7044-e8d0-43f2-b87f-c79502e9b30c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026760, "uuid": "8a7f505d-a6a6-490b-8cce-ef0c8cf6ddfb", "value": "RECIBO DE PAGO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2679ee94-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048008, "uuid": "d3db8343-2c5e-47ac-a163-9232f6dc6e82", "comment": "Malware payload (Mirai)", "value": "6abdfee06223cb39fe65d2eefbd2ac3d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048008, "uuid": "ff2166d0-a63b-4521-8506-96daa1c55a10", "comment": "Malware payload (Mirai)", "value": "758fd28645e45914a8c35f391cd04bd075b2a83a105ffd3371a731ad95df2b46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048008, "uuid": "759799f6-bfff-4b6f-8eee-b15b3fd52c2a", "comment": "Malware payload (Mirai)", "value": "7c7a83fd1a73a9f2e9951add31d052bda68f9dde", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048008, "uuid": "c1598513-192a-4756-8e63-7424eb30815d", "comment": "Malware payload (Mirai)", "value": "0ba5ba9675767ab8850dac33c8921143811ad9751f642f0cf42c6bd2e30aaf02025713161d1a3f6d405743b837adc411", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048008, "uuid": "cf06f47f-d434-4841-9989-f7ce7249156a", "value": "T19F63022F020BC2A0CB59C539137E9189EB227D9261238EBF16E422FCF8758457E65F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048008, "uuid": "a43baaae-efba-4df0-a601-e29fe127a452", "value": "1536:O9bySBFVQRfWw2alHNshXLsRsWEV27sImGpvKDzCs5OV6L/6JDJiHJ:EbySBFVifqalH8LOG24IN6ms5OsL/ADm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048008, "uuid": "49652db9-6ef7-4787-8877-a87f6063bce3", "value": 72176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048008, "uuid": "eb89825f-a6ff-4125-89ab-4bd4929f07d7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048008, "uuid": "6424e586-bf69-4f59-b5b2-39cf663ebd1c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e4074b-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785994701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994701, "uuid": "f91cc92d-a6aa-4696-833f-3523889941cc", "comment": "Malware payload (PureLogsStealer)", "value": "4f13c72b2b899cfcd999d3e45a2f160f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994701, "uuid": "d88f5e51-671e-40f7-8eaa-b05142271bec", "comment": "Malware payload (PureLogsStealer)", "value": "75e5f9ac8c8e44fa09fbe405296bc6644668458a5951f7e2625e271526a0e67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994701, "uuid": "79a2e0ce-0be6-4ee0-9987-7ee7c8df5026", "comment": "Malware payload (PureLogsStealer)", "value": "3069bba57b0fa6598df739f6d8b8cf84bef57f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994701, "uuid": "ee19e4e5-b615-47f1-a74a-93d581654eae", "comment": "Malware payload (PureLogsStealer)", "value": "253c37af33d1a7fa9623bb6adb55de126fae50e9a9a0a66e1f298a260ef07484277bc4e00c2177e7c2170d75bf8969b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994701, "uuid": "36936d62-ebcf-456d-bf31-c04a05782b74", "value": "T16375126466ACC959DE990770C971D3F42360BD4AE820F1179AE57FFB383CE1B2908396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994701, "uuid": "fa73ce1d-c7a0-4112-b934-258735f0eaab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994701, "uuid": "8e1cef7c-e2ad-4692-8a92-6f9f55fbf805", "value": "24576:osmaHnToA0ZR+zng5ru3OGW/vVO0aiyIrHTwZnxtNmQlmXxvRFBCEymVdxg:o3YneR4aCPWHVObiyI2x+m6xcDmVvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994701, "uuid": "d3c19e96-8dbc-4caa-a6b3-1089a2dc7521", "value": 1631744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994701, "uuid": "72c06ab6-d15e-4675-8346-47cecac6669a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994701, "uuid": "3fa65160-2359-49b3-b495-4146bca84d0b", "value": "Purchase Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf046fe-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "6dd4980f-1f26-4ace-9031-63ea6f200962", "comment": "Malware payload (Mirai)", "value": "c3e092f5955f4fe6d5ad3ccb459651c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "910de827-df65-4945-9f3a-b80a59cd452c", "comment": "Malware payload (Mirai)", "value": "76156ea6efe0845d63cc5a97dddbc8dcca834da4e861e213b35cbea8a6155298", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "5fab404c-52b4-4557-8347-4befc172a600", "comment": "Malware payload (Mirai)", "value": "603fea7e9a28be696b91f5aa2670ef2936ec4dd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045737, "uuid": "20094943-6442-4ee5-9724-545e45de8fa7", "comment": "Malware payload (Mirai)", "value": "b6dffd5e640d3ceb10e34f88ece58c314ae7d1aaa3785cb5cf8f1625f60c20297ba54c001dc8d54a12ea0b1a76e7a908", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "ed807549-7061-44d3-b06a-ac111ed2ba9c", "value": "T16ED33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "0bcf21d1-eb13-4329-8f55-182f4997f8c7", "value": "3072:JuVeGJFWOgt9ctajH1I7s441o+YLyXzXgvy:JuVwt9cUH1I7s4MeLmLgvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045737, "uuid": "6b80b66e-fdad-4201-a067-d820ffd6198e", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045737, "uuid": "f0621cd6-054d-4951-bf48-723b00d131eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045737, "uuid": "87a944b6-cb0a-491b-ab49-3a5c71343647", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad43cf5-918f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786018058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018058, "uuid": "a2782d01-08c7-4b14-b601-0c9cd4eaf256", "comment": "Malware payload (AgentTesla)", "value": "e4533f14e42eb710c5284de3bbf02854", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018058, "uuid": "c0e383a4-6fe3-481b-87fb-0de4bd3fbb9f", "comment": "Malware payload (AgentTesla)", "value": "76187f95a48f5e16ef140b2221b24a6d6c02b50ede6277f04bcbd620c011477c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018058, "uuid": "f39f992f-0610-4619-a459-d5ed6e9ba98c", "comment": "Malware payload (AgentTesla)", "value": "b27a5680f147e2cce36eb90dcf0e15e8b398a17c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018058, "uuid": "7baa619f-e6fc-4c17-9e67-99350e452ed6", "comment": "Malware payload (AgentTesla)", "value": "be5bec6bd1c65e66dce3f84deb288168d853ac4a3a4a90819d68cb2aaa67ada2c0835f52681ffed88ff5c539bf5e45a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018058, "uuid": "a455f617-72ed-4609-90d2-ef187adfa6f8", "value": "T17545B77D0B9F3F2B32C0A479ED07A2E12AC27A999867A0F1C0654B3611A75FED553037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018058, "uuid": "6c31879d-c306-44b2-b48d-eefed041e667", "value": "24576:sxH2RBtx/V3mI0oXMosDeHGOPeQvHcHrH+1M:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786018058, "uuid": "e108b621-435d-4e4b-a996-236f280b37e0", "value": 1267201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786018058, "uuid": "7298a426-6a9f-41a9-9408-93946d387f6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018058, "uuid": "d506545e-52dd-4411-9196-c1eca42531ad", "value": "Scan_008674.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168b4e76-91f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059578, "uuid": "eee811e6-bd4e-461b-b9df-36571d6225f9", "comment": "Malware payload (Mirai)", "value": "b39a9cd00020264a81ff64b2e24a8435", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059578, "uuid": "61065e20-a726-404e-84ef-e5bba2a71d64", "comment": "Malware payload (Mirai)", "value": "7661b8408aa9677341bf46a27561c9f6d3967ad2e72ea5eab4b665f283f9b3fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059578, "uuid": "39e641aa-d41a-4b76-9a58-da9543fb2cb3", "comment": "Malware payload (Mirai)", "value": "534a81992d45adbb17d306edde1bce502a3dc21d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059578, "uuid": "8791212a-fec0-40d0-8f09-360a029ecebb", "comment": "Malware payload (Mirai)", "value": "d2eb1bf9473888b7c73d6e40608b57cd9a9c3186a35ac4c193bf8648b41acf9a801142b5dd0750bd0d6cdb5bf75f5cf6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059578, "uuid": "5a153072-d244-49e6-b05b-0ae875472439", "value": "T149042945EA404B13C4D627B9F6DF42453333AB9493EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059578, "uuid": "9424d91f-ca23-4ec0-a9cc-91cbea5ec3f9", "value": "3072:8Le6vh5G1QIruCee+asuTuRebU7IVILUZQe38YhTfYo+M/RzApthLn:0e6vfRIr1r+asuTuReAvLU/38+x+M/R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059578, "uuid": "f48c254d-0f71-4611-8889-3e1e3de786d4", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059578, "uuid": "f2f9a4ed-e63a-4887-ba62-6beaf2d54653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059578, "uuid": "cee4e687-8698-463e-845b-7ff48de7d808", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e50e6b-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046576, "uuid": "5a89cc26-74b4-43d7-b253-97f22ec26ecd", "comment": "Malware payload (Mirai)", "value": "571cfd41ef3002578ff626a290d8cc8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046576, "uuid": "1d6b493f-3e04-460b-838d-74991eab4d57", "comment": "Malware payload (Mirai)", "value": "76bc9a13ee5a29ac4dd2dcc7f07ee63b81136109eb9b9140a5f4a63663ff9ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046576, "uuid": "27bea82e-af79-4ef9-ae81-715547cf2183", "comment": "Malware payload (Mirai)", "value": "9a0cbe6ecc74f3b4162bb72a03c95b1725a601cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046576, "uuid": "2e384d8b-81eb-4319-9ca9-9b8214c751d5", "comment": "Malware payload (Mirai)", "value": "f9aa4e15b3cdfc48e67bc0d4115cda57c5c460a12b7a8ad6e60de11ec5243d5c374f1124ce66f7894d2cf4ad8aff22bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046576, "uuid": "be0fde33-625e-40f7-94da-9c9e3939a318", "value": "T1FAA42A8C97F19BDFE06DDD3063296A171CBE493770E377A6A17DE86232AB14405E7820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046576, "uuid": "4b88927b-af1b-46ac-bb2e-32a89de326fe", "value": "6144:SFPWLROGFsrR+uI3eLxTaN6+gDyyOdI7/4CPyLFDr2Laoja9QG:hdOGFsouRx+N6hCQ0yLaoja9QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046576, "uuid": "618e4d8b-33a3-4035-927e-c99c22593418", "value": 469288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046576, "uuid": "cb654401-fb54-4ca0-a900-5ceaafdd7157", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046576, "uuid": "9d8a064e-30c2-4b8e-aad7-b7d97efc6fd2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c2984a-916c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786003012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003012, "uuid": "8ad211c2-9fbc-4b6f-8a6a-11d4659b4954", "comment": "Malware payload", "value": "1b01c56a2534756c2635aee816f3b0d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003012, "uuid": "538ed293-b427-460d-93bf-81b71074dfa1", "comment": "Malware payload", "value": "76f4cff23b97b5cc222d0183a9ece353a5a36cfad2e722c6a7e00f47bf3137f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003012, "uuid": "e3c9623e-a550-4cb7-a14f-cd0927606c57", "comment": "Malware payload", "value": "a00e01aafc482b01b9a5487aa5b9d92fc06ea9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003012, "uuid": "3c0cd9d0-abc8-44b6-8a24-5bfe3566b57f", "comment": "Malware payload", "value": "51999ecedeeebe539458c1708414b050b8e2afddd442561cf429a134af663738814daa4a61e26e8947c9aeb0d662cbdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003012, "uuid": "e716e1a1-5198-403c-9b47-300d8a5f02df", "value": "T19AC68C73914238D9E5A88DB4D11026526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003012, "uuid": "5ac6d8ea-b527-47a5-9815-3f945dc7c430", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003012, "uuid": "ba10c3b4-af26-4b16-b995-e56666584854", "value": 12222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003012, "uuid": "122bcfb9-e0d4-4ab0-9b12-de34fdb3669c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003012, "uuid": "274ec2c1-f54b-4fc7-996f-96711ffbb348", "value": "76f4cff23b97b5cc222d0183a9ece353a5a36cfad2e722c6a7e00f47bf3137f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036a9a4f-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048379, "uuid": "0730db5b-9a40-4a95-a98c-075d78bd7425", "comment": "Malware payload (Mirai)", "value": "dc599e2e98cb5f28d33919df0719fd07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048379, "uuid": "0829ea18-193d-4d2b-b4ec-1c08f57e373e", "comment": "Malware payload (Mirai)", "value": "76fc3352f925411aaed817a6e00d4e3c467d2765f533966560693bc7dc3f8e11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048379, "uuid": "c8a37444-2eca-473b-9843-0b52519c8c50", "comment": "Malware payload (Mirai)", "value": "5917aa985b962245bf83b9107fd19d54eb990f7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048379, "uuid": "e747b729-fb70-4207-94b2-e4c9247c0810", "comment": "Malware payload (Mirai)", "value": "e0e1d9b75a26b14c27f51a1ce270fbcdd82a17e33b49c2fe09f5d375b2b9b95bbfeeab13bcca131ca8f92a926dadb650", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048379, "uuid": "9a6374b7-eb8f-45df-b88a-906e5ed99888", "value": "T1F234B91A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048379, "uuid": "042e86a4-e0c1-4ea6-8edd-b254dd66454c", "value": "6144:Mrn8504EgAPXX3J5BS6FpBp1J8JG8WYkQsxNenndQ:d5044XNpBp1J8JG8WYkQsxNenndQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048379, "uuid": "3404e8b4-e803-4980-b394-3194700a9bcc", "value": 246187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048379, "uuid": "9a049495-dd23-4685-b94f-35266672f474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048379, "uuid": "0d1dc2db-352a-4625-b6a0-5aa5fec5b99e", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84eb4694-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786026692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026692, "uuid": "9230d531-3619-4a52-8aa3-880e29e0f4bf", "comment": "Malware payload (AsyncRAT)", "value": "36466886134ad2cfc48b812a41b64785", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026692, "uuid": "0cc1c61b-a853-4bc6-9678-e46ddaef66f5", "comment": "Malware payload (AsyncRAT)", "value": "774abc6247967d4f39888db18cce6c42f70f12fed58caa247b7cef14841d5d6f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026692, "uuid": "aa402c5a-0c07-4070-b6b5-0df8a549738f", "comment": "Malware payload (AsyncRAT)", "value": "004c063befcb6038f245fd9644d8d1ff34aa1acc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026692, "uuid": "f32f6d07-13ee-4f81-8304-c6cc1fea66f1", "comment": "Malware payload (AsyncRAT)", "value": "d44867cd4dda68c1ad1ea5558ca9e0acaf92dcd8af10b5487df9178b41c04bbc57e6ad2ef2ec011e9e7b7e0288bff966", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026692, "uuid": "196bbd4c-a2dd-4b1d-81c2-5bd7623f763f", "value": "T1C183EC4559967080A3776BBFA22B98D4E777076702841857B87C7840EFF1D09EEE0CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026692, "uuid": "5fb2a653-a26e-46bf-b395-b0a685ae1c60", "value": "768:YcrSPg4w185ip6/buzwqF//oSh+BXPtMnsSoxpPk6U42w40M1p3XaLCljf3ZFaki:Xgkp6/owPDDBDgDFtFd+kE7z+XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026692, "uuid": "470f370d-f778-49e4-90de-83e0d53c8aa8", "value": 87272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026692, "uuid": "16992873-eb20-4cdf-b6e6-de7a433f4633", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026692, "uuid": "28795e87-acde-44f4-975e-ca504cf075e8", "value": "PO#098765342.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a855d909-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998834, "uuid": "abcbd2a2-b49d-4a50-9f13-68b6549f62c9", "comment": "Malware payload", "value": "b70797be1f8fbba5fb3e38a60b7e2642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998834, "uuid": "a503d24a-426d-4e66-9135-4bdc882cdf47", "comment": "Malware payload", "value": "7795087552f5daff4002e6faa1b3ce67713059112355a592fb7e3b76a2da6a02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998834, "uuid": "185c8172-392c-4759-b2f2-a8cd53195720", "comment": "Malware payload", "value": "4d294c04710f39e489cbc82b462909c3e4d4f321", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998834, "uuid": "a403418e-318a-4910-a9f0-37bec595e100", "comment": "Malware payload", "value": "d75dfe896e4ef3a72f969b064e0e3e23fcbee928d114c65989751294afa17581237433c4b93263072be4925f2d08f053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998834, "uuid": "eb7af10f-c694-4f4e-a906-b758aa0066fe", "value": "T1BBC3120610E5A69AB23204BF8E12EB9627874F7AFF7A31D306345316FD5268831F548E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998834, "uuid": "0db00583-c86b-45ab-8026-087f5e70f83f", "value": "3072:9AwDWwlXi/F+XDbpgKvhJimm4Q1cax69dIGFm:nDWwgt+zasZnQ1Z69dIGFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998834, "uuid": "d4ac4d52-29f9-433b-96e3-605f2aca99bd", "value": 119636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998834, "uuid": "1e8a344f-6e75-4453-b615-bba697850625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998834, "uuid": "e30fae7d-3410-4f78-9fa9-f0fbf2892a3f", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d30112-917b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009485, "uuid": "e4f51936-1440-427f-b114-607d1e99723a", "comment": "Malware payload (Mirai)", "value": "f4bef8d409fe0292e2e25c68264f3f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009485, "uuid": "b0d761d3-d580-4d44-be45-cf40b3c3fb20", "comment": "Malware payload (Mirai)", "value": "77b199ce132fa548e4ac57f8ef90beafe4c619b3257d1c0ca12a1ac414ecf0f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009485, "uuid": "3fd95047-492a-48ab-8d52-f99548250b7d", "comment": "Malware payload (Mirai)", "value": "275c18b1be8f4153fdb40a4af74098eba07aa99a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009485, "uuid": "cc0fd82a-faba-4934-94fd-dd1ebbd5a081", "comment": "Malware payload (Mirai)", "value": "f87fedb987cc1f6360b071dbe6ee335906ed4f7528f2b3d691e751e8e6efb9d7c4eee40da735263e91973bfed8314d5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009485, "uuid": "489d336c-239b-475e-8bb5-2cb9318fab30", "value": "T17182D039D15BB918D8B00436D7B8C08AB6F54FBC84F5752221A5EA3C634280FCAF61C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009485, "uuid": "e05e938d-6e3c-47a0-b25a-c475ee3993b3", "value": "384:Cu2Dku9zG9mnH435HOa6DOTJulDsmWpXPthymdGUop5hIE:x2DvCUHc5Hj9YsmWpXPts3UozaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009485, "uuid": "00ea705b-b5d9-4ebc-8dc4-51479544bcc1", "value": 18588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009485, "uuid": "d76706db-040f-48f7-b18b-88c3d487e1d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009485, "uuid": "98ea3b6d-6427-4196-9f0c-c42962f3db10", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008d34ff-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786048374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "afdb4640-e66a-4dd2-a06f-26f33f3ce9b7", "comment": "Malware payload", "value": "314e1ff492d9a2c421ad93d0d841214f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "f15f9db0-edb9-4130-8e27-d671818f3dca", "comment": "Malware payload", "value": "77c7c8adfbcce242cd35534b8c94e899285bd0b2a5a7f06ff5d91ab21933b34d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "038e9de3-e9aa-464e-b87d-c505c6a1a73f", "comment": "Malware payload", "value": "77e507810b1f13858caa2840e5eb65a978177a7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048374, "uuid": "404fcad9-caff-455a-ac96-aa80ae4ac640", "comment": "Malware payload", "value": "16f55c82c271710fea4c2298fbd80bf3abff1227cdccce2dd4b58b6c5f6249ec6791ea8806d51c008d06a472d1c4ac6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "0c70b3b8-dd49-43fc-9f8a-631a40e6f7f4", "value": "T11E31429929707E31828ECF0DB0E146A45247F5C6B2934BF2E5431D29A8DBE40B417B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "9fae9332-97d9-4edf-8582-d588ba692a95", "value": "12:7kft0dt6hbNaKjT6dODOqaDU8fGMGTK1zk1ZhVbcVb1LBqhN0/N0KvtIfse77XGz:4fCc3FHDwjYKxkpCe2/2MtcWgxID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048374, "uuid": "45eaf0ff-fe3f-431b-ab74-7562ff84ded7", "value": 1848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048374, "uuid": "c75239b0-3646-4214-9085-b9a25104f925", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048374, "uuid": "76a04760-d6e5-4afc-b064-9af70e8a9f40", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f33e40f-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026091, "uuid": "1208bba7-7a4f-4e56-b1dd-4625472ce3ca", "comment": "Malware payload (RemcosRAT)", "value": "ccdb61148960b94f52b40592f03af119", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026091, "uuid": "058052a0-bde0-4772-9b66-17df98af2e34", "comment": "Malware payload (RemcosRAT)", "value": "77d1ccd3b57dea0ff34ee568a1027cd8ea74f14f3580acbc0aba8587f96f7a6c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026091, "uuid": "d62ad903-1b7c-45f7-81db-5e084832c7b0", "comment": "Malware payload (RemcosRAT)", "value": "c90ceef8e350611afb26eddbe46061352ccd7646", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026091, "uuid": "7a86be45-c097-473f-99f2-92b99b664be5", "comment": "Malware payload (RemcosRAT)", "value": "dbe80c79af2a1d5bb749d0133e06b9fb1c295a5e364046cf3eff8fd499dda5a28a8f1ab4b6fbd3707743ab28eacc1418", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026091, "uuid": "6329e483-74a7-430c-9f02-c9cab9cfb029", "value": "T178151211FF805476C9825B390FA3A6D1D90CBC5B9E6A0F0A27897339783B7F4D962C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026091, "uuid": "72b0eb67-c453-4df5-bae2-29095256cf8d", "value": "24576:CKpt1QRT/64rm4u1UiVN37YWczoyf9KDYgWikRMHRU2/Z:CKptmB6au19v37YWczok2YgWEHGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026091, "uuid": "f400c82b-d93c-4f26-92a3-612b764de5ce", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026091, "uuid": "092cc9dd-3395-4654-a781-5418816a8515", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026091, "uuid": "9c7cbed5-378c-4c3e-a7a5-380026328e19", "value": "PO003302204082026_Product_List_Request_for_Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5291734c-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048941, "uuid": "04bed89b-53fd-4b43-b727-8e23301e6bbd", "comment": "Malware payload (Mirai)", "value": "5c20d4ff4199022568cd95db1bfe784a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048941, "uuid": "e04389f3-2ed9-4de6-a5e7-9b10e60afe13", "comment": "Malware payload (Mirai)", "value": "785331dbda750708b9bc74228d4acccd559dc4e95a72883d501ee3c07cdc93e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048941, "uuid": "d2a04daa-8690-4b4b-ab14-25f04eb09487", "comment": "Malware payload (Mirai)", "value": "31f02d96e08464bd552a0d5437f2af163f66eb53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048941, "uuid": "572a95ff-e705-45a2-8b33-492a39f7213b", "comment": "Malware payload (Mirai)", "value": "ce6a167c8b0aa74c0770f5dd098b1f818f6d130cca1e4eff9ab000987fd2f0872e1ee03f8933fd27731ae9b1c14d8d10", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048941, "uuid": "f1d4f1f4-13c7-4a0c-a7a2-4f86d43bbc17", "value": "T1AD730266217ADEA2D5B2803363477D49A923887A037453FDFCB9A71FB486E115C0C4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048941, "uuid": "a2fcd2cc-8ece-4585-a9a1-1068568a9ac3", "value": "1536:E8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmkp2NorJ:LzRnwP0bMQ2RijvDZZ1rYGhG13kp2NSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048941, "uuid": "95c80ab2-9d8e-4f30-9dc2-4685113f3ba5", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048941, "uuid": "4422091a-ce2f-43be-9191-df88c5bb70af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048941, "uuid": "7a9e9519-edd5-4651-bc03-d4d18eba4191", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc37e0f-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004081, "uuid": "33868e7c-5120-4e2e-a737-87140f7103b1", "comment": "Malware payload (Mirai)", "value": "73e4d5ed528c5e2a9e5f4937db1d1a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004081, "uuid": "75797839-ce59-4d76-9298-c90eafa07116", "comment": "Malware payload (Mirai)", "value": "787d49c6b8a23eba58b6c444b1dad7a4ed02f1ec60269277000a608fbb0ff764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004081, "uuid": "134bd3cf-e260-48de-af48-a18e53ce4328", "comment": "Malware payload (Mirai)", "value": "5cca42d3b37de4338dc7a67e7928fe97f42f2d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004081, "uuid": "ddab524c-bcf7-4979-b143-8cd19aecb063", "comment": "Malware payload (Mirai)", "value": "597f6a0b237187d26e396ab98668f7a049fbd8f72323f49fb4ece770adf243581bb900cc22716d059d2e08b0c8938043", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004081, "uuid": "8b273470-138c-4d58-8995-bc9cd599af47", "value": "T1DB23F891BC829612CAE423BBFA6E41CD336563A8D1DE3213DD222F1177DA92F0D7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004081, "uuid": "2df9328d-e691-4f1c-b36e-3857608be1bc", "value": "768:3GxYaR13QoN9D6WDZVK3ojt6ynQEQKWkK3Y0O47h5EbRFjYK9Y4V0o13HPNTy9ir:2xYSt+WDZikK8799Yolg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004081, "uuid": "6772612b-22fe-4c72-be40-a1394eb7565d", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004081, "uuid": "48b9daf6-7939-4469-bf34-661d02c63938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004081, "uuid": "29635558-08bd-4f5d-8c34-8f194fefdc16", "value": "d237c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8b1a4c-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786021849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021849, "uuid": "560c553f-c3d8-4445-b9bc-fd224d359d0a", "comment": "Malware payload", "value": "de02de7f3ab61a945339ffee437ef80f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021849, "uuid": "2a9cd013-56ba-495b-b1e7-14e8df4ba1c7", "comment": "Malware payload", "value": "78d3bd95ab0273aa6543b806f4d476ead5327f5aeb26be45a48b32f25b4a94c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021849, "uuid": "107a5074-14d4-4ed6-a9b9-b9693b7353bb", "comment": "Malware payload", "value": "b556098cd3f940edf7cd83eb14e747559d8f74be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021849, "uuid": "64001567-ff8b-443b-949c-aff955b9df18", "comment": "Malware payload", "value": "5cafc8c11540c74176dcaa9f84e0eca2f33fb4d04c0d4e181797f85647c4ac9b7c40d2a6e75c92e4be7f6ff8a4487eb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021849, "uuid": "010a6575-c955-4073-9d0c-a1ecda524e0a", "value": "T180236D6126857C14AA99C4371D7E2F0CBDAD43E6320452EE7FCB3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021849, "uuid": "9eba9a64-3aab-4313-aa70-51af73124e92", "value": "768:X6rDTPjH49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:qr3Bcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021849, "uuid": "a0a21f70-1027-4ed7-8b68-62d41ed630cc", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021849, "uuid": "b58b8b96-faf1-44d8-8329-7d081bd500ad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021849, "uuid": "07d327c9-6d69-4399-bd60-12fd82d81b11", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2fb620-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996184, "uuid": "f5589e13-5c39-40a4-b210-3dda870da8c0", "comment": "Malware payload (Mirai)", "value": "0c62d9d088cc63478e35331f30789a61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996184, "uuid": "b9f58ba5-4925-4460-9d4f-5d3665d228ef", "comment": "Malware payload (Mirai)", "value": "78fa8d2638113db18043e79d3122a69b48b7d62cbe438480a625f6fe255b446d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996184, "uuid": "b76869ed-35d5-4bbf-99b8-2b9cfd01b086", "comment": "Malware payload (Mirai)", "value": "8c17cb3f3717f7a30088796ea9239df31ffbfb2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996184, "uuid": "53401dfd-6c81-40a3-9ed5-65783c85ee2a", "comment": "Malware payload (Mirai)", "value": "950498f483173e1425d1cb26e74f415bc985c0dfd3a5b5045e43d377dd9306fcf1588e70ecdbf319b533660f479c5c4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996184, "uuid": "3cba1d22-ccf5-46ca-b455-3e98dbd7ed96", "value": "T175A3EA0AAF611EFBD81BCD3705AD0B0278CC951771583B767538D928FA4A94B8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996184, "uuid": "bcb61ac2-50af-4f74-a8ba-dcfe1a0ebb95", "value": "1536:Z/QBJ9yN0IRx8BOUn4EzEpm9TAR3AuSkxdt2Fzg3p95ghZp2yYuy:VQIuIRxmOU4EJcAw3Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996184, "uuid": "6c84144d-edb1-4d87-8c51-be1367c77ebb", "value": 102560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996184, "uuid": "4ad979a2-b170-4d5d-8410-8d8ce64aacc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996184, "uuid": "65958d42-f7a6-45e5-beef-a4e509b65f93", "value": "Nnn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d81c8ee-9141-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785984642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984642, "uuid": "ad33c700-6fb1-4d92-b3fc-bab24511d045", "comment": "Malware payload (Mirai)", "value": "8d1b2045be2a57ae338568e26503284c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984642, "uuid": "68503f9f-9f72-461c-9126-bdeb947dc4c7", "comment": "Malware payload (Mirai)", "value": "791be1e6f2839b929c5c6e65cfed9f27d16789e36443dfdc852051ceb53b5745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984642, "uuid": "0a86b58e-7920-44f4-882c-9b0fa172f0b5", "comment": "Malware payload (Mirai)", "value": "e9af8c608a09363932cc6b74a992e052d7da6a28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984642, "uuid": "7e6ae5d5-61a6-40b7-be28-90030cbc7a6c", "comment": "Malware payload (Mirai)", "value": "d14b73c6d510d7861f4a1f3a3bf2c95376df5fcebe0b0aa2e80475e268c79866b06fe0e6b382263580c556c2f2b6dc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984642, "uuid": "30eab741-de7d-417e-a2a2-ac53d17f7ac1", "value": "T160D312D54F48188EE537E234A6876324BCFC6BF2855BFA0057C85A691F5BB13F886390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984642, "uuid": "28fe0af9-e063-400c-884b-c1da914e2259", "value": "3072:6DNAIQLFGBMkW3TE2ESzXVGQFM6dCbyrQLRJVcs6jAmjpUVH:eAIQLFXZ3TE2ESLVG5hYQlycGKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984642, "uuid": "63b20df6-8580-43f2-a0f4-bbf9d9a29087", "value": 132532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984642, "uuid": "bca943ac-a170-4091-a060-9f20fb66a630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984642, "uuid": "d3190d87-946f-416c-aa8d-a2d913c1d054", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7def9720-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996186, "uuid": "dd1e9ea0-493a-444a-b6db-0bd739b62d81", "comment": "Malware payload (Mirai)", "value": "b681c094258e5b50d86d02393eefe3bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996186, "uuid": "40a38539-0089-4780-a7e8-826ef1fbce21", "comment": "Malware payload (Mirai)", "value": "795f15c33be53446eacde438383231e0197cebe8ac54efd2290acecced237b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996186, "uuid": "e3ea4911-d90c-4776-a290-236abb8caa07", "comment": "Malware payload (Mirai)", "value": "4dd9bdfef1cc92ef9426c6f4dab416f75d3c838d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996186, "uuid": "ad6c0b56-bb41-4372-bfaf-cc0be4b0734f", "comment": "Malware payload (Mirai)", "value": "354fca6f3f06364c4a23f91fb9b81d5af3675db603384c07e60a213b389d68d07262d74e040eff98d94d369383e1a502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996186, "uuid": "7f6a03b8-44fd-4260-b0b7-fbc5dd09532a", "value": "T12683181ABD419F15D0D526BAFF5E528933532BB8E3EE7212DE146B2427CA91F0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996186, "uuid": "155925ce-b07f-4f1f-b2d0-247d9b352e99", "value": "1536:oJnW1OZbJ6X8dVNuGrjR19RfSuvTvB8JYz/vandZ60Y1dlH5ib1uhrxb:31O9JnnDvB8JG/vandZmxuuhrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996186, "uuid": "04d9ca4f-c33d-4db2-8edf-15d923be915c", "value": 86156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996186, "uuid": "f0bb5540-8df5-471a-a9b8-76b4f518e3b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996186, "uuid": "2dbc8a00-19a8-4188-a68c-b0ffc84517ce", "value": "Av0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a9b4f8-9143-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1785985273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985273, "uuid": "3fa39a02-fee5-48cd-9b04-0f9d3382785a", "comment": "Malware payload (GuLoader)", "value": "fec9198dac87022d7c6fc56e1e18ed62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985273, "uuid": "d0c79a9c-4342-422f-8758-d69280ae97de", "comment": "Malware payload (GuLoader)", "value": "79a184c05789e4479d16d15a22206de124b2102b861dc4ba050c2aacb3ef834e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985273, "uuid": "51739c74-b6ed-47bc-a142-cd64c58c543d", "comment": "Malware payload (GuLoader)", "value": "4beb0a2628da83bb6b0bf15ba48f36343db3666c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985273, "uuid": "373e0b52-d0ff-4999-bf5f-0cec0058b14d", "comment": "Malware payload (GuLoader)", "value": "6b575ac3efb98f48ba908caf771b8383e9e11825ede9b493fa57c9acedd4a71c4e323f1880f5255c0a2cce29c0607f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985273, "uuid": "9f128088-1cbd-4edf-b9e7-79020cf31078", "value": "T1F264C091724494A3C97007B049BAD53652A15E2DB9B1D20F33E1BE6FBBFE3C31A16607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985273, "uuid": "789449b7-6f5c-4dfb-a150-7954831c6274", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985273, "uuid": "9ecbfa63-a7d6-41c5-b0c8-ec8f5317b2cb", "value": "6144:ncBvWHOjyRV4zuAtanxSce0eutJ+p3Yw2Iva1NlTA:cSRWzuA25e0fJMZ2IC1XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785985273, "uuid": "b9878ae6-f64c-41d6-a828-7aad8fb73d15", "value": 323664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785985273, "uuid": "fd56c538-0238-4707-b097-3d943f3fe1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985273, "uuid": "489670e2-9250-497e-ac22-4942e6832ebe", "value": "rDetalle_Visita_I_137894350961234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021b61db-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "5e80dc3f-8c52-491f-925b-7f83449bc0d8", "comment": "Malware payload (Mirai)", "value": "de401d6ee7a0630525b91d222b037c37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "ddd0bee8-90a7-4593-b40a-dc5ae7c7346e", "comment": "Malware payload (Mirai)", "value": "79a4cf16c415b1251c66f0e0e6a22bec3399109a7bbd2feff5ada0026d312f76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "c48350c6-448b-44b0-acf8-c2e46c513432", "comment": "Malware payload (Mirai)", "value": "1d6ab727fe6fc49c0043906ca551c70ffc07f266", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "f4fc0e27-9e2c-44f6-b11f-975febde96e0", "comment": "Malware payload (Mirai)", "value": "9b0af264bdfd5f564bf31e3845065b102e35fffcbdb4caa49801373233c762c24338a6767e10d9364eaae07f2a9238d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "c47a15ea-281a-4ecc-9489-13b517d183bc", "value": "T1AD0419C7FD00DEBAF809E33748130809B130B7A254925A777257356FED3A295197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "2a708f21-7681-4623-809d-9b7e4f32666e", "value": "3072:eHZfBJkVNDUylnTzBMuffmEUy/sKd68cdKkGDJeRVFbkwbVpjbidLkGlI5p6d:LDUgBYy/zd68cdjGDkNkw2Lrmp6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048376, "uuid": "845889ce-24c2-4a9d-bd03-9bc20a8148ac", "value": 182244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048376, "uuid": "454e7cf3-5ed8-4584-abfd-368a10b4e908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "68fa6320-9514-4405-8ef6-53c4831f2a0d", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd6f18f-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996236, "uuid": "e02d9b98-cc8d-4fc8-b38e-74117ed03527", "comment": "Malware payload (Mirai)", "value": "653f8f22e0c64b68a2d618943b66ca08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996236, "uuid": "56fc6bcc-0333-43af-86ce-62e173981a96", "comment": "Malware payload (Mirai)", "value": "7a40b0c74e2bf4821345a948421e3f2bb0ab7ff0d954a4e824c5a634c261aa1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996236, "uuid": "fcfe92ae-40f7-43b2-9fab-295be30f97a2", "comment": "Malware payload (Mirai)", "value": "2dde03cd96e390ca94088f8b4b743886614c35cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996236, "uuid": "226e4eab-e5df-4769-8c67-c2047913c515", "comment": "Malware payload (Mirai)", "value": "90496b323cc018d5b7db40ac0905560a2ccafb37b45821cc7a80ac5c2fff9639491b95d2b2269147ef9815e5226c55e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996236, "uuid": "f5368f3f-f30b-4460-abd1-80c0490bc11b", "value": "T1CD24298ADFA51FDFC46FCE30061E031715EE599B93F16336867CDC58B68A2094AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996236, "uuid": "0cd12c82-8517-4256-81da-71814764d743", "value": "6144:s44ZfFemPSGncUtSxfreVA9xQbBpKBDgNR3g2mujdeOXdvSaHnvvIVm+4+Mpn3:pmbBsDgNR3g2mQd1pHIMTpn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996236, "uuid": "70f9a6cf-b479-4097-b795-a4bace90078c", "value": 220412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996236, "uuid": "cf03df6e-3bc8-44c3-9980-2c04a1737fe5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996236, "uuid": "24fab590-1980-48fa-a0b7-0a8e57ba683a", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d7078f-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026960, "uuid": "7c7c360c-1cc5-44f9-848a-e665b5dadd22", "comment": "Malware payload (XWorm)", "value": "551ce96e4fd2d116496397596bcb47b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026960, "uuid": "3fd82396-39fe-4ac4-a17f-00e5f16b21e4", "comment": "Malware payload (XWorm)", "value": "7b39640545ca6bd532f9598c69ab8d681513a91580f6c277aee4de5afc21637d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026960, "uuid": "1dacbeec-e68b-4460-9efa-05a764e0b5a4", "comment": "Malware payload (XWorm)", "value": "916a7895f935fd385ef916a01e0c3d3b3fc9737b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026960, "uuid": "b2b75360-7550-42ea-956e-b51f8aff704b", "comment": "Malware payload (XWorm)", "value": "841102dd50d8e4d74026db73651cfdc18082fd9612072ac3e452a2f590365ac4ec3376b687d2d8300e2b05ee47155b9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026960, "uuid": "cb13e93a-d65e-4d5f-94fe-26f64b2227c9", "value": "T1C0431D3700478D2AA6B0721068053F7A6E1FE11DF19067EBEBED8247BB136BD4D5B858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026960, "uuid": "9538655d-ee53-41d0-b6ed-a6231be888f0", "value": "96:heaKe8eyezefeHCeGKe8eBeTe1eTeBezSKe8eElssg76ffF988JF7f928FNgL82Q:BGjWZhwDmp9Xkrz8QaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026960, "uuid": "97b5f2e6-0a24-4dc3-a83c-cc79902143ab", "value": 58164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026960, "uuid": "b5a0c08c-d7b0-4472-a773-7c4bb6fa71e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026960, "uuid": "9321c8e5-ee7d-401e-af71-59b14384e75b", "value": "proof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bf348b-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979611, "uuid": "0d999e1b-1d67-462b-a393-fde1625a772b", "comment": "Malware payload (Mirai)", "value": "71d0a0a009f9260d7d3b7eb19c2b612d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979611, "uuid": "f9798743-a2e9-40d1-ba5e-ec2fb5ba9438", "comment": "Malware payload (Mirai)", "value": "7bbd6d4cf4bb82ee90515cc745379bfb2d73ba8d9d92c839896023b6386f9c04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979611, "uuid": "b9388029-8c94-448f-8b6c-aa730986029b", "comment": "Malware payload (Mirai)", "value": "d5ea7c5bdf4211be32c1e99bbb94e4a7ea2e0a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979611, "uuid": "66e96ecb-b805-4da1-909c-900491e22711", "comment": "Malware payload (Mirai)", "value": "cccafa9ed152f8884dd7c520e97a2a3b138adf1912a3ff2fc6410ea154da20e99c972cfaa042ef58208e2dcb9556f9a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979611, "uuid": "c89b50d1-69d5-4b37-b75f-b14bb879f063", "value": "T13F148E00FB185953D1931DB45B3B0776E37D9C8318B8E019190E7B568733EFA9A87B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979611, "uuid": "3a25d6f0-9eaf-44af-aeeb-4c4bb74a7625", "value": "6144:PN3KQIlteuY0SMAQWhWICAIQiwGSOvqHzD4:luJApLiK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979611, "uuid": "856b715a-f278-4d60-aee7-eb868cacba00", "value": 198020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979611, "uuid": "0f406f22-db4b-4005-9379-8437d929d715", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979611, "uuid": "ea001d36-2386-4560-991f-102e64c9a3b3", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcc8c73-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004077, "uuid": "151d3a76-b2ad-4ab5-a1b0-dae9ef88c22e", "comment": "Malware payload (Mirai)", "value": "853a9d2f283eca52b91583b32162e891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004077, "uuid": "de8117df-c8c7-4075-aa9f-17b9ac6952d9", "comment": "Malware payload (Mirai)", "value": "7be63c754dd5a655cd487583e06a293d04a8042cb60b13356fe7f841403e51d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004077, "uuid": "4b9990d3-7168-4b7d-ac22-c3092d003245", "comment": "Malware payload (Mirai)", "value": "9c1d8798ef83f854a48cc1b7ec9fced5b8c0f137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004077, "uuid": "6f32da1d-895a-4356-86f2-5d322fb3dbe3", "comment": "Malware payload (Mirai)", "value": "01f0309d6b37c979e5db4701a4b6a927225c02d1bba6e4948d6466953fd74d770808ff7d9c12b5383194c002c59586ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004077, "uuid": "6725db15-45af-4fff-ac27-e96e7e8a64e1", "value": "T1F4138FB7C86E7EC8D15946785824CA7C0B63E505D5532EFE969AC8964087EBCFA0C3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004077, "uuid": "7406be13-1277-45ac-9b2e-0c52346c5be5", "value": "768:7PmYl/DlwwtCTzlb5vH5yxIpe2l/g0M6PNoskqhpN0CUoW6cCv:7Pf5wwtCHlFnpte0M6VkON0U5cCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004077, "uuid": "e5176fd6-ab17-4b30-ba88-e9542616a3df", "value": 43868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004077, "uuid": "c0d69c4a-0518-4d76-b1f9-0413209e6e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004077, "uuid": "c0dfe439-412c-4181-bc1f-b73c77a5e340", "value": "90a07f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d723b85-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785996238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996238, "uuid": "2d10292e-c556-4d7e-aa8d-1aa12d0cb07d", "comment": "Malware payload", "value": "5624f349f745dbd2b87e63b1e5d01fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996238, "uuid": "1e2212e6-cb06-4cf7-b6d1-d30236ed4371", "comment": "Malware payload", "value": "7d82928ce1ff15b67c227c69971ffd550adc4ac6446d503e24dc7bf9752bb8f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996238, "uuid": "43df3512-aa2d-4e56-99f8-3dada1d6fde3", "comment": "Malware payload", "value": "b55d2a4a98375d7a4fdd00a5bc5f510941125097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996238, "uuid": "22c951d3-eb2e-480a-bc7c-5b0a7ea4e092", "comment": "Malware payload", "value": "5895bc2aadb1462143ed6b2a74061a3dbd322240527ea2dfc6ed96d6f2d954f77cc614ce7529ae2573ef380d84e61aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996238, "uuid": "7fde00fe-8dd5-4695-a900-7056d1985caf", "value": "T176D60233A189602AD06D563745B79285853B6E687C218D1DA7F03D5CFB3F3A03927B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996238, "uuid": "36be1ee2-f2b8-4223-b9f0-fd76eff8665f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996238, "uuid": "fa7c4b81-a7fe-4365-9fc8-8d0673f3d853", "value": "98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC7YqI1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996238, "uuid": "db2e6c8c-778d-48c2-b190-7a28cacd20a0", "value": 13702473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996238, "uuid": "c87d0594-a0d1-4cee-891f-33a8e37a4181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996238, "uuid": "0577e768-b3b9-4b73-a808-0b9d6bc4a4ea", "value": "5624f349f745dbd2b87e63b1e5d01fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783bef17-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "ec1a2c1b-4707-4f5b-9e01-ea1594b9013e", "comment": "Malware payload (Mirai)", "value": "9c2f8a7b107732a09befafa998c46a49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "cbf539f7-bc31-4274-aeb2-86bda820a0a3", "comment": "Malware payload (Mirai)", "value": "7dbf43d94d677fe063b2d04ebee0fdd10f52651876804ed745a0db2f45cae6ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "b1383101-89db-47dc-9b44-f4c6ce877a79", "comment": "Malware payload (Mirai)", "value": "e74e8ecf675f186ba43f36da2a61344ac6a94903", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "31e84266-fd61-4ac6-a9ab-4c26d9c3f5a3", "comment": "Malware payload (Mirai)", "value": "61a71aca2f1a4cc3a61d9caa4c86834347cf626f49d192276ad9a020d8ebdb04eb7e34acac9fa4c5408505b84a7acc54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "b04203af-2b6d-480a-99c1-b6af9387f0a4", "value": "T10A257C6AA2A3B1BCD103C03057DBCEB25931B47512216EBF66C4DB353E65DE02329B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "26e72a40-5006-4fed-a386-728bd56b858d", "value": "24576:i9UrMTDsFPHNd/vTJbRmQcNNWiFxcdv6rxPuCYWg:wjnNWrdv6NPua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030965, "uuid": "8b54410a-f9dc-408d-8483-80daaea9bbe4", "value": 1039928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030965, "uuid": "7a7867eb-a3cb-41da-8ac6-1b55ba7771b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "126c8d8f-b0a0-4fcd-9d20-f5015d29b116", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bc252f-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021995, "uuid": "7e56fdd0-fcc0-4308-9612-4c7adb533a42", "comment": "Malware payload (Mirai)", "value": "e5732b63eff28b8a5f17c5252046b262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021995, "uuid": "91d1b666-3fec-4408-b935-fd5c890cfee2", "comment": "Malware payload (Mirai)", "value": "7e77daab048b12f2251f6d67f90fcd7a7810a798c2130006258340db0fd28217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021995, "uuid": "915af3f0-1200-4dbb-b122-73d4ade9106f", "comment": "Malware payload (Mirai)", "value": "649a367a77a78fdeca74d190d41b7d9b31be1d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021995, "uuid": "d9b6fbab-7994-40be-b2d1-cb0270b25ca8", "comment": "Malware payload (Mirai)", "value": "8b42c25f21bc41e28aa29bab9796cb46bf04b8571c6aebf9d19a76951080a300bc79b4dd1ac000f44d80aa64a08b25e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021995, "uuid": "e466bd55-b3c6-4056-9610-5b1a027e793c", "value": "T1B653E60F7D1ECAB2CA919634C63F00511655CB5158BB9F323ABAD61EDBB212BD3178C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021995, "uuid": "9b5e629f-1864-4e50-823c-7890b90f7ba9", "value": "768:A3gGH4i9EXt8bv7tU9dOmgFcw6dc+VNrbmJHA2tUzHiUNR9BTv:AwGj94y7tU9cYdc+vEA2tUzCMR9BTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021995, "uuid": "fcab20da-363f-4db0-bea2-a0dfec5520a8", "value": 62120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021995, "uuid": "a5d7c7b2-5815-4096-95b8-3d650f54f763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021995, "uuid": "013d2e33-74f4-4c64-ab9c-c5449d588dad", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01863581-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040645, "uuid": "29586141-e379-4d5c-83ef-33bf271de820", "comment": "Malware payload", "value": "388174098637e6f82e5a98f8943a6035", "object_relation": "md5", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040645, "uuid": "7fcdc476-2a23-44f8-ac02-3df1180ee5b9", "comment": "Malware payload", "value": "7f06c47b2e6298cd39b01fbc728f6c38bef1fa7d7500a011e58ae719451cac0a", "object_relation": "sha256", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040645, "uuid": "bdf22b0e-9fdf-4663-a254-6cc489a22669", "comment": "Malware payload", "value": "8dfb301b28a2bdc8cfb5cb744d5e14892ecb0e45", "object_relation": "sha1", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040645, "uuid": "6c8d88c1-3805-430c-a7f9-675711d01d0a", "comment": "Malware payload", "value": "9e89ba959a879b921fe562b0c025e90517cea6907d9a48557cf70b4752251763a43a30c12785878b9647f070998eaf13", "object_relation": "sha3-384", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040645, "uuid": "cef87ff5-e817-4be6-8e00-12e95720b200", "value": "T10E431807F592D4FDC096D4B08A9F5127EAB3B4A852723D463FD86F352C6A8284A3CE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040645, "uuid": "877b592f-8560-4b76-a4e9-1656625922a6", "value": "1536:RWYmUyx81slg4UdWtbg704+wCtDapm+WH2uMAm25+VL:RWjUyKslmdWtM70eCtDam+WHJMAm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040645, "uuid": "bee33774-3531-416c-9be1-32cf1165ed87", "value": 60592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040645, "uuid": "fc447a64-1111-4ded-abf3-cc7c3b59d495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040645, "uuid": "7edb12ae-ac94-4504-8a5a-0eecbdc923b0", "value": "7f06c47b2e6298cd39b01fbc728f6c38bef1fa7d7500a011e58ae719451cac0a_from_104.156.150.223_redis_set.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8488f0-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005469, "uuid": "6edffe75-f523-4a1c-9e1d-f1ae12106ff2", "comment": "Malware payload (AgentTesla)", "value": "8b894f883a669bc1078964eec3647059", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005469, "uuid": "93a988c7-4844-49b1-b651-0cd56b839f21", "comment": "Malware payload (AgentTesla)", "value": "7f7a9881d6ac026d154eaccdf1afff355e7c05a7ee09ba319a1879c8392c6902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005469, "uuid": "954c5869-e9ea-4853-89fc-81fe5be7ecf6", "comment": "Malware payload (AgentTesla)", "value": "bbd4fc11c82c399954ebc5def652230ce743d7ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005469, "uuid": "e22e81a2-aa11-460a-a1f6-3c14c22b2f0e", "comment": "Malware payload (AgentTesla)", "value": "89e9528a4348401c2705f532ef249bed3718b4a8bfee35dd93c2a2e0116a3ac8b4be80f22f4455b14117f5be0222a7cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005469, "uuid": "2f7a5e54-72ff-4c4f-8d05-a5a76494546a", "value": "T1FAD5F68167859173B720ABAD523ACE319A0FA00319C1DF04755DF7093A6DD8FB368EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005469, "uuid": "6f9c68ad-b9c2-4097-ad7b-eaeec147fd0f", "value": "49152:tEI6Suv6eF1CH88Z7ieUL8ACMxoU8pA01KAsuycH2+PKLXaJKtXc2BAVfM8EhpO8:WI62eDM889ie+8An18e01KAsuycH2+Ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005469, "uuid": "fefebe9d-974d-4e86-ab95-b7c782a45d9a", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005469, "uuid": "ccc63b4e-9f07-4ea2-baaa-ebba0c6048b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005469, "uuid": "57c1f3b4-e30b-4f26-a453-4224e89a0010", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fabcd1-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021987, "uuid": "de9b354e-0171-44d5-a09f-89ffa2687ef5", "comment": "Malware payload (Mirai)", "value": "cef21f4080fc389dcea1a0bcb5018684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021987, "uuid": "ea6975b0-d604-41aa-89a8-ba103ec6ea25", "comment": "Malware payload (Mirai)", "value": "8050259673238818b7ca1a4db72b737864423b3f8256420bfb5bde81e1c101a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021987, "uuid": "616969ae-9eb7-49fd-9bb4-61d68dae8222", "comment": "Malware payload (Mirai)", "value": "db7e42673f764245901d4d926e87a1d66766d6f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021987, "uuid": "a0464156-aeef-4a27-a6ce-7d1fb16d7dba", "comment": "Malware payload (Mirai)", "value": "e369448fe6a77ae1674da1a0c17247d3b9c85b8b6cbdc9172fa81d909595297a13645665a8afd1ddedb663a2f92e48dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021987, "uuid": "c0588d94-e761-4e3a-96a2-d3fb02b29cc1", "value": "T17323F798F944D635C6E030BAF61E02DD73030FBCD2EA31159E216A347BB79194E3BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021987, "uuid": "f3da4111-af1a-4f3d-8dcd-fd48714d62d0", "value": "768:HyWb6PI1JdX5Hnbp6gJbaRNfD3z3T8WO5goLn2Dv4BhvWRwWfWRjMHcA9QSDlD2:HyWb6PCJdX5Hnbp6gJWHfDD3DOOoLnjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021987, "uuid": "7e024df6-684a-4fb8-9305-b037b8851cf4", "value": 45964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021987, "uuid": "35ffc728-b5e8-4888-9aff-e06b7f68b856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021987, "uuid": "8dfa6f8d-47db-4025-8f39-dca9db220845", "value": "main.armv6-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69202923-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045543, "uuid": "0aa022ce-18b9-4ecc-8e33-8d18c747b944", "comment": "Malware payload (Mirai)", "value": "cbed43e96724e1f2715466d845ff8900", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045543, "uuid": "6a575406-c53f-4058-ab65-41e4b0905cae", "comment": "Malware payload (Mirai)", "value": "80f330233fa00588bb71e464cc1addbf16b7c503f6f799e20efc50c812766ae0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045543, "uuid": "902abada-daa5-4192-ae6e-d4dd586c3878", "comment": "Malware payload (Mirai)", "value": "8ce2ba2cf8a11ded1cfd05c4d7d5485775211580", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045543, "uuid": "6813265b-50bc-495a-80ab-f9cf27744811", "comment": "Malware payload (Mirai)", "value": "7dcddc07e9ef0df3e71da6646347b161955194b660842290740eede0fb80710e24dc984f5994202b7e73f8f5af91c75d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045543, "uuid": "85ca65b3-4275-4a87-8769-511a4d4509bc", "value": "T156832985B981A622C7C1537BFB1F018D331A57E8D2DA3307CD295BA0778A81F0E6B795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045543, "uuid": "c6599a16-a92b-4b46-925f-1738e55f214d", "value": "1536:k2/ulZXFoPKEE2XM64zMiSBv8t465EHYznT9nQJhp3sATCvX+m:k2mlZX6MTzMLl84iEHGT9wNsXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045543, "uuid": "2b451c31-6939-42bf-a9f4-36a0cea32c0a", "value": 87352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045543, "uuid": "7302d001-ab96-4f5d-bc5c-9e23c543f5a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045543, "uuid": "6727e2f1-2cd8-4114-9f5d-df04e0f5ef42", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284b234d-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786005061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005061, "uuid": "d5681461-9d44-4c1e-9b91-2b897a23f817", "comment": "Malware payload (Mirai)", "value": "e23f3077d42068e9e42816b93d20afa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005061, "uuid": "1c85d623-13ca-4234-bc0b-ad39f7858659", "comment": "Malware payload (Mirai)", "value": "820b3269ce638eed1e9c3306f888f80e7f971efa3239eeee88a98cc2f0b912df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005061, "uuid": "298ce8a0-a31a-40c4-9bc4-af0acbb1fc53", "comment": "Malware payload (Mirai)", "value": "287c7b6d0ed7bed8e74906ad6c26dc2a7e7049e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005061, "uuid": "977af3a3-7332-4181-8fbf-faf3e3da58cb", "comment": "Malware payload (Mirai)", "value": "16f7aec1403c52d15cdc17b98740a1216967bb9fbd801c565aa4d235e4011a9a628f28ac641451eeb7ae6cf4f5478f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005061, "uuid": "89630a93-ccee-478b-8423-61f7d7f13b4c", "value": "T111F37ED99A1FAD82D6C7F3BC9D594FA230373CB40165C1B30E00666DE4EBDD688A2572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005061, "uuid": "f5bd97ce-12fe-436d-bc5e-e1fe4bf230f3", "value": "3072:jI2za49cqJX4m3Pcpl3xGXqdFYfdN5Ahpl1vK9oL:Uf4wmfcppxGXqIfb5glJK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005061, "uuid": "b17d07e4-2df0-48eb-acfa-0269e7ac18a4", "value": 157576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005061, "uuid": "1e97d0e3-7f89-4928-a039-8fe25eceb523", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005061, "uuid": "a0f25fb0-389e-412d-a831-a985b1649ed5", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.4217.5597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46db6df8-9169-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786001677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001677, "uuid": "ab88fe3f-f643-490f-be3d-2b342363a20c", "comment": "Malware payload (Mirai)", "value": "00dabca530e98717feadd7e4eac2b9e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001677, "uuid": "0f7a8184-1b87-42b8-a962-727c1d7fe99f", "comment": "Malware payload (Mirai)", "value": "82556818462ab6963889e81669945c99eecb6d719bf03b421d741fe099a0222b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001677, "uuid": "c9bbf42f-586d-40df-bed4-384d210d1a4a", "comment": "Malware payload (Mirai)", "value": "b1a0b903256b14e05f320b3f067cecb6321c740d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001677, "uuid": "2fb37a14-46d2-4a3f-beef-53b8f700840d", "comment": "Malware payload (Mirai)", "value": "574f57908ff3adce01034e464e7a09b85d9a32935b0ff0a0f2f5a09583279b4313d3777186032b8a48efaabf04ad3c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001677, "uuid": "f36d61f0-20c7-4317-b609-178457189d9b", "value": "T1F06302BB732EB530C96AB13450D41BF4F2AE7746A223936C06C97AB3ED619413931A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001677, "uuid": "5e87cc14-8a2e-4eb8-a0d4-751a77a24900", "value": "1536:M5ujSYRuiX00JIZfcDxv/W1By4asIVF96yENVl86DgOfiA/xfL:0CSMuiEGIZfctv/WvCGd87OfTJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786001677, "uuid": "cf306312-2afd-4094-8a64-5cfbfae5e016", "value": 67848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786001677, "uuid": "11bbe2bf-dad9-4488-aa4d-1ac6948770f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001677, "uuid": "de2b9dba-2471-40e6-a552-a405a34a8131", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2443bd22-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "8fc5f80c-8323-4bef-a42d-9f720cb4a04a", "comment": "Malware payload (Mirai)", "value": "261b51613dd261926d2ca9a711e3b081", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "23768ebd-1ef6-451e-9300-8c3ad496a6ea", "comment": "Malware payload (Mirai)", "value": "82d16a631297bdfde2b55177d15ca38c742ca677369e92ae4000c4c93350dffb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "5b218d7c-0f6c-44d3-871b-61de875eee7b", "comment": "Malware payload (Mirai)", "value": "6fc8d66cad0590dcca2663676c48e4651f7600d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "b475088c-fbff-4b3f-88e7-660b749eb8e3", "comment": "Malware payload (Mirai)", "value": "dd76e30e4a406c879563f4c8cd5b9d128eb57b4e04dd8c166af973b924bacc11c9da2737ccc6b9a6c7dfa7e607a16130", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "4f2bd258-9c6a-40ab-bd47-bef44ce42a34", "value": "T1C8342A87F900DF7EFC07A27244A70919B130BF7618620A77F126BDE69E390D5192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "1ce95ceb-af4c-4563-ab7b-31777ffc3468", "value": "6144:ogVITOHZW5nU2Yme6WJBvSqSyF2bDs9TLPxE/1LaTIK+:owITM5LPHTIK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050581, "uuid": "901604b2-5f17-47c3-8c81-125f4b65afc7", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050581, "uuid": "d6498653-b9d9-4dc0-a308-37af335acd83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "4def5dd3-59a9-486f-a37e-54caf542c518", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b68c10-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048060, "uuid": "c43cb539-f52f-48b5-90c0-d40b9ff461d8", "comment": "Malware payload (Mirai)", "value": "cb42e3b952b648366fc6acf477cca490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048060, "uuid": "58ef3cc2-6823-4855-a8c8-d456f1c831d4", "comment": "Malware payload (Mirai)", "value": "836bbb5e40c1c8a6700320d0611195555d8d69e654665c97d9f3c0557b76580c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048060, "uuid": "d5273488-2fa3-44a0-8dfa-e078338f8a04", "comment": "Malware payload (Mirai)", "value": "66a9013148d3dc7123daa4897980e6837931367f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048060, "uuid": "51d5695c-7d92-44f9-bc9c-a7e26e6e9042", "comment": "Malware payload (Mirai)", "value": "9fdcf6f8a06f5022e74af6711e4ed2a574ee9a64085dfd85b61c4198c0ce7d7ee4ecfec850df3ea1640e41a49d4f55d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048060, "uuid": "e8616451-6898-4e87-9781-92e7eb37e421", "value": "T190343B4B73508FA0E375D63046F34BA7AAA9228617E39545E36DED107F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048060, "uuid": "c2bde820-bd61-474e-87fc-8069ab99637d", "value": "6144:RSykXsqYuw66eV+GNJkHBgN4O6+Hz61+H+R:0A66qR2pO6BxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048060, "uuid": "7554ac9d-91f0-42d4-a946-bbdae9e2d48e", "value": 246508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048060, "uuid": "21365e43-2f23-41e1-b119-0257b9f3136e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048060, "uuid": "c8afd829-2ee3-4096-9533-49f5b50fa46b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84d061f-919b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786023396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023396, "uuid": "743b428c-25ae-480e-b6b1-130a7e7e7b7c", "comment": "Malware payload", "value": "bffd96c31d60d830189bd6b21a191bb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023396, "uuid": "06555650-2775-41dc-b1e6-a81ab9298de6", "comment": "Malware payload", "value": "838166fc552e944a499477335e6efdbf08b1d4eb2de1009cd528fdeac913ec1a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023396, "uuid": "5078272b-4301-4b1d-bbf1-aeb208f1e21b", "comment": "Malware payload", "value": "8adc26af8bd468012e3eabc42c97ec5aaa7a6dd0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023396, "uuid": "39a202e4-5c36-4b7a-aa33-5c0d79f90501", "comment": "Malware payload", "value": "9800ec47191314a4666cb0fec6c8b4b544e8b91dd019accdb93b32d11ff3158ea072e200551b32e3cbb041702440f8fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023396, "uuid": "a4fc4d92-a66c-4cd5-94db-2b7a3359f63c", "value": "T19147DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023396, "uuid": "53166abf-e73f-4703-b2c2-0ea8fb2a407e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQB:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786023396, "uuid": "6db613b8-6350-48fd-bcc6-e0cf0277bcd4", "value": 24805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786023396, "uuid": "c4b14928-c375-411f-81ba-25fb9372c331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023396, "uuid": "44411e49-159c-483a-9f5f-666cbe63c3af", "value": "838166fc552e944a499477335e6efdbf08b1d4eb2de1009cd528fdeac913ec1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed19311b-9131-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785977904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977904, "uuid": "c7f2f8f6-90be-43ab-9d36-7255960d2d77", "comment": "Malware payload (Mirai)", "value": "8ec85b6b1f2ffb0eea2403d36c6a803f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977904, "uuid": "30a5fb71-54e5-44ad-95fa-3d1297aa3cff", "comment": "Malware payload (Mirai)", "value": "84f81d78f84f045a4a26d5a2aa98a0a47442334f22903a43e2cf72528e064863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977904, "uuid": "ab3bd853-db51-49a3-a200-58c2e2087150", "comment": "Malware payload (Mirai)", "value": "e09c4ece2b490ac6399a37a22550e15c5662232b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977904, "uuid": "7b4ceef9-3c31-4b8d-bb0d-14eb71d4eb84", "comment": "Malware payload (Mirai)", "value": "fab168bb91ba4074a7905a03a6acba35032957868a41fe027ed801e9e43cec4fa32b1efb4c10e528b1dab59afb9bc084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977904, "uuid": "b49a8c44-55b7-4465-a935-fb56b9288fcf", "value": "T1B113E16C65646E8B98BF2C3EB49E37F44A14F1D077DE2BCDA652440CB91D24BE81C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977904, "uuid": "8e9da53c-1acc-4762-9841-502aeabf9b6f", "value": "768:/O7iEvAbuR8n7EnNG+7FKEylgUc+Y6i0kry9yvGck6orGLPqT6EMWZ0vWb:/O7iEvSuGgNBF+cRH+UoyPw6EZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977904, "uuid": "f14fe90a-0589-4615-b3d9-361bb51465e6", "value": 42160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977904, "uuid": "2f1b85ac-0756-4b98-93f1-971213abb865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977904, "uuid": "08acf4bf-8a4d-4d1b-bd27-4f2798a38b61", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbb93e4-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005554, "uuid": "6ffc9a2c-b804-4255-9481-a12134e3446e", "comment": "Malware payload", "value": "fde3d202b7e7cacf6e3c731a96af087a", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005554, "uuid": "0ea1eb77-4b76-45ea-a248-20d2d20a7341", "comment": "Malware payload", "value": "854b18425a949fef15004d2e052468036b67a4c5a2289ce8828989f1abfd531d", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005554, "uuid": "5063c117-3f4c-4a9c-be3e-25c6803c4f49", "comment": "Malware payload", "value": "c19db5a4ac9804dbf09711396ee243d86eb939ba", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005554, "uuid": "2b74a8c5-776e-4e1f-bd4e-b485dd8d36f9", "comment": "Malware payload", "value": "eab5f756f03c1b52e7909bbd2e23a55fca61c9a1a43d4a80a40b4fe76a9ddd70ef2e7f768fa7a658c71421a5228c0fc3", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005554, "uuid": "38443b51-930d-4ad3-bd71-f1d48f39c6fe", "value": "T1152412045DD14A70FB05323F90E07121F62AB5E80AD6AB17B7709C9A7D9B317D739368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005554, "uuid": "ade1d3aa-cb2f-4276-b709-02610c49369b", "value": "6144:CLgwNFseaqitX9+U+JhPbZ7tKLueMlhgxnDcyhY7z:CVGCbDJhP9ULuDb4D1hYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005554, "uuid": "76e9a84c-b4d4-4b69-9e24-7062f5be3566", "value": 219929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005554, "uuid": "bd8748b2-1802-48ef-aed2-e2e5b34f88e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005554, "uuid": "af988cbb-ac1b-4560-870f-433e80f3c338", "value": "Purchase Order_PO20190298.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2520643-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004085, "uuid": "49e05fa7-7b61-4472-bd7e-26094744e342", "comment": "Malware payload (Mirai)", "value": "ac907762f7332b1052b95e3f886e5a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004085, "uuid": "0498260b-33b7-4a8d-86f0-1b0e2d8a3bc8", "comment": "Malware payload (Mirai)", "value": "856ef6d79a755ff4b3fbd6df620951b35cc3b398f95338ff5974dc26749d6cec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004085, "uuid": "ef9f4d0c-c477-4f70-ae34-4428d43467a5", "comment": "Malware payload (Mirai)", "value": "883430b5739928e78809b989fc1e243fa0d21ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004085, "uuid": "ff98ff50-d3ea-4ed1-bb85-5eae4fce931d", "comment": "Malware payload (Mirai)", "value": "12e442f2864a735f9d5c10a9b248531a5e88a05b3f02b0b68a73045fa97fd254146d0a698946849e1512d30e018e40d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004085, "uuid": "093849d7-aaa7-467b-aaae-5749f916b724", "value": "T1DF230813B98584FCC09AC2300F7AB93ED532757D1239B2A97BD4FF166986E324E1D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004085, "uuid": "7fed2b4b-8154-4b46-947e-fd8ea44b9d1b", "value": "768:x532HdlHCvJeO4N15N1mbKi3QONW2+8BWMxUUje1UYTdsH/+SYV:XuCcO4N15NmKi3QO02+8BWAe1UYJgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004085, "uuid": "03edea57-27bf-4ab8-a563-b23ed12146a1", "value": 47168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004085, "uuid": "6a0ca611-06a0-4e06-935a-a3599a5cd004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004085, "uuid": "b2546339-d66d-44bf-beac-e3cd642fe758", "value": "efaa9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500ac3fd-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993961, "uuid": "a212d6e1-2d79-46dc-a0f2-08713797428c", "comment": "Malware payload (Mirai)", "value": "9322940a5b92b20c64e62fa3c810450e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993961, "uuid": "46b93c04-cac1-43c7-bb49-50b641229712", "comment": "Malware payload (Mirai)", "value": "857c5746f5e5e308bd01602cbbdd3eaa316300934d106ab9b53f4c21c74328e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993961, "uuid": "6f692230-1d7b-4ce7-9b72-2db1e3c302b7", "comment": "Malware payload (Mirai)", "value": "47d9683882b5258f290f42c645d5f6ae895feca4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993961, "uuid": "1c4095aa-7414-4170-bad9-b383bfd05bb5", "comment": "Malware payload (Mirai)", "value": "4a7d376319629ed5e387334fcfc435b80277edfb9ade17ae02a78b5a3418b9b3decf99beb5f09187516616e72e256576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993961, "uuid": "5a7b55b6-d90e-4646-90e0-e5a12ecf8d8a", "value": "T1A7E37FA5A61F6D82D7C7F7BC9D694FB230273CB40165C2F30A00625DD8EEDD68CA2562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993961, "uuid": "7b1fc70c-1af9-4f7b-9b2e-75f40229e84b", "value": "3072:+Mni71zObhB6z67/T8Trx3DcpbNzou8kvPKG:PY1iNE27r8Trx4pRz+kHKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993961, "uuid": "53897423-0a1f-441f-bcda-6d8b385121cb", "value": 149384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993961, "uuid": "4054e9d3-109b-4a34-8e5d-d4980e326f39", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993961, "uuid": "98af6f63-3c39-421c-b74b-d62bf4ff5fe3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa5f663-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979483, "uuid": "3be25269-eae8-4bcd-a5f5-44f580d1a59c", "comment": "Malware payload (Mirai)", "value": "66628633e1aa6d73ec4047ea88ff2048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979483, "uuid": "6e01d7bc-7521-4093-a464-c09da135331b", "comment": "Malware payload (Mirai)", "value": "863709a3b2ad698aee58280f46803d17f4d2850536e860eece547eb874103325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979483, "uuid": "c4ef40bd-7d15-4fb7-99f8-d54d2f875512", "comment": "Malware payload (Mirai)", "value": "df6bcfe7d56f7a8afcbb1bc508908d8d3af4fa67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979483, "uuid": "efd24eb7-2e86-41d4-a7f2-f09e40c7b3a6", "comment": "Malware payload (Mirai)", "value": "f04b28da4167b72a6f895ffb3f8f93e6ea29524ab2949177353e2f87df42a2bc79481b7499a00a9c67105b087dc3e020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979483, "uuid": "70862acf-e319-490a-a62e-1eb1f790cb78", "value": "T17DB3F755F880DB62C6D4267AFB4E428D33231B78D3ED3106DD10AF35B7EA95A4A3B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979483, "uuid": "7f4f6ade-0fa4-44bf-b42d-f4291626518c", "value": "3072:ulM20bU97F37uDtD1Hbs3HLIPlY1O+aX7AMaS4:ulV97F37QD1HYHLIPlY1O1R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979483, "uuid": "fe9ca03f-b604-4619-b19e-e1ad352541f9", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979483, "uuid": "3b9f2177-2d77-450d-8d4a-4c4b7818d4f3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979483, "uuid": "4c5c006d-3b5d-4487-8724-70a129f24f62", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24211184-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993887, "uuid": "2f4b6359-9cc5-44ac-9436-901fec3b9505", "comment": "Malware payload (Mirai)", "value": "aa11e55bcdf5505abac953be28bd6372", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993887, "uuid": "8e7db78f-f715-4236-9d96-295601543a55", "comment": "Malware payload (Mirai)", "value": "87449cffaf7aff9fb38dda4d23b5d65580dfbb91345b7001c5e95d9661960ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993887, "uuid": "3c824cd7-2b10-435f-bf89-a48990c03379", "comment": "Malware payload (Mirai)", "value": "1ca0b5e17f77748f512271b993064d60e6b1e839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993887, "uuid": "e5f03d56-dd5d-4f61-b8e6-4b8e5552d382", "comment": "Malware payload (Mirai)", "value": "abcac52a8c514aff5050ed36f8f49e62386befc02209a4016c4521d4b23a73acd905c1e3712acc2d0f48af71a32faaee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993887, "uuid": "8fafce89-535e-4369-8733-386d36dd9c72", "value": "T1F1530232E4490C1DFD0FD6761C0C938953C8BF36A4B1A9B0579D1942CAB6BB7D316ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993887, "uuid": "58309cb7-6bc5-4d6f-a0cb-fb82e42d2713", "value": "1536:1Ab08yCpgR0HB/cRN0YCE5PV7f5yT6vewe69dAOyUC04u+qgw0r79:1xCmRClE5PVI69dvC04u+qgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993887, "uuid": "a64bebb3-f5f5-4e79-80aa-14ff9717b27f", "value": 65384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993887, "uuid": "f4e2c422-ee60-44ae-bfb3-f0a71f35f69d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993887, "uuid": "c38facc5-c2e1-40ed-87ed-f36b4165e9a3", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733c12e-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021998, "uuid": "8a8ae6cb-7aa5-45e9-9c2b-761a4d7d66d5", "comment": "Malware payload (Mirai)", "value": "bd89d2f036461a3467e8df44db5dc748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021998, "uuid": "5c21b91e-1613-42f8-b150-5aa0ebfa0b4e", "comment": "Malware payload (Mirai)", "value": "87682daf2c7e812a982d8afb7e4af1eb13eb8de9a8636fb81e95bb845bc701e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021998, "uuid": "325458ae-7e55-4cdd-8cee-145f4ba1027a", "comment": "Malware payload (Mirai)", "value": "617f10f63346f505e704336a4c70b573204f2e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021998, "uuid": "5ef3d882-385c-43fd-9df4-a18c5f6cba05", "comment": "Malware payload (Mirai)", "value": "ba3dbee2c03c86d98191761ef27778c184116e4068a87dcc67b067fe597fd48652d62b15c8956e5a1372e70a3848b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021998, "uuid": "3ba1100c-c92a-4262-94d1-ed9d84fededb", "value": "T140030A46EA519B06C59232BEFB8D414E37136F68E7EE32359A306FE013825E70A35525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021998, "uuid": "6d275a71-0185-4114-93da-fa7047a00aac", "value": "768:1F5nTvY9TWPiuAlMLokZqDZmO0J0M4VCi6jtgnw04+aVsw2/:f5nTvY9TWPiu0MLo8qYniMhi6jGnw0Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021998, "uuid": "353cefdf-fff1-4f41-a721-c3e07d97dd9a", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021998, "uuid": "4e82c008-a424-44a4-b02b-84e3843350e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021998, "uuid": "cd8af441-c7e7-485e-b8b3-64499a81d018", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e8f338-919f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786024754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024754, "uuid": "8fe86f5f-b5b1-4bbf-bfc5-1848fbadb5ce", "comment": "Malware payload (Mirai)", "value": "891aa20f91a6d3277f45fe4697b990b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024754, "uuid": "2a3ed8c8-e694-4903-b3b4-693a57f47c3a", "comment": "Malware payload (Mirai)", "value": "8769de39fa72c370e84a722bc70667b99e20104ebc2839f45035ce198e59c5e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024754, "uuid": "d73500d7-20c9-4fef-b8fb-67a904bd4fae", "comment": "Malware payload (Mirai)", "value": "37898fb5275b73299beb2aae5a379f396bf52fed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024754, "uuid": "7360241f-daca-4ed7-95e8-f0bac95ad0bd", "comment": "Malware payload (Mirai)", "value": "500ae3ad106654d0297707d640324e76b6ce5a754381829df3f64901a5af02b61fc55c4691da76a1fd55e9c0c975756c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024754, "uuid": "1c3cf332-4234-429f-a347-e0b28bc6945f", "value": "T125D2E16DEB59374CF462573244AFC12F7496ECB3A36F42818BD84912283894D277DEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024754, "uuid": "84e75b16-e023-4cef-ad77-cce191a4b341", "value": "384:MpGclfUDwDsOAFImUQSAAHCw9TKcSLJY7eoayfsqxRFpDU7/2LuY1+rG0NyqW:PcmROmIIAi8KpLJY7Pa6tpI7/e1+6Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024754, "uuid": "c4e93e7d-6be5-4488-9482-7cb4326ab969", "value": 30009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024754, "uuid": "f02d8564-f357-48cf-b067-96a3f72de379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024754, "uuid": "7bf92113-0714-4fe9-9ecf-9dd1c45c94d1", "value": "8769de39fa72c370e84a722bc70667b99e20104ebc2839f45035ce198e59c5e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac47bf96-9176-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786007430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007430, "uuid": "2ca2d479-f3c4-4693-99ae-feb1201b7c7d", "comment": "Malware payload (Mirai)", "value": "6cee6293cd4750295e103b479031cd95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007430, "uuid": "1f17ca5a-b227-40a4-86f3-a47bf5d4ae50", "comment": "Malware payload (Mirai)", "value": "890dbb5f7d03af7589d6c713275677d7d5e9247525728185d835e3e3148383ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007430, "uuid": "169c6329-595e-4ea6-958a-35dd29697770", "comment": "Malware payload (Mirai)", "value": "fb979163f49427817ec73d6d17f6d3228fab3f9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786007430, "uuid": "c6ae8a61-36c8-4fdb-a405-b773fe86c681", "comment": "Malware payload (Mirai)", "value": "e867254276c3fd4ccdeb6ea240d5eeed9026cdbf7733cb14f2475cc06275ca4a74dd0a89b1f32f546ba4527d2a0143cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007430, "uuid": "e0503920-6089-4389-899a-067b18f796cb", "value": "T1BC31869E102069365113DE9D7363354DA68D95F72D5FC7D498080ED5838D3CCF221B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007430, "uuid": "65ba89d5-717f-4d22-a8e5-5764dd029840", "value": "24:LHgHg5j9RtqONBA+57i5rvMbty05UGCbcs1o0:LHgH4N3BA+2Ms2jCD1o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786007430, "uuid": "0a2e265e-ef5b-43d5-8f00-0790fcca635a", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786007430, "uuid": "ad9250ad-9516-41d8-8e55-af772b284163", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786007430, "uuid": "56b57470-e4de-40ca-9e35-764db017f0fe", "value": "890dbb5f7d03af7589d6c713275677d7d5e9247525728185d835e3e3148383ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01573a97-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048375, "uuid": "da1045ee-79ff-4bc9-af37-b8e4c251f029", "comment": "Malware payload (Mirai)", "value": "c612dc245201b72aee2cc4ee5a50b73a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048375, "uuid": "7c6c0291-ccf9-471c-ae59-d83eb4147b55", "comment": "Malware payload (Mirai)", "value": "896739f406f9e7bc1e3746e5a34b7e5f4b136a7e5728df22a7818c50f380c13b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048375, "uuid": "19a7a5df-8fca-44a2-b251-620ae7f4553c", "comment": "Malware payload (Mirai)", "value": "3b6a3825417a8f13cf0e0f422d195cf27731d98b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048375, "uuid": "f9d7c43b-e4a4-40b7-8fdd-2538ebc6cccb", "comment": "Malware payload (Mirai)", "value": "deec6faa1dec54dd348b68bc2d794feae4b524585c739d91edcfab91f46759fdc1893c6d96c7b0799f5f825562bb9a91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048375, "uuid": "33071b7f-1d29-4c32-9e81-3467e1f98167", "value": "T128F3AF67B74B5050C4E44AF41BCF5FAD292721008E7B99E77C6E323A6A775CA28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048375, "uuid": "6e0d9466-96fb-40b6-b3a7-c49deb2d7b68", "value": "3072:Xx/5yfUhn9HslYRoGpTiHu9H7PT/vRF4ITXqbpygZCBrWOG4u5nWq:XBEfUhntaYXWOh7Pj/Ta9FCBrY4SWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048375, "uuid": "3b5d47a4-2095-45c7-b89f-d9f9a2726655", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048375, "uuid": "3a5ac0fd-cfd8-49aa-9cd3-7e1be7d4c9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048375, "uuid": "ab78b81d-c502-4c05-81a8-0712dbedcc89", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722ea4d5-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "0370e84b-6530-4d9e-ac45-d8dd6d185822", "comment": "Malware payload (Mirai)", "value": "7458bdf5cfc0a197b1355ae822895aca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "23096009-b281-483d-bc80-32969720a2b7", "comment": "Malware payload (Mirai)", "value": "89bc05195c285fd2a451a2698795eaf4246758a8a399ec5440c1f58aeae9d641", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "44062c5c-7ddc-4e37-a5ad-950e56b27b5d", "comment": "Malware payload (Mirai)", "value": "750716ec4fc03c9954bea60b4bf8f479a52272a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "d9f1b552-a56a-4cf4-9094-431fb7bde1e5", "comment": "Malware payload (Mirai)", "value": "3d7449419fe73077f9bb276d0bb1b63e4e1e9ecc15298cfbb626a94feb3ada1b894a093dcc968483b14d48bb35774038", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "9e2479b8-3c4a-4cb4-870b-82c3ff6871e6", "value": "T11AF3AF67B74B5050C4E44AF41BCF5BAD292721008E7B99E77C6E323A6A775CB28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "c687ac41-197c-4f48-badc-eceaf9ef2d6b", "value": "3072:/p/5yfUh/NM5N4pPG5TNb5c7jT7fR6gnPXq7pygZCBrWOG4u5Vkq:/BEfUh/Wf4cpbK7jnZPadFCBrY4kkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046847, "uuid": "d335e35b-7596-4b1e-b1d5-bb8a3d3dd8d9", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046847, "uuid": "a2beb0a3-bbfe-4317-b4a3-31152ca17117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "48a70f29-5563-47ae-99c3-d6383cb63f52", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bc8d6d-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "3e6885fb-bb81-4738-a436-0ceca1e7d74e", "comment": "Malware payload (Mirai)", "value": "9a3ba1bf6139dcbac7d1dec1df01f18a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "f9f1b538-ab92-4573-9d28-a9d64ccfd397", "comment": "Malware payload (Mirai)", "value": "89e9d3797c5b51b99362290caeb507e8122b3bb890ecf68372a9b059e9213ab0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "7ef5ad80-216a-4e86-9af6-b6c4f9450d5a", "comment": "Malware payload (Mirai)", "value": "e38df4e7ba95c10341aa213d033ce9e87cb3c89a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "9f1cb04f-6653-44ad-a7ec-a107f506e2cb", "comment": "Malware payload (Mirai)", "value": "a389c1d33b5b598e2899ba297411fae08864006a1b7fb1f13d7f183db576bffd20908d1e0751470f1b5d88279c23ed58", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "8ae057ea-68ba-4865-8c73-82dff913a104", "value": "T1E2E4AE41730E3EBED3B7B53AC0D20B26AE19AF5091831F1351F4B51A59722AB2F2D586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "13cb9f2d-2728-41c8-bda1-3b01c0b5a224", "value": "12288:A8uUR4VzdNBdc1/d0XXml+QBKXKqSmoRgQffV4sN4E9MThVNGK/a:A8uzBNBdcpd0X6+vKqSngQfJ90VNn/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030961, "uuid": "f37efe4b-c66e-4df5-ad59-d41cdc0350c2", "value": 674064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030961, "uuid": "e26a0fdb-a01f-4f72-90e0-c21f52802601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "7415aa37-be54-4269-9587-2f51858926a1", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38614b08-91e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786052762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052762, "uuid": "0f61f4ad-387e-4a60-8675-2f64bf437834", "comment": "Malware payload", "value": "bdc5d7419f69b538a77b9397c5db01b6", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052762, "uuid": "cad70e81-3347-460a-8dc6-dde5a09e1f8f", "comment": "Malware payload", "value": "89f5e86a2ca62dee4ea9ea65d2235efb36528f987ba4d136326612f79cfe89a9", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052762, "uuid": "437a0353-e762-4e02-b12d-a588d02bb868", "comment": "Malware payload", "value": "5cf2d0a673a924a77f30080307eefb3735abcf87", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052762, "uuid": "dba4790f-fe58-4b70-aa2b-a0b776cea067", "comment": "Malware payload", "value": "c18e304d750b709be6bddb72533935b01b8d66ceac418029f1aa0bd72ebc1ae2ee3dda3bb541860e1b7bcb1160989cf3", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052762, "uuid": "a2ef61c2-7d4b-4604-912b-5f3367c7c772", "value": "T15D85235197E54063E8DAC7B4A4F04107BBB87C959F79829F2391A1AD0F67E90B23831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052762, "uuid": "dcf5b7cd-d1e5-4911-b44e-fe30fd2d38ed", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052762, "uuid": "fa91c883-795e-47c1-abbe-8ccff56451c5", "value": "49152:rO5IEUpkrtUiNxC/Wk7yHmNP2vAQUptJ:CaE6q/C/7eGNP8RUptJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786052762, "uuid": "43d76a38-0ece-4211-82f6-5fbd8e26313b", "value": 1768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786052762, "uuid": "2084b3a2-6e5f-400d-9dae-f37c865f7e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052762, "uuid": "58b79137-21bc-453c-8967-0e8fe1bf1da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27787eab-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786030830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030830, "uuid": "49c4fae3-3c91-4bf8-a0d2-24626dbd86e5", "comment": "Malware payload (RemcosRAT)", "value": "842c0ec2c16fd14a656b3caa6b0d93fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030830, "uuid": "edebd1f6-a6d5-4713-8b06-ab61fe2cd33d", "comment": "Malware payload (RemcosRAT)", "value": "8a494cf5613a27de7739d417506a93aa98c51453230f61de36d18d53e5456d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030830, "uuid": "586d9d5e-baa5-4612-bf11-cbfe00888865", "comment": "Malware payload (RemcosRAT)", "value": "0617b24e963b97ba0fa031d09509b05ab06176d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030830, "uuid": "241bd513-8949-46b3-9079-69fe0bc11e1e", "comment": "Malware payload (RemcosRAT)", "value": "7c7e0fe52de5e839588bf399b307ab315e41c1e9406a63145159cc9b58b0d44ec192858298e478acd22231bc2f99497c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030830, "uuid": "79b434eb-68da-4b4d-aa8b-3cbc7ee6924c", "value": "T151D46D4AA3A441F4D077C235CA828537E6F2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030830, "uuid": "b4d9d9f4-dc2b-4ea8-9c47-78ab30b1091b", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030830, "uuid": "1a1be055-ccfa-4c43-aa1d-f7d9749a1c86", "value": "12288:GZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:oQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030830, "uuid": "2b81a2d0-301d-45ea-afa1-67800275ca6b", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030830, "uuid": "2f90f01f-f157-49cc-a009-8a66fd6a3a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030830, "uuid": "be42b50b-a273-446f-bdc4-724e01c37e89", "value": "SecuriteInfo.com.BackDoor.Remcos.716.17702.7178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95121a7f-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005244, "uuid": "527ab0a9-4226-4a1c-9fed-546862b62bd8", "comment": "Malware payload (RemcosRAT)", "value": "58133a5275783e42279ce2bed419ad7b", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005244, "uuid": "99c74a88-98a1-4bfc-af14-0ff4fd618abc", "comment": "Malware payload (RemcosRAT)", "value": "8a9aa3dcfe7919c6a925d9e533e4c8a9db86e4f05427635384bf734adaa250ed", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005244, "uuid": "131481dc-5106-492b-8e23-acebf70528ee", "comment": "Malware payload (RemcosRAT)", "value": "b94388898f4a5fc7c3c2038ecffe4ad8c7a925c8", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005244, "uuid": "47f0e684-e02b-4ae8-8c7e-a06705586c9f", "comment": "Malware payload (RemcosRAT)", "value": "e271a2212af4e10633fe3cb8f6bc5b0a770539b62776dbfb42c9c894d759245555e2aca51dfb8e445fca8d92dc6f21b9", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005244, "uuid": "0e5543de-4419-44a0-8c04-d9644472f051", "value": "T113476F864CCB0AD9C28A766CE4B05AB280C79C4D17FED3ED2B119E8F25DFD6114718B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005244, "uuid": "eb1783bb-3ed8-4fa5-9219-2ee4631a87ea", "value": "1536:12l78uj14+44Hi1evoFIor0gUsW9nPjAkA4ZQ08rYWi1ZWZV1FgRR/AiVsnWkzgq:Zszg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005244, "uuid": "cbfb8e6d-b547-458f-ba77-38d600ebc6c5", "value": 26009794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005244, "uuid": "0fe32ec5-a2a2-4d99-ae15-dc2a55ce472e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005244, "uuid": "3fe235e4-ce64-4229-9975-be4421732d84", "value": "FedEx_Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc30dd6e-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040206, "uuid": "fd72597f-404b-407d-8816-2616a4a15a39", "comment": "Malware payload (Mirai)", "value": "bf30f1252976afe048f743160bea8537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040206, "uuid": "fc3d4666-936f-42d3-89cf-0773f8cf055c", "comment": "Malware payload (Mirai)", "value": "8ab137b19a9a70aa6bb854ea5bdf8cb8ee63c49e59d5653c6b57e86f15647722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040206, "uuid": "b4684cee-a74b-4b3d-a45b-e954a6bbcf42", "comment": "Malware payload (Mirai)", "value": "27d4f94d4d3209c62f31866b496c1eb5e1617cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040206, "uuid": "55e413ea-e60a-48bd-a16a-57bdbebbc980", "comment": "Malware payload (Mirai)", "value": "f1f6739b0c39fd75a94a2da9acecd98a0a4585af817a71ad33975327e7c70f89b076239becc8def6cf60d8691b431c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040206, "uuid": "995c725a-0f9c-462f-883b-a0b92bd9bfe1", "value": "T13A446D1BF740C4FEECCBD1FD8ADF6125EA31BC58113AB2593BD02E653E24A50AB19641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040206, "uuid": "99214bb6-014b-4c9d-83bd-cd32e8837b85", "value": "6144:ePCp8MzRhq5zCyug8j5UfWPEuPW8CkQZx9LG4:T7hq5Uj+fWMu1FQZx04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040206, "uuid": "977e9184-bc4b-40e6-ab5b-5ed28d28d713", "value": 257880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040206, "uuid": "c67952c3-015b-4190-95e8-e8be19a57be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040206, "uuid": "29d146a7-3127-487a-846d-b316589781fd", "value": "pope.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89251d2a-918e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1786017679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017679, "uuid": "1e9bee3b-b312-4c84-9ec7-f37a2c505926", "comment": "Malware payload (CobaltStrike)", "value": "c19a5fc3d5fb2bf7f68d3a730f6eee20", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017679, "uuid": "6133760d-d076-46ea-a3ac-59350f1202c2", "comment": "Malware payload (CobaltStrike)", "value": "8ac5a2344e0d866abb491eb54060029ea890810f52cd12f0040a6151b251f269", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017679, "uuid": "8de6383a-2afb-4960-9318-fd6b4986afcd", "comment": "Malware payload (CobaltStrike)", "value": "c8b1df8656a75965227f1515c192bbe800adeb8b", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017679, "uuid": "e7b5c927-3053-4b47-9682-857f787e41e5", "comment": "Malware payload (CobaltStrike)", "value": "2ace5d48be445542487c11b82797604a1c058a32613d5eddf90ada7e82e62b4b559d7a2eb6506cab9d44cc684e33ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017679, "uuid": "e655ed07-3980-4918-9087-cfafb833db10", "value": "T1E0D46B56F6F686FDD0BAC0B08A539776F971B8884274A74707A456223F33BB05A3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017679, "uuid": "912c07c1-bc7a-4ad6-8c73-3bb0d19a0a82", "value": "8e2c5139a9e2fb2ee2dc2f7e688799a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017679, "uuid": "842a1f13-05d3-4580-a122-b78f4b0d917c", "value": "12288:MH3PxIr8VVVVVVVLBh/DBLXL0RSb7PQmmrk7MQdE:0EOBXL0QQm+QdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786017679, "uuid": "b1cc67d4-38ea-47ac-ab86-1afe5e43aa7b", "value": 657073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786017679, "uuid": "d7f3f716-7ce2-4060-8cdb-5c3644b84a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017679, "uuid": "417b93f0-c471-4224-86b2-bd609bd6cc9e", "value": "dbsql37_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c6ea09-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048057, "uuid": "95d64127-9a4d-4e82-a9eb-452a39e994e3", "comment": "Malware payload (Mirai)", "value": "f2e0602b70493dc4e0c119782c545bec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048057, "uuid": "db7dbee2-42de-46a6-b501-3802765641e3", "comment": "Malware payload (Mirai)", "value": "8ad5b52f551cea96c8c8ea6fd0c2239aaeee506f55fb72d9207335a5baa0ca2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048057, "uuid": "635adda7-4b60-42fa-81cc-f8ffff0e26f9", "comment": "Malware payload (Mirai)", "value": "28544bc59a89d52cfe2465eb3eba44b8b1ff130b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048057, "uuid": "91091791-2033-4ea0-8f6f-722592f74428", "comment": "Malware payload (Mirai)", "value": "898b9e659d626be0d004d96093e086e2d1a165b64d48e9b7aec2bd2a6d1508b1fec02e79b972a8fa0e4c4137befe0d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048057, "uuid": "193925ac-2d28-43b4-b04f-ce1901d3ed84", "value": "T107048FD99A1FAD82D6C3F7FCAD594FA2303738B40265C1B30D00525DD4EBEE688A3566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048057, "uuid": "061585b5-14b7-46c6-90ee-562a298997c4", "value": "3072:zu7F02cBoEWH1moz67/5/wjP/hoO07tjCKRL1vKQm:s62cKtl27x/wjPL0RjlLJKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048057, "uuid": "496a3f7c-3e81-4863-a07d-980a2e51d558", "value": 173960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048057, "uuid": "7a1fe371-36d2-459a-837e-d08fefec390b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048057, "uuid": "139e6cf5-10e6-4f69-8cb7-05acfacb84d6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7625c60d-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030962, "uuid": "03fa0d01-f7d8-4ff4-b38c-3739f54b9216", "comment": "Malware payload (Mirai)", "value": "ac74f4b9683de23136de64facabbeb07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030962, "uuid": "1240ad32-f0d1-46a9-bc81-c3dc0790c3f4", "comment": "Malware payload (Mirai)", "value": "8b8e368fa3ac720d21006b9d9117ee9c1ae3c89227cbaaf78f6ce09f745574a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030962, "uuid": "69310725-a4a2-457d-84d6-4c710476b049", "comment": "Malware payload (Mirai)", "value": "6db3b51e0870aac4e490d4ba37e6224ab2018f4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030962, "uuid": "21ade91c-d95d-4d8f-ab33-7c7cd082e6ea", "comment": "Malware payload (Mirai)", "value": "ed8c07d3234a02b3d2cba05f51f48a10f4ea110d31097789e366757df1e0af34954563a1fc5f6d2f7e11775d8065f37e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030962, "uuid": "e1d32e98-9154-4152-9411-121e9883a9e4", "value": "T127057D5377218F58E351D67005F38B65AAA521A30AF294C2E3BCD2207F5166E2C5FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030962, "uuid": "ce5cf0ac-e9f4-4f6e-a019-0a0f0859fc26", "value": "12288:gbNfU9cH8zS27v4B4aLbToLoI9TZScx70loFOFSu+6pKV4hUOG:io60S2z4BDLbToLzZf0loFOFSzAUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030962, "uuid": "cb4c4369-40c5-437a-8a4a-f2612dc651cc", "value": 861592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030962, "uuid": "313a3531-5763-4fc9-ba8f-e77c065fdd74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030962, "uuid": "44151d2a-c176-47ff-8ea1-dd69169c2378", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51330489-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786048939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "a649241c-cdb3-43da-8517-2bac9165764b", "comment": "Malware payload (Gafgyt)", "value": "d552631a571b0c52429685e62a582083", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "3ce27b2a-cf14-471b-a619-464383a938dc", "comment": "Malware payload (Gafgyt)", "value": "8ba0c887190a6ff7b791b18e77045970d4006e289e015c1ee52d2361378ca685", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "927f5a8b-df11-44f2-93de-3b868597d7c6", "comment": "Malware payload (Gafgyt)", "value": "b3069aa8fe2d20654475b26c5467b1730bb4d2ed", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "7b5b6142-fdf9-4146-8102-1084f515f5b4", "comment": "Malware payload (Gafgyt)", "value": "63cc1961fbe223e9d8c5389e5eac882000bbe03c31f87d27511f26dd29ae357485a5d0d762360e1fc607c8a707399654", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "54d4f4db-5ff1-4d86-b640-fe5f728e4942", "value": "T1FE5302F690D8BDCCC19A5734050F0A033E91B3786089A63A76C4A6958AF2750DFD8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "34039b3f-0034-4502-b192-abe05a70524c", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRurLkg4azHy:CM5az1Fy0oPgdZX6hTo8RorLGazHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048939, "uuid": "8bbd9712-b2fd-4b70-945f-5db5f6d0f4ac", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048939, "uuid": "e038fde4-b0d2-49c1-8a0a-be2f5aff19d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "7b212af2-78bb-4cf2-9e5c-f3258bd3f1c4", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18b5bd7-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004084, "uuid": "6319b47f-26e2-42ae-b8d2-a3c599194bfb", "comment": "Malware payload (Mirai)", "value": "0480d5c539e68315b75879509d45e66d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004084, "uuid": "63e18e2f-7b16-40b4-a9a3-cb2115cf303f", "comment": "Malware payload (Mirai)", "value": "8bf23c53159e5931964803338518f4bb4d86308f27e5a2a628da4dd9f205fdbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004084, "uuid": "c367a6f3-0236-48e3-a097-5f8f575240e4", "comment": "Malware payload (Mirai)", "value": "0942ae467e4196a3bcb6637d1c7b5aea82dfb8f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004084, "uuid": "2ca9c9e8-bf90-4c65-95fe-1fa98493326e", "comment": "Malware payload (Mirai)", "value": "e2dba76e0dca805d1bec049546fdee1834b830f6c47adbd9a07e3d62b7d3ed72f04acffee57090aa61a96c0cc2250b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004084, "uuid": "ce98a31b-ff61-40ea-b7d3-a63baa70d90f", "value": "T105231ADAB8019D7CF80FEBBE8417490DF521675554930B2627ABFDA3AC721A44E23D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004084, "uuid": "1305678e-ebcb-4ccc-bbe8-5f878de98c4d", "value": "768:MHAL2SzvyZxdKjaGJwNelnCrlNWi3aiAkm9uqV9Va18f0x:MHA/z6ZkBJqlNb3Vm9uI9Va8fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004084, "uuid": "7335791f-9b14-448c-a2b3-3d8a0d83dc07", "value": 48532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004084, "uuid": "07c0da20-4f5f-407c-903a-b701adfdad3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004084, "uuid": "8be17ba1-a278-4689-a2c2-e9bcad5f58d3", "value": "ef4188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1211b3ab-9134-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978825, "uuid": "4612f4ae-56c9-4bfc-a2ac-833ab717bd4b", "comment": "Malware payload (Mirai)", "value": "951871ee98b906705a81713cfb586931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978825, "uuid": "848c54e9-5e9d-4b8a-b90c-ddae1f318081", "comment": "Malware payload (Mirai)", "value": "8c03d205d6000645c309fe41b7d7e4d4a91b3570d98a22036f60a47993a2c6b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978825, "uuid": "922ad48b-3b43-43c2-95b7-01bccfad6182", "comment": "Malware payload (Mirai)", "value": "c1eb51761a6985cca593a242da1e5acf3c9fe865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978825, "uuid": "985106ae-4e04-4fb5-b889-bdaa5cc3415f", "comment": "Malware payload (Mirai)", "value": "64b68d6b81307ec120de8d57cd4d79a1f5cc16220c92486ee7cf38d0b36c82110eac49b7154e87d27cb5f5f8c4e4b557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978825, "uuid": "3bf1a88a-dc42-4adb-b2c6-f9ab76e8c4e2", "value": "T113A294D2ED42009EC7C057FFAF5ED7C8739393B1C5EDB21AEA088614649A94E5F1AE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978825, "uuid": "89ca7c1d-c39b-4bd9-8592-542e303a4ac0", "value": "384:Xq2lYgow4AIQYgow4A5BJRZhpx5BJRZhpx5KpRT7TKALTtTTs7sjeeKyzgwWiTWp:XqeYgow4AIQYgow4A5BJRZhpx5BJRZhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978825, "uuid": "02c5e680-d962-47f5-b89c-cd6b0c69dd67", "value": 23328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978825, "uuid": "7535c910-b241-4637-9ce8-18346c7787e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978825, "uuid": "2aac9a54-bafa-4e7e-9082-95d16699c0de", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9f6f5f-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785994761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994761, "uuid": "c59657b3-f33d-4132-85ae-25d0c33ed47c", "comment": "Malware payload (PureLogsStealer)", "value": "85d6a767b426c20709f3ab47677b8491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994761, "uuid": "8694b40e-64db-4c70-8556-5f4b8745592e", "comment": "Malware payload (PureLogsStealer)", "value": "8c6a39427e30dcdbf6ccaeccc1fa5b5571eebdb0c58e4d5051cd9b1d8effe6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994761, "uuid": "448caf59-9d9a-4de6-9a73-0bf6d92c72bc", "comment": "Malware payload (PureLogsStealer)", "value": "9d114d1ae6f7e6c48470f2c97cce14156a174e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994761, "uuid": "891b8472-38bc-4bc6-89ae-d7e8a397c143", "comment": "Malware payload (PureLogsStealer)", "value": "46129da8e9e6f24ac52dc35db0f96b485a2eb6e63ee2032e07db3cf7207feba1198448bf673f9be75ff9da8a5787de75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994761, "uuid": "7dcdf16d-9487-47e0-a281-6753c6da6db0", "value": "T13C751260232CCA16DCA94B70C476D3F523A0BE89D462F2179AE9BFBB3538F175904746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994761, "uuid": "74d3d2c0-8e9a-4faf-9675-20a900c76f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994761, "uuid": "48a98327-d7ec-416a-93ee-68c55599977b", "value": "49152:imA7ZT4XyvxBts1aCtTpsIaTATEexkyj8zlziee3:pA7ZT9vx/sYknIBziee3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994761, "uuid": "d2ef6f3a-3bda-4ffe-8fbb-8ab598886973", "value": 1637376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994761, "uuid": "06e170cb-d79e-47e6-9f45-f9aafffd7136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994761, "uuid": "8c110024-0aec-4d75-922e-408efa0e4bf3", "value": "0000000151908257_signed.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368b17f5-91cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786043740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043740, "uuid": "0c5bea25-c1ee-4fda-9b1b-e4cba06987da", "comment": "Malware payload (WannaCry)", "value": "c763e05c8ed4b4cad85c610abdefc5f1", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043740, "uuid": "bb9cf65d-1e95-4ee0-b113-451d8b03c829", "comment": "Malware payload (WannaCry)", "value": "8cce14a06ff19f92020cefcf42c0040495c0dca18543f8449159ba1e78f69f29", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043740, "uuid": "ab2054d4-0120-406b-972c-e94898107345", "comment": "Malware payload (WannaCry)", "value": "97454d2f3186331f68be1815e277488d891bbe16", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786043740, "uuid": "19913216-d258-4df9-ab24-c26bbffa3ad0", "comment": "Malware payload (WannaCry)", "value": "d9050c7e4f51e2d243f3b6bd880dc2e5cefd15a25efdfe9e68475798335e424d2f9f7c61ca17b9cd4cd69f40cc5fa1ff", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043740, "uuid": "53a05912-2573-4da9-82e2-bf904e967820", "value": "T17C063398726CA1BCE0450EB444B38D1AF7B37C5567BE4B0F8780866B0E53B9BAF90751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043740, "uuid": "dada9730-0539-443f-a768-6297047ea2d3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043740, "uuid": "3b2aa954-6eed-4f68-8e18-23446b75460f", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2A:DXDqPe1Cxcxk3ZAEUadzR8yc4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786043740, "uuid": "48cbac74-8023-4bc5-be46-b60a0650190a", "value": 3688448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786043740, "uuid": "6410d4b5-6888-41c1-9e21-92881b36f14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786043740, "uuid": "33a61eeb-a9e5-4d57-90c6-6055e124cc06", "value": "8cce14a06ff19f92020cefcf42c0040495c0dca18543f8449159ba1e78f69f29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91295bdf-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "fcfaa017-213c-4ed0-93cd-f578543ab771", "comment": "Malware payload (Mirai)", "value": "e2da17d8bbf356ea60b9881f15eee0d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "fb6ca6d6-5cef-4978-b626-1b1c0023e5f6", "comment": "Malware payload (Mirai)", "value": "8dc1d8251208789e5d9e269372bf8e0abcc6bc2bef0df932bca6c58a12079e52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "563c60bf-1cf9-43b3-ae99-7dedee33c33e", "comment": "Malware payload (Mirai)", "value": "480b20a44113c1009ace9395f38bf7af6b152a88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046469, "uuid": "0435b9b1-23c5-4ced-9be5-bffe42aeaca9", "comment": "Malware payload (Mirai)", "value": "c3887d81d424b3a5d1ae28e79358918cb8632fed35b6e0af9d09f8cff97743a81e81d84489bd60286ea9c06eebaabcbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "3ed72692-47ec-4ba1-ba35-a48f0af3f78a", "value": "T1489408CC51B0E3CED060AD32D2257AB79967123724837A8D61DEEB7B12F714606B9E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "0a870ccf-7f21-4f34-a314-489f07b5cf60", "value": "6144:R35TSaH6gAQgtLHE8VZT5wR05Ujez+EuXj65C69NPqB55ab:fBgxk8VZT5MjeMT65lPUHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046469, "uuid": "efec6bcd-3f38-45a5-88fc-4af1a77c31df", "value": 411552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046469, "uuid": "721311e3-7dc1-48af-9b81-0c98f75bb99c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046469, "uuid": "62c24e4d-d843-4948-bb82-47989bcd5a3c", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9304922-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785996312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996312, "uuid": "5bfafcc9-e097-433c-984d-328b80301b1a", "comment": "Malware payload (PhantomStealer)", "value": "6a24eb3239d3dde1dceb58352b69f3f5", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996312, "uuid": "3d5434d2-c661-4102-916c-3f6749a63ca0", "comment": "Malware payload (PhantomStealer)", "value": "8f6f78a3e78c282fa75cc96b5ad6b2c5083ca05bdde8ebe8b4f32bce6f64adf4", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996312, "uuid": "37fc3d5d-413d-4ef8-b002-46ab6f0a3e2f", "comment": "Malware payload (PhantomStealer)", "value": "03ee984eff59d8d9d1a579642481c00948dfc1fa", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996312, "uuid": "6f4f57f7-8dfd-42b8-84e6-c2a13746720b", "comment": "Malware payload (PhantomStealer)", "value": "9e0dcfda98b96b5607229229c961951c7ced64554155aa0ed6565febf8cf953ff9cf2fcb2db5fd6bec809c4440822b4b", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996312, "uuid": "9baef8a6-bb06-4a30-896e-834310d0971e", "value": "T18F94F62863F88A09F2FF6FB5A8B049118B32F84B9D39D74E1988509D0D72B91DD50B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996312, "uuid": "e649fd5b-7df3-46b2-a695-bbeac450ee1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996312, "uuid": "d86317e2-e039-4e75-bf69-68de3b400fe8", "value": "6144:BTJAKXh0CBHGz0KXXUJKYOh0NbWbSOklUyS3Adcz:BTJAKXbHTacKBD3kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996312, "uuid": "2bca3287-36ba-4eae-bbed-2488046a9a12", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996312, "uuid": "cc4e2067-993f-44e0-9301-beffd842d60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996312, "uuid": "a8daa94c-3021-43d5-9636-7b16ac70d09f", "value": "updated-phantom.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef97dd84-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040185, "uuid": "6a49302b-b1bc-4f21-a7cc-220b333b2278", "comment": "Malware payload (Mirai)", "value": "f9afedc1d6e5aaa467a588e6078f0416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040185, "uuid": "72171273-cee9-48a8-bd3b-0b324e7f1132", "comment": "Malware payload (Mirai)", "value": "8f7eb852c7118ae14cf0ce722792d0e41397dedee3ec226c2e89c4684f66585c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040185, "uuid": "80227a54-bf16-4664-a7dc-214243df791e", "comment": "Malware payload (Mirai)", "value": "e4e28defcf709fa7efbec081c4a34ed384388484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040185, "uuid": "96a680bf-a93b-47c6-956c-0d8de9271a23", "comment": "Malware payload (Mirai)", "value": "fbacd11d40bb7695446ca4cb506f6b839385570cdfb1bf0c36d176bb74f62fa76b24048f2d1659e607616afa8b95691d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040185, "uuid": "1f461999-a310-4224-963e-a0d223e462ee", "value": "T12974D64F7E318F6DF264C73847FB4A70D64836D617E1C692D06CE8091E2438DA45BBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040185, "uuid": "e18c7e23-c738-4da8-8ddd-19310c2379c4", "value": "6144:/x2n+0PUjHvc4XNSetvqDNRtsBQXQdT0GkCLGF17PG0:/Un+0PG7RqBR2Qa0GFQPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040185, "uuid": "09ca8fd7-5a98-453d-91a2-f6796fe869bb", "value": 344800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040185, "uuid": "05c922d5-cc23-4e39-9f1a-06f17d2152b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040185, "uuid": "d6538de4-aaa5-4e46-9056-5aa297252e99", "value": "pope.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7733fd07-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026669, "uuid": "a99a6a15-5a88-452b-8f90-b6dd9c9f8b58", "comment": "Malware payload (RemcosRAT)", "value": "9d5f239ddead4e1ddf188b3a9812398b", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026669, "uuid": "a353f8a0-eede-4c20-877c-9d9a161034eb", "comment": "Malware payload (RemcosRAT)", "value": "8fd8208e5cbb67f5fcc38769b1eb2e90bac83115e9d0e64fc4b0f589121f0130", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026669, "uuid": "305d19e7-926d-4d7d-ac73-9dd16d859b2e", "comment": "Malware payload (RemcosRAT)", "value": "35a08404722e08ed9b7062f8f921dad8d0d558f1", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026669, "uuid": "16673fa0-8a12-4171-88db-78e71242cdf7", "comment": "Malware payload (RemcosRAT)", "value": "adf6582c48ef30891bad060e199f4ab840c2264e9fd170b5b0b7933b7a042cdf467ee651932b5083a6be56aa0ea6e6cb", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026669, "uuid": "8d72bd25-910c-4294-bd00-833f571e0d07", "value": "T1E625EADF6BF33A4C2408B75A89FDBD9C1842CC910452A07AAFB41BDAC51D6416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026669, "uuid": "f82f56d1-3537-42a7-afad-d8436cb81ac9", "value": "3072:l4YwYp0ur51x+8J9NB0+OeO5Sp0BMzxKMdJRh:fJp0ur5HFJ9b0+OPSp0BKxKMPRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026669, "uuid": "475cf19f-99f8-4244-ad2d-6fd434b45144", "value": 1023169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026669, "uuid": "fba7e0d7-4d93-41cc-ba82-e7e4df8067ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026669, "uuid": "879ea218-b57a-4ae5-9774-fb38f2af4e35", "value": "BBVA Comprobante de pagos,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85f7a7c-9139-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981278, "uuid": "cc27a06d-e12d-4ad4-aae8-489e1695085d", "comment": "Malware payload (Mirai)", "value": "4c2a2bb23ca8110153334430f40f5294", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981278, "uuid": "b6f11e3c-ea7b-4fae-981a-9792877f0749", "comment": "Malware payload (Mirai)", "value": "901ac5e8541d5f7e2ea51a635bcb33d7c12ae809c2f75edb63622d9004dbbde0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981278, "uuid": "5b6d8bf3-03f3-4e8e-bf23-02ed7d458b2d", "comment": "Malware payload (Mirai)", "value": "0db7d9c98591506e1c4d47cdcc4334a3913064d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981278, "uuid": "f712f6d3-2efd-4d0c-a847-557f0c6a7835", "comment": "Malware payload (Mirai)", "value": "e884b84f38408bf818b7f6b6df101d7ced20ff9aef0252d3e84ebce817ec94c7587b3a4838af952c6fcdf569eca19696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981278, "uuid": "004d6704-2f32-49e3-b83d-436f1cdbe336", "value": "T16EF3284A77108FA1D336A63046F387A7ABB9228217D2D585E36DDE107F2135C681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981278, "uuid": "c60322a2-f475-415a-9aeb-ccb2be3752de", "value": "3072:GT6WkkNUjyvuasdTgWnQUf1F0b79GpDP1CyJ7uwkjbl:xWNoyvFsJBQCYSDP1hluVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981278, "uuid": "0c65fefe-5d3d-47b7-88b4-09256d865218", "value": 171148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981278, "uuid": "3dd0b92d-abe7-4289-9d97-049a2f4a1b4c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981278, "uuid": "9c18f7e6-d38a-4785-9634-a5501134be31", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df755b5d-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048318, "uuid": "fed1fa89-374d-4b4b-8329-43029a7ac621", "comment": "Malware payload (Mirai)", "value": "547d327a7e1f5353b60f9325c6bd13b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048318, "uuid": "9c5764a1-4f94-4e7e-94fb-4d04ff9849a6", "comment": "Malware payload (Mirai)", "value": "9034b3861f27e6936fd910a22ddb348e8b0f7a70a4e3ad2e4928dc3fbdef19ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048318, "uuid": "bd320185-75e5-4c98-9447-f258cc14f0c6", "comment": "Malware payload (Mirai)", "value": "e3682008d1f64e0afeb78adb307140e1bd62da9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048318, "uuid": "7bb99bf2-6a31-46f8-9ccd-32aca30e23ee", "comment": "Malware payload (Mirai)", "value": "22d8ac33d992305fb8f346f3a24c615d9fd5517c779690734f4b8b7a5cef843ea6e176d8b001b47f5c9b2ba835bd7823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048318, "uuid": "7109f22a-4957-428c-985e-f4ab312907a1", "value": "T1DAC36B73CC2A6F58C528D5B0B0748FB96B63A960818B1FBE5577C2784083D8DF6497B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048318, "uuid": "4b1369f0-22ff-41d6-ace4-314b533b5a80", "value": "1536:flhYag2gxi4h6McB1HFCQKrHIrL7xI3kM+rIrxVqWlV8/fVPVoa+9h01:dmKgx5h0FFur8u0M+rWbqWv8VPKa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048318, "uuid": "ad4056c1-54a2-4c97-893e-844123149e90", "value": 125880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048318, "uuid": "9b00322c-a62a-4462-a78e-6f988c9c8842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048318, "uuid": "bdd12725-8c74-42f0-b022-f085281db662", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375db482-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978458, "uuid": "695ef65f-2d6b-4019-b283-22b42967f09a", "comment": "Malware payload (Mirai)", "value": "a98d67e67fc04b4451850c70952d9b3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978458, "uuid": "e1755610-f8e7-4376-8312-dcc255883dac", "comment": "Malware payload (Mirai)", "value": "90635095f7edc189533d696d5af6edd85024dd2438bd7741fada4e7ee94a7e2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978458, "uuid": "28c4e3a0-646d-42d0-a822-b78d35a52021", "comment": "Malware payload (Mirai)", "value": "1fe6d3d412ea89ec4e4a284792c429a7558c9ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978458, "uuid": "19786156-c3db-4068-b064-1213637cd1e3", "comment": "Malware payload (Mirai)", "value": "f915390f0a4c8efe5869207d16bce4c24eb076f1e85db94da57593836aab7ebbbe7a9cb9ac14212ba926954aab9ad396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978458, "uuid": "3eb6edb3-fedd-4d0e-8f9d-bf3104a2f590", "value": "T114A3CA5B6E318FADF27887304BB74B30A79963D623F1C685E29DC5011E6434E681FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978458, "uuid": "cb749be1-1828-4726-b3f0-7f1f89c7e9c5", "value": "1536:UfM9z2Ptbv86hzsv8c374hzrXmPrh2cbGlHerWNwbZDNCHgLcqCw3:UfHtbhiD3GrXYYc6vwbZhCHT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978458, "uuid": "27ee40af-7118-4231-808e-34b08c4107d8", "value": 98004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978458, "uuid": "0ed00346-171f-4a80-84cb-713a0f95c254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978458, "uuid": "2386840a-5c77-4a26-92f3-b073aa1f251a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3249c109-91a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786025264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025264, "uuid": "87e6f26b-d90e-4612-a3b7-26c89d8732da", "comment": "Malware payload (PhantomStealer)", "value": "38a18881cd691a0a2e5b51f1c8eed827", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025264, "uuid": "dd5b60c3-9397-4c50-be28-fd4fbb8c948f", "comment": "Malware payload (PhantomStealer)", "value": "90655bfb1f2e873252202256daec20ef3ba39187cdeb17c9acdc15086146c04e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025264, "uuid": "c4279e98-c328-4a11-8e69-3108bfd88008", "comment": "Malware payload (PhantomStealer)", "value": "8b128fddeac9e92a2e5b120d013a71eb078d26ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025264, "uuid": "2a36c39a-3a25-4813-8447-037cb785c9f2", "comment": "Malware payload (PhantomStealer)", "value": "3060ab61f4b2d8d851590f315db4765af4cb48cf4dee54a4c9ae28b946c21ef546e5dfdaab788136d0cb6ab16e815168", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025264, "uuid": "c66fb9e3-6147-4e72-b897-4b0f5993cff7", "value": "T1D4F5C8B356DF39866E423E4D481E3A694E6E85342CA3D9C8FCCD09D5121399BA034F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025264, "uuid": "f667e4ba-9286-45e0-a8d2-f892493e7e20", "value": "49152:yFmjYXWS/nlQVR6IvHbCp7LNZLY+U/wyKP:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786025264, "uuid": "d0215679-6065-46a4-a5b4-c7c8c5501851", "value": 3632265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786025264, "uuid": "650faed7-a607-4342-b4a8-16ffcb310153", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025264, "uuid": "4c45cbc7-0b65-4bdb-bca3-c04eb18ebd3c", "value": "drop.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f059a0ee-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040186, "uuid": "044cc03b-96c0-4487-b492-2d0f1eb74f4a", "comment": "Malware payload (Mirai)", "value": "52646d6dcc534a89f0d2d77593f7e361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040186, "uuid": "1d198bf7-707b-4506-ad8f-8caa20f5ace5", "comment": "Malware payload (Mirai)", "value": "911db9a05265582c4962d02cc356aa59cee7ad3c6c90d04460bdd69557056beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040186, "uuid": "3af31355-5e11-4815-9b3e-896eeaeb9f8f", "comment": "Malware payload (Mirai)", "value": "8d0629e788c37b3a690553d2f325702c46a795fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040186, "uuid": "aa87935d-4ccf-49c8-bdf3-e4b4737d8859", "comment": "Malware payload (Mirai)", "value": "9c072ba124a39aa62ace27f1da9e2da23cb1e6cacb234a1103a5f127f416beb84ad3486bc3b5aab7ac60e68f936ffd13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040186, "uuid": "7e3358ac-374f-4fbf-bd3b-785ad7fbc5ab", "value": "T14F349D23FA215F8BC21B99F259F88A7A1B037C615A07CF917061F7B89B53AD5B409370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040186, "uuid": "82e1bcdb-3c9a-46f8-bfe6-4dc049b6930e", "value": "3072:d8jPVL9qOn8Ao6Yg1HvJUADBJ4PXfCX2Fb0C9/Ks4Lgg3AAOnqeGlbebTC:dAXzYKvnf4PPCY0kt4LV0qjl6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040186, "uuid": "f62873de-939a-4aee-aafa-f3230f8b16f9", "value": 252712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040186, "uuid": "5113eb53-4916-4de6-a417-59756b69684e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040186, "uuid": "d9c584f6-3b66-41a5-bafa-016968aeda5f", "value": "pope.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0d05fa-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786008965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008965, "uuid": "98c83dca-ac38-413e-a680-65d86eaa0771", "comment": "Malware payload (Mirai)", "value": "83c7ac8c5b19d32fc70d6fc2e5b8ec40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008965, "uuid": "0a7f9646-d1b9-427e-93f9-f62bfdc2e36c", "comment": "Malware payload (Mirai)", "value": "92156d8b4a15c0ead650dd0ef01dbf3ae0f3b45eedc48ac8229c3243c98a8392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008965, "uuid": "ccd90819-34e9-4646-a716-e9bbfb8cd0ad", "comment": "Malware payload (Mirai)", "value": "82907fde0e5e31c4831532b8d21e903baca7bee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008965, "uuid": "6b51e6c7-2fc0-4d29-b5a6-e85a3354068f", "comment": "Malware payload (Mirai)", "value": "f9d9b7c9d135f766409b61bcf4f1568f8655b5d0e4ebf1581e09e7d92ebdc8b78ad617991871c0e10e3be7e3dea5f233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008965, "uuid": "f7523b69-6659-43b2-b11c-28e3abd2148d", "value": "T1BC6302D72B53F13CC89A52F7424855C6EEA18819C3A54BAB2AB8947FD423E083DF2114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008965, "uuid": "e1c9e7d0-4ac0-4b84-98bd-afdd4da26715", "value": "1536:j1ETvFmZx91AnGxbFOzj9ZKayO+Xjvaqgv7pB8pGK1XGzrmiz5g6:pETtmZx91AnGpaBZ2Ovqg1B8YrmZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008965, "uuid": "9773ff59-c303-4d43-b1a3-4c71bf4bdbb9", "value": 69500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008965, "uuid": "6bf68c5d-5a45-463e-a9d5-9934110193c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008965, "uuid": "e192e943-d920-4872-9405-386990ed90d5", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.25210.27426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61f9894-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785994616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994616, "uuid": "9cc76d73-fd61-4120-93c1-8c61464fe6b3", "comment": "Malware payload (DDoSAgent)", "value": "50acf95be29bcb3d8e1b7866e46156f5", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994616, "uuid": "0023fc7a-bd8a-4449-a201-1af548d1d6f8", "comment": "Malware payload (DDoSAgent)", "value": "925216bc36653e4fc476bccf970e1a88122c9867f431f83ec7eeb3c6115d459a", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994616, "uuid": "be89bd75-7f9a-4e81-bb3d-70690fc632d5", "comment": "Malware payload (DDoSAgent)", "value": "d7df3927a6cb44de08aac5b02267113efa3b74bf", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994616, "uuid": "89fc9ba9-ba63-4cbe-8270-f7a01249c45d", "comment": "Malware payload (DDoSAgent)", "value": "2b0a76bcc514852b39f2ed1dba3b5b91ef26a28b1c22123499b3e7cefb34ca886acab274cb2cb09f1771b4c2485e216b", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994616, "uuid": "f7ba86af-edd0-48b6-b6ab-6087c462bfc3", "value": "T12DD57D137FA8DB0FC52822310DB1CBD5672A9C4642C6A517B285F32DF9B20AC599EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994616, "uuid": "be77c451-91d2-4536-be9a-61c2c1d799ab", "value": "24576:lRmKxIMx7shOPXLYtnAIQJAcsNmqGs9Io9GEfjUtTEEyTbqQA1yUOU95lZc5LWLL:VkmToVfjQyhA1yBU95/NW79MN59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994616, "uuid": "415bef4f-b138-429c-8bf2-191295dfd7b2", "value": 2963819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994616, "uuid": "3f571c36-5b8c-4f8b-b499-f03f9387f2b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994616, "uuid": "57aac196-fed4-4fd0-bfb4-907d6a68f7b2", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7926331-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998832, "uuid": "90e24db4-eb99-4e1d-8f5b-dde899b8aedb", "comment": "Malware payload", "value": "c9bfe42869ee30a4f7e618cf65559ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998832, "uuid": "dca5ecec-9e67-4864-b590-b83fe2759546", "comment": "Malware payload", "value": "93808e10eac891a5957a61a82ae15922f76d809f58ebafe08f110667135123fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998832, "uuid": "88a38f71-10ce-4b40-b5c9-d1d778e560a0", "comment": "Malware payload", "value": "8fe6a653240fbaf3d47800e6a8bd8306856190cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998832, "uuid": "b70e563e-9f2e-4a73-8476-966e4b5977f0", "comment": "Malware payload", "value": "a1af59ade3690ea3e8fb8d11c44a7fd8dd12501399fff24240a7bfff73a79280b61dae1b31fc3c88f2dda0ee17b0fd93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998832, "uuid": "767ef4d9-b47a-4d04-8980-4e221f2ebc3d", "value": "T183D312BF558DFEE8CF2209B7DB560108991123A3D1156A3406C6F73D8C9EB9D27E1B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998832, "uuid": "d86fabd2-978b-45e2-8ef7-9751706e14db", "value": "3072:fqY9XWP/9KVhdphVwWlL9z37J6Q2H+NcemY3hHP7P6n6:iY9XthhVhXz3l6fHC1v3x7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998832, "uuid": "95c855fc-3fff-4954-a750-2835e218ba9e", "value": 133852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998832, "uuid": "2b4459fb-39da-428f-81f9-acd861fbaf44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998832, "uuid": "deb3f52e-34e6-4940-99a6-c3bf12f9ce8d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a88ec5-9197-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786021722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021722, "uuid": "d1fdeec5-8d2a-4a12-b92a-e588f1262152", "comment": "Malware payload", "value": "531e20aad035ca83f46aae4a5d136fc7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021722, "uuid": "fab10a2c-47e6-4cd7-b931-b6f43e0d8f4c", "comment": "Malware payload", "value": "93916979a489c3fdbfb85f2ebef61428ac9326bac123ed1d4db0d36c8950c3e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021722, "uuid": "16eb660d-f95f-4d95-864a-1eae676bb2ba", "comment": "Malware payload", "value": "5271ee760c2dea7854864693963a022952451762", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021722, "uuid": "5af8bdbf-a637-43f9-952d-5bb23467da93", "comment": "Malware payload", "value": "b941c5326562c795a3627e72d9506136e79350a6276939b40a279a9e0b328a236c3842bfccb8fb41a4636756bf43c1c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021722, "uuid": "80207697-e0f1-4957-94b8-e4c6586fdbd2", "value": "T1D0C27D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021722, "uuid": "4b15ef28-f872-4055-81f7-a0bcb81222cb", "value": "768:658vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:658l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021722, "uuid": "40179bf9-488f-4a24-b209-5fc679bfa9f5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021722, "uuid": "7346a922-4422-4d80-af8d-1d9f9bc0aa3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021722, "uuid": "fbaeb73e-1f8b-4e4f-b9b2-a3a91d989262", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d3126f-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786005188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005188, "uuid": "beb226d6-26c0-47a0-9ef6-95c9afa46548", "comment": "Malware payload (PhantomStealer)", "value": "40082bce60b8c0cccc76c4e9755f7355", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005188, "uuid": "27c97d26-269d-4f05-9228-9396e1585ff4", "comment": "Malware payload (PhantomStealer)", "value": "93c12bc920498b2d2c7aa60c66a71f794348546f8e41ff3b010aa3bf9be643bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005188, "uuid": "16203ed9-329f-4726-9b25-4766b392b8ee", "comment": "Malware payload (PhantomStealer)", "value": "36e8d52de7aa60beb09058776241f8be811bf324", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005188, "uuid": "e046b097-b81a-4363-8a65-1b4ea84f7bab", "comment": "Malware payload (PhantomStealer)", "value": "bf052d38b63726fbd5a06a1d451fefa587ccdb52420cc5d8049796cc4e7b7b21a622fef19891292324202c6807f062f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005188, "uuid": "c3e149c0-9041-4095-a5aa-c6aa7755be79", "value": "T19DF50781278492727B21AB9C537ACE369A0FA00355D6DF04316CE708776DD4FA39CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005188, "uuid": "fff881bc-cbe5-4f1f-9e31-c1e5e2d6be86", "value": "98304:wJHsbWErtHi3JWUZ+gfBwyWAqkvOEoHZA8ZO/sgDHS8PVBDZKBA1Ru:yHgDYhZbno5/ZO/sUHSyTfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005188, "uuid": "5dac1f22-e668-440c-96bc-8118468a1f0a", "value": 3574960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005188, "uuid": "fe051c56-55ac-4d7c-87da-168ebff313c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005188, "uuid": "724301d7-336a-48be-8725-167a1cea4b63", "value": "RFQ _OPGW20180126.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec60178-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786005233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005233, "uuid": "53183c64-34bb-4c1f-a76c-7288fbd86fcc", "comment": "Malware payload (LxBaseRAT)", "value": "1fe9af4555024c7b603fe66679f5b010", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005233, "uuid": "75604723-77ee-4835-a8f6-06ee6371d16e", "comment": "Malware payload (LxBaseRAT)", "value": "94e8b56ca74e421e08e4843c1bc3319413dfdb0d1217df3b84a4c5a3fbb76184", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005233, "uuid": "50711956-2b6e-40e2-a703-d631a53f5b89", "comment": "Malware payload (LxBaseRAT)", "value": "b6d2a002a383017b992f618d54a90d3191836f16", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005233, "uuid": "f2099ab9-457c-4ff6-9435-343ec16b0d29", "comment": "Malware payload (LxBaseRAT)", "value": "ad5ecdabdd38e8b670a18af9594508082013812ba5c989bab15275d91f607bf4a8c8067b46ac5ddc1bfce610df045c5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005233, "uuid": "9ab4926e-2968-4f01-b2d2-35fc549029c8", "value": "T13905AEAE86687F690408F81D472F31C9EDD3C96A1B7BE2D8BF4A0F6F01175A0DAC5911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005233, "uuid": "2ab42f73-d905-4b53-9a01-73167100f52b", "value": "24576:nhfuLUVjB4zpUM1H3CbViRvpzCVn0AxC1Sw7h/:n67wb50n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005233, "uuid": "2958f281-4c15-4c61-bf48-d4cbeebd7533", "value": 818979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005233, "uuid": "cb49924e-3c72-4eb1-ba99-c1953a1bdafb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005233, "uuid": "4524a14f-0b60-4d51-8b8a-3312f89a335c", "value": "PURCHASE_ORDERS-Q4-2026 .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5949ff-91ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058680, "uuid": "1191de1d-dac3-4d73-a696-039629fa5eb2", "comment": "Malware payload (Mirai)", "value": "4cdd3997d23e81d2d8888985e77d2124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058680, "uuid": "44972c0b-24fa-46da-8c74-3bf53fac8ce4", "comment": "Malware payload (Mirai)", "value": "94ff3c3a94cf977890206e7592239387083dfbe2aaa27a2f6f74d7b39d68c8e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058680, "uuid": "f04dc1fe-7633-49c0-b9e7-c4d61332c22a", "comment": "Malware payload (Mirai)", "value": "cf723562e98d21aed0c1d52fcdbe47fffec79ab4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058680, "uuid": "849b9472-fec5-454e-9f29-0e9482869145", "comment": "Malware payload (Mirai)", "value": "4ca58c5094237e000ef5f675517acbcbeaa0f9458f3ff2a0d841c95a6c64b646d2d739dd564b769598f92b746cf4d9bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058680, "uuid": "d19c50b7-3f37-4e1a-b793-d40e3776fade", "value": "T10FC329A9F890DE52C6C52676F74E418C33231778D3DA7106CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058680, "uuid": "7854108c-7c80-4bd6-b305-a83c09e60609", "value": "3072:8E/eDOpvJF41gFIXbcYEEU5ajMWxNwhUhGw2P7KNyF3j+uFf1Dl:8wEuFCbcYEEU5ajMW3wst2PnT5F95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058680, "uuid": "b94073cc-1c8d-4131-8743-b53e5a179162", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058680, "uuid": "507d3a1c-4f64-41ea-877e-3474493acaab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058680, "uuid": "747c5b34-73f3-41a2-aab8-2ec5170b5ee9", "value": "f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb5ed83-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045549, "uuid": "07636348-94c6-400d-94ea-b3d158531fc7", "comment": "Malware payload (Mirai)", "value": "076ef529a359288e482301dad99fda4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045549, "uuid": "3e8499b4-cd3b-4505-b80c-c44b9c773341", "comment": "Malware payload (Mirai)", "value": "951867c8f6694d43e8346f29d72a6d7006894332f6250d0d107751ba2393c0f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045549, "uuid": "e3c2cd69-a69b-4159-af22-bf5530642392", "comment": "Malware payload (Mirai)", "value": "4e9d7f9ed184975e35c78369edfc9ee83590bd13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045549, "uuid": "cff23669-ebc6-4a15-9fc3-86d05cdacc0e", "comment": "Malware payload (Mirai)", "value": "c063dcb83095f5102339cfa50915f9c98f426e83d4f463163acb424dedda0e5412e01efff8d7d5f764ae4443c5b5b632", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045549, "uuid": "08f01988-8ad6-47b9-a18a-f16e497af243", "value": "T121834BDAF401DDBDF84BDABA45230A0EB531B3040A930B2BB767FC97AD621F48916D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045549, "uuid": "b29547d4-2dba-49ba-b12d-42143e62bb24", "value": "1536:cPBKx/acjJmNN1xWXOrvpOh3iLncoFD/806iJN34Us6lbR/nNF5Fbd66CQ:CiO7p03ijZFD2pUFlNLbEBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045549, "uuid": "90a7d30c-ab10-4096-92d2-466cd8b6de5b", "value": 84776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045549, "uuid": "33f70d05-d336-493e-80fa-3bd201c22fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045549, "uuid": "0ca3247e-698f-4f88-8bf0-218c4bacc165", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c2f863-9138-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785980732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980732, "uuid": "d647bd96-d3af-4e2c-98e4-0306586e0155", "comment": "Malware payload (Mirai)", "value": "639c97940c3642268d8e51acdbca079f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980732, "uuid": "5d9dae2e-1b29-451d-938f-a66f2682cadc", "comment": "Malware payload (Mirai)", "value": "957e67f204d9e9254e4750bf73cc7bc1ec551f1a0536d586df76902b5dab0726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980732, "uuid": "8e97c4fe-d24d-476b-bba3-1c595f9347d7", "comment": "Malware payload (Mirai)", "value": "c75cdc2f285b8254195b5f221dcd76894ee55f48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980732, "uuid": "09aaf1bc-40d8-4090-b3cb-8d0bee7df1dd", "comment": "Malware payload (Mirai)", "value": "918425241974c21666d3a25c0b89d07e4b753330799f9626b3b75f090683d0e9e6cbbc0e4f48168a441017a4123b5c7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980732, "uuid": "b4461f8b-1d7f-4ad5-b689-d3c0d3c6ea87", "value": "T1DBF31889EFA50FDFD46FCE30062E132719ED589E92F16336457CCC58B69E2484AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980732, "uuid": "bd291746-0ce7-4a76-b42d-fcf6eb1e703e", "value": "3072:8DNtskU5LcNcLcl1UDUVlEz6FV4EfFOBeiInJO7PYzcE84PPCmI8/j6CcW6UP5w:qXskU5LcNcAl1UDUVlEz6FV8eiInJOys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785980732, "uuid": "4d1d9910-905a-4632-aa6e-0ecc7e81c759", "value": 171148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785980732, "uuid": "9916db30-1d18-48d2-b346-8b2ee6743d8c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980732, "uuid": "587ffc94-44fe-4da3-8155-d4b592d8be9c", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23acc9ed-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "af34b622-f465-4cc8-b32e-b98e5663c0d5", "comment": "Malware payload (Mirai)", "value": "6ed1b3d25151c7f45b0e09626ab7eebd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "4b145343-268e-453b-ae63-212c5016f806", "comment": "Malware payload (Mirai)", "value": "958dabdb8ea42dfd3725bf70d8d8641b794298942269d33a921d2428a9f0bf20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "0c886121-52c5-4ac7-9297-f363d966ff0c", "comment": "Malware payload (Mirai)", "value": "54bcec92d22d6caaa2f297f43ac872dc223dcedd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "27612f47-d2a6-4305-8a06-e5a2805a8d48", "comment": "Malware payload (Mirai)", "value": "c44ee00674fe690b07467348ee6cc26f7a75b64adedd5eb5ceb0b7c9f5accc6a7c2407a9de70807c1a1b258d047bb87c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "06f41be6-3711-4dc8-9404-b4816dcaa962", "value": "T1B4043802E603CDB2C01301B212B7DB760E31F9B7AE26D452D3BCFEA5AD616D1654936E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "bd13127c-adce-41d6-964e-3ac1f7c1243e", "value": "3072:svxSRDk8dj118115ccNaCJEb/+BIhbjoHU8gYlpm8X:svKJr7cNaIGjbjo08fm8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050580, "uuid": "e87c7110-8b91-431c-8bd2-3089c0ef077e", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050580, "uuid": "ac8534a1-1b3f-4daa-ac15-10a9beabff2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "a1934fdc-b579-49b9-b4e2-1aab734b215d", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb7a0ed-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786005768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005768, "uuid": "14be7f84-1c36-4a70-a245-74036f5a748f", "comment": "Malware payload (ConnectWise)", "value": "520025e1f568794245dac666c348a8fa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005768, "uuid": "6087fced-5c8b-4b10-8a6e-133c53c4277f", "comment": "Malware payload (ConnectWise)", "value": "960a805c5686d1145914bb57caab5fc12b420a35fc23b39b5604d78f47597149", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005768, "uuid": "a8d87acb-1632-46ab-aec4-0f1a19fd22f7", "comment": "Malware payload (ConnectWise)", "value": "238eea3f66ed9054233f60d4e82eaefb08996e76", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005768, "uuid": "15739516-31d5-415c-bcd6-dbfc198da514", "comment": "Malware payload (ConnectWise)", "value": "bc946641ef45a3b54e624a75ca626ea5a4086cf471b0348fd22320a0a596ced65a7b69d4467682775f1a216e906c96f2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005768, "uuid": "e55fabd6-6244-4b01-ad3f-086a9c14a0da", "value": "T1E72249290B0E897CF5180E2616BF20263CFBA459BF6209095F37EDEB3C3D954B836595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005768, "uuid": "06053f89-d309-4ada-a46b-157b77ec023b", "value": "96:OzgAcKVtczLVHK3Vgz8//zrcqEzdCAIgU4lK4AN0BNnE4ACfmi4EqvIL:yp8agz8/bAq0chqbnE4ACO93vIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005768, "uuid": "a0b3c12c-7acf-41f6-b5d0-396c56624adb", "value": 10342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005768, "uuid": "6a5c7df6-95fe-4cce-ae97-5d478bf426ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005768, "uuid": "e2186912-7519-411d-b662-a2bc6bdcd108", "value": "Document (1) (1).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411cce57-914d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785989641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989641, "uuid": "c84305d2-c8b4-4fea-9320-b32ba164540e", "comment": "Malware payload (Vidar)", "value": "d5e5e8c107a21d0bddc5eb3268962f6c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989641, "uuid": "a967fe12-af6c-42cf-a28a-bc1ff54c31c7", "comment": "Malware payload (Vidar)", "value": "963800f7e55fca015738f5ab5f09200c4be803c5740c2801fdf86d0de105fb4f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989641, "uuid": "1fad5178-ba92-4466-bf63-47afe7bbfb81", "comment": "Malware payload (Vidar)", "value": "3ebfc24e5d879f413ee79a21318558b4070dd2c7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785989641, "uuid": "0a92a5f5-ad39-43c3-af0a-014ae015f1b9", "comment": "Malware payload (Vidar)", "value": "d1e9351e85070fc94c831d4dbd2eccc6798857abfba932f41d917d9b675f006e9d63a6d683069f91668e5df9f38d1956", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989641, "uuid": "494cfc5e-16d1-422f-b208-5323f0827adb", "value": "T103F733C047458654D19FAFF9217F0EF36F270DA0736DA4AB427A8830F4695ABC58928F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989641, "uuid": "877339ea-6579-43ce-80b3-24d3c2d01342", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989641, "uuid": "0ce0fa22-09ec-4ac5-8940-a734b0240042", "value": "1572864:yLdkQIZ14zzAdFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7o7:y2QkKv0aABZVPArg/bXeB7o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785989641, "uuid": "88b95eec-6403-45cc-b1b1-277219e71f0f", "value": 76994398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785989641, "uuid": "758e7625-8784-418a-9119-bd91d113c37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785989641, "uuid": "20777a33-cfd7-489a-9fde-bab851ea2014", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399afbe6-9179-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786008526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008526, "uuid": "28a54a81-39b4-49ad-b803-f2144c57ef8f", "comment": "Malware payload (Formbook)", "value": "ffe3d122b995bf22676def4fb11b13ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008526, "uuid": "5e5b151a-10ae-4350-b6dc-e1dc2e8913a3", "comment": "Malware payload (Formbook)", "value": "9651b0ffc0ae5c18dabf04e4f388b44c48fc312c438408f33ea4635b65a048ac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008526, "uuid": "3d85aba0-14ef-474e-937c-68743ef3a0e4", "comment": "Malware payload (Formbook)", "value": "7321e689e279b142755155d929b50a133812e2fe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008526, "uuid": "e3313f00-c1cf-4716-9faf-e89e5379c4d3", "comment": "Malware payload (Formbook)", "value": "54ca10a7754c60516e41719b0115f42290e0df4d86bc7d9847276c2c0bc92b55732907ecaccf5373e2d84f226972c65b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008526, "uuid": "1090f443-f350-461c-980e-af78a71b9d6d", "value": "T164E508F336DF254B5A60FB2EA44D6D95070AA4716A87BDE430FE0E84474B0893F98C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008526, "uuid": "6bcdec49-3bc1-489d-91ce-68d608e3a687", "value": "49152:GQNMmCwgiKhydkC1VMEXEPrnWh+5IvQhKHHPW2ZlPlxxiDfXoq7:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008526, "uuid": "0d00a4e4-9e40-4a84-8dd6-897e35e2cdbb", "value": 3151406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008526, "uuid": "8f2c36a4-190f-4ecf-83fc-1b375bf471e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008526, "uuid": "0d50e4b9-7ba1-49d7-90c2-b111aa5ae2fb", "value": "MV_SEA_PEARL_ORDER_QUOTATION_FORMpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3df516-9169-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786001744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001744, "uuid": "20b5f452-2949-4322-b3d0-7cc497d82110", "comment": "Malware payload (Mirai)", "value": "94630ad62a7ade0bf628f682711d6d25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001744, "uuid": "a0030014-e505-4fed-b22f-f3a582bce902", "comment": "Malware payload (Mirai)", "value": "967bcecd7d0f07d801140a5c2159873c2220a57052d0ed2718dfcd4e960f81e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001744, "uuid": "01d68faa-84eb-44eb-b9f1-bf68adee9493", "comment": "Malware payload (Mirai)", "value": "c12e6539c8a6ac41fef9ad42aad4d56ddbb839d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001744, "uuid": "d3554c7b-711d-4147-9f3d-b8c8dbc9a014", "comment": "Malware payload (Mirai)", "value": "6f049709eb45f1a60fb98a20e7f9eef834fdbeee6688d8724a6403d87d0982eca4c9b86e514aa98d594c7045551be265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001744, "uuid": "2f043fc3-ac3b-4b69-9fb6-b0520be6b112", "value": "T18BD33B02A58080FDC49AD274879FD137FB32F89912347B1F3B946E612D3AF616B5A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001744, "uuid": "79328055-bbd3-4d4f-a798-41459f8d1418", "value": "3072:WHX3eBHqR1v5KquQta6ihRRuCgDauDV8b7b:W8qR1gCShuCoab7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786001744, "uuid": "d562c3e6-f97e-4ba8-94b6-47c5b04a71a7", "value": 141440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786001744, "uuid": "20b84b96-c1c4-45a5-a7fd-6d3b0040bd26", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001744, "uuid": "48c1d47f-25d9-4d7b-a3c7-771d2c8aa352", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2300e8dd-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "70026d07-7ba5-4480-a46b-d816472ef71b", "comment": "Malware payload", "value": "2252811701dc257641d739136ae62c8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "cc1f371f-88eb-4ac9-9bad-7330b2785a70", "comment": "Malware payload", "value": "96801f2bbb993227b7092ee0a8b143e83bbf85f99b8abd32abd79c45d7fb9719", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "01a6f84b-75e4-4e5c-96ea-a5ea1d64331c", "comment": "Malware payload", "value": "2ab039b3b028fdbd64b222e234a0e0b6c120adc1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "29b66a83-29c9-4e81-b90a-c41771d4e13b", "comment": "Malware payload", "value": "a99f19cb64792215aa9d6dbe7e669ae55adb8981fd9234ec68488f288ee8b0946c56ffdfd6d2133fc1570f39026da634", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "86be12a9-e513-44af-b64e-54aacda05268", "value": "T1DA117BD630302E72274C86E8389EC4B86257145B4DA60DADF4CF9CFB2B5839468BF742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "bd2f7f77-0280-4322-b1a0-bc40457864a1", "value": "24:YTdjSu3LBd/YiZYlJsu92J9xLUY9d7LJ7Ki:YThtd/YUCJsB7Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044996, "uuid": "27981576-3128-48aa-8b64-5a3729a6d354", "value": 1016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044996, "uuid": "83183498-2b10-45fb-84dc-953ca74c47be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "8deed18c-8fb5-4404-b1ea-acff94610129", "value": "auto1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1530c65a-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978401, "uuid": "4cb923f0-02e4-4722-8c14-c4d19f30603f", "comment": "Malware payload (Mirai)", "value": "a96bfd3680f088b24881cc643be76fc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978401, "uuid": "5344f9e5-4edd-4ee2-995c-f6100a9d8969", "comment": "Malware payload (Mirai)", "value": "96f7c5a4774691e2397617d90eeb27eddb0dd5b2b5b5ab44167ac948d135bbc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978401, "uuid": "a51fe404-6039-43ca-a49e-1d3c0f55abe7", "comment": "Malware payload (Mirai)", "value": "87eddc2e6b623952cb793023526da4287cc6227c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978401, "uuid": "a62fbbbd-e3f4-4c1b-8970-8230deecfb53", "comment": "Malware payload (Mirai)", "value": "3aeb212ae6ea7cebb5ed4063b410d9631ad11c546fb534e14ba8f942987053e93da8fb9450e217cdbf0c9b5ddfc8cec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978401, "uuid": "2683827c-1dcd-4b43-bbd1-c5070ae86077", "value": "T17D03F1DD470392EDDA62A0FC1EE50BB46E1897D2A5429F2B7299C74A8D800F13D83DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978401, "uuid": "2490c9c1-6ea3-4f6f-803d-3d177d64e7af", "value": "768:m0Sq4hADe1a+a7bNQyFmAUBXYgPN7qPWJgGlzDpbuR1JR:ZSqm8eC7bZFxIBPVwCVJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978401, "uuid": "f6ef0e09-2d65-4c2f-8fd5-88c4eca41f7b", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978401, "uuid": "0174c3f0-ab77-426f-9454-1a05a2482898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978401, "uuid": "c6c5a8fa-320e-4499-a43f-b97c302d54c9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02538cb5-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "4bfafa8a-f54c-4782-8f1f-3d19ac1a24e5", "comment": "Malware payload (Mirai)", "value": "89258aff7b4489766fe09046769f8f84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "260bab91-e264-4873-b03e-3cb3c63db3dd", "comment": "Malware payload (Mirai)", "value": "97457bc09a6635dbfd7797639d160bfc73a538e2b9c4dc2d084a88171ae5f27e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "b13af814-b732-4d5e-a17c-ec4138d7a2f9", "comment": "Malware payload (Mirai)", "value": "ed20d65cc5c0e3662bdf7de5d42562b37829aece", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "0924a961-5a33-41e1-a797-5f95dd6c896b", "comment": "Malware payload (Mirai)", "value": "a4dc2b27517c36e75de2e18a32cbba22cca4dc912037c5fefd0979b7728821ee474fa979fdc30b9d02905257c594de1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "e1e7fc13-4c04-4cc1-9b0d-17bd100dc175", "value": "T106A34B86FB93E1F0D94605B1111FF77D9634DE221024DE5AEBD4BEB2AD32A02925B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "1ee87341-16cb-4ffd-8d36-3fc6f1b06ae4", "value": "1536:Tw1BTLVHw4FZx6Rg+c3Ra/ofDQZV7JU/310vntiZvnwl7/4qKU7yLQPrL:yZ5FZxic3A/ofDMWClSCskL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048377, "uuid": "b3ca77da-0878-446c-8198-27816dd381d3", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048377, "uuid": "a3f481b0-8def-433e-9c7b-c13f67c5e578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "212e826f-1748-4559-803e-e7d0f292a68e", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e18225e-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048933, "uuid": "c20c9cf8-7c48-4c09-b3dc-f2994b214ab5", "comment": "Malware payload (Mirai)", "value": "120f082b512753362a0d35f5f18d86e7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048933, "uuid": "497eadfc-2cc7-489d-ae6b-4fdbd9867dea", "comment": "Malware payload (Mirai)", "value": "9748f0b3b56d7ae52d720dce4d495d58e21dff93cfdc742a8301324b848e0a6f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048933, "uuid": "7b8bcc7b-30d3-4b4b-ae99-7061ae970680", "comment": "Malware payload (Mirai)", "value": "fbd5e27e30d7f6a6549c38b4435f121d557902bc", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048933, "uuid": "f7d5e554-37e7-4f51-8ae9-61ec2a0d8079", "comment": "Malware payload (Mirai)", "value": "e3695aa946b584a985cd65ddda848a1eb5a77ffa6174084ff3fc2696a2d349cbcc4497e260f767e9f09f853da6f25b23", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048933, "uuid": "2be4d4f5-bdfb-42cb-af72-12c7ef26a263", "value": "T18DD3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048933, "uuid": "53435607-c3fc-42e9-86fe-e5e34776f09f", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zs6:xOFgpOEoVv3MXL5NhGOs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048933, "uuid": "cba48ac9-201a-4e3e-a7a0-4160531a5573", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048933, "uuid": "00941b31-c239-4214-a2cc-7f85021b18cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048933, "uuid": "ff2a5d10-751f-4fa3-b6ca-e3eb09bccb0e", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f1a912-9136-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979667, "uuid": "2b246853-506b-4cba-8794-255d02d1b70e", "comment": "Malware payload (Mirai)", "value": "d65b60667dcdbfc734995aae0c25ef93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979667, "uuid": "2f22732a-b381-42f0-951d-a086f693c95e", "comment": "Malware payload (Mirai)", "value": "97a04076d3b1d8845c64d8087f6b879def4560566e2376372d728529dc837cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979667, "uuid": "f9c73751-8728-4236-9a0f-771b4a54547e", "comment": "Malware payload (Mirai)", "value": "a0465bf8d72f4de589adc86ca7cd9589e64e4930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979667, "uuid": "86fa093a-ea5f-49bb-a60f-b36408692812", "comment": "Malware payload (Mirai)", "value": "71aa7ac9e151c7dbd1abe3266541b51cf7df3a87b68f018e5815a88968c4c4982951dc88764e06161d7c2e60c92d9663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979667, "uuid": "e2e52c9c-5715-4537-82bc-0a835d040d1a", "value": "T17443F1D34685AEB6C1E9143AE52CF3B674240AB8DDFB3555C52208ED76F92038B72C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979667, "uuid": "27d5befe-729e-4cc4-86cb-c79dd407b6f3", "value": "768:U6h6u1yyGeIYG6mbYyVpR/tG+0zpiPGHF2TT9m1Ok7FyL6qZBtuXNiRuTM0IdZAL:56u1yyGOzYpRlJEHsTxGy5nQXQQT18fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979667, "uuid": "69e4a93b-b77c-4704-809a-a9629701ba30", "value": 55924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979667, "uuid": "7688cc7f-b62f-47b5-a1af-55be3756cb07", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979667, "uuid": "100f7be9-d99b-4af7-b6c9-1686a8b34aa1", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f32b2dd-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "0e7d9b44-fe65-4788-a7fb-d7604275633a", "comment": "Malware payload (Mirai)", "value": "7593eef2e34e10488e4ac9b68728d79e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "a3102863-6bfa-4fc0-8822-90cc02465357", "comment": "Malware payload (Mirai)", "value": "982e2e9c616a4ae1113eaf9c39932afb30f8cd2548a404ce33f90fc92c78470a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "c79d8787-4937-40a0-9146-ad63bab1e2b7", "comment": "Malware payload (Mirai)", "value": "89e12a4cfdfd9a15d7694982defd571527d2f3a7", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "30c9f216-25e4-4321-8172-45de3c4bfb00", "comment": "Malware payload (Mirai)", "value": "f3e08c276b489c70ad2f27596a1f7090fdc81465c2fcba4a24314cf867d1f42ba87c8b6a89d0c53fe57a592c8844644e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "c3e6b5cd-cf52-484a-a9d5-e3cdca6f75ad", "value": "T14FE3120A983C9B86CC5E1330E0AA18B79445E59A9756C7DA5398CEC4F797EBF2C5E00C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "62dd4d99-10cd-4af4-ac4f-fe4e34e63f90", "value": "3072:UEv0oEdx4MooUfQUH1bBlVRLxFTh/IvFiDAXkho/GuDw:U4MP7UpbLxFTOB0ho/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046466, "uuid": "eb99d406-eb08-4c87-86eb-61831f6df4d4", "value": 149800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046466, "uuid": "00b85abc-5ce6-40b2-8821-094220f55603", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "4c83a067-45ca-4316-a82e-0e6721301e59", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b256a7a-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786026729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026729, "uuid": "1a93fad8-03c8-47d0-89c6-d9a01288edd0", "comment": "Malware payload (PhantomStealer)", "value": "7e66edcb2fda0c7caaebb04d74c72b82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026729, "uuid": "5f8bd099-006c-4a0d-9bc0-84fc4649449c", "comment": "Malware payload (PhantomStealer)", "value": "9834937477c328ffad0d982c40766053d1b6ba524f504c605266be5c81441e7b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026729, "uuid": "257968a4-0bac-4600-859f-2937fc936c7c", "comment": "Malware payload (PhantomStealer)", "value": "cecdcc7676d8df3db3c433798cf925058c6da8f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026729, "uuid": "0d8be225-f59b-4f27-adb9-192481c08712", "comment": "Malware payload (PhantomStealer)", "value": "1872bacd194acd2442785a0723a35a1b7ee9eb52870f47f17053b1ba5992719e69191ae3e9f1f8359561321d3e6ce056", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026729, "uuid": "76c99585-cdea-46ee-9840-37f891259d37", "value": "T18485C9ACDC735F263956E34ECE42ECF405E36B034D52D18E949E65AB0872B34DEA3852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026729, "uuid": "c8fbed40-3225-4f34-8f27-b1a9c7768c8a", "value": "24576:yIHFJVP410vPayQ9vw2yPXp57qMdp0I4pmusP8K8RCJgUDZE7MDlU4:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026729, "uuid": "28693f68-f349-4a11-9828-32c6a75b7f4a", "value": 1805104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026729, "uuid": "227ba208-9a42-4a40-b5fb-17aa627fcb11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026729, "uuid": "67ed277a-a635-4b3d-ad49-15a683de9760", "value": "SWIFT COPY_06_08_2026 CITI BANK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8330c3b5-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034420, "uuid": "77d318df-7d3d-4c00-9df7-8983fb5d946c", "comment": "Malware payload (Mirai)", "value": "5ab855d366d59b0e379f994f89298178", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034420, "uuid": "a6e2f445-9eed-4c02-8819-567de2d60326", "comment": "Malware payload (Mirai)", "value": "98d83f73703359480ec5f0f0e4e1d8b6c12b96ebd25cb09a0ca7f596712f6dd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034420, "uuid": "0f80e188-b95a-4f6f-a988-803395ee171b", "comment": "Malware payload (Mirai)", "value": "c97005ea02be0c80b41f74e65671429b6d2880c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034420, "uuid": "0f2704d3-bd51-4d8d-b63b-8a6aea7d323d", "comment": "Malware payload (Mirai)", "value": "5c85c4bdd7c602f3f6649508ae878befcea70808f938f5dab18b6e229861937125095a0b41b56f7ecd05167ca811be6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034420, "uuid": "459ab55b-f844-4706-9b80-1354a6f684a2", "value": "T100E35D8AF4029E7DFD4FE5BE44670E09E931A39131830B2A53DBFDA3A9311994D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034420, "uuid": "bd6ccb84-a233-4aeb-a179-a0b951aaab72", "value": "3072:7oDlIyA+oy+ZGiTyr3aiIHH5lgLOoe97dlJ8jAS:1Dy+ZGBIXxoe918jAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034420, "uuid": "c5bc697a-f39f-4258-9ac7-eaeae0f138d9", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034420, "uuid": "f10a0ca8-43a3-41f2-bb56-5a0c145efd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034420, "uuid": "369a58a5-164a-4d53-9e70-0b2a029356d9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d05eebd-9182-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786012371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786012371, "uuid": "d6b1e9c8-0617-4f57-aff4-f336ac5104a3", "comment": "Malware payload (Mirai)", "value": "cff7b90b2a979ba797fdab6fac4321c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786012371, "uuid": "5f26fc84-d03b-4c65-a346-9f5cc9bf8dfb", "comment": "Malware payload (Mirai)", "value": "9a26c7ac75b0c066341ec9ce7011849025c05b6b97fb7ad8f36ce0f6870b4d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786012371, "uuid": "8222cf2d-21c5-470b-a8c7-ac0a3da66e46", "comment": "Malware payload (Mirai)", "value": "2f02abfa4e2f361e6e0c9e9296f700342066f25a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786012371, "uuid": "c87d3dd0-c7bc-4296-9613-1e8c95b77d56", "comment": "Malware payload (Mirai)", "value": "fc70ec6bf83981ecffb9acf62f8919187867f055ae64a1348ea01807661ba8c3606ed06721841ec2bcd3f395d569d104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786012371, "uuid": "52974881-f3d3-489b-b3c9-bb542e7aa9ba", "value": "T134E36B82FB93D2F1E59305B0002BB71F8B349D398124DE4AEBA92E31EC75706955B67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786012371, "uuid": "d11b21d6-ebef-4b82-acc2-a8412f9f897c", "value": "3072:NIgQXXim6tQLgbWayB4nxqFkw8poFunpC6QH6aD2TDov1:Kgiq4gWa04nHpCRV0ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786012371, "uuid": "99838a3f-71db-42a0-bb93-978477d085db", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786012371, "uuid": "fd0b5a56-4653-493e-a45b-7e2c4982ddc7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786012371, "uuid": "4ddc5883-ae02-4121-8817-b23a0bdc9a18", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53116c6-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998828, "uuid": "c6aa023c-ede7-4162-98c9-3f3e4705fd1c", "comment": "Malware payload", "value": "d5d1472a7f22e43053d676f1a3008104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998828, "uuid": "7bf0ebe6-3116-40b3-add0-4e604ce0926f", "comment": "Malware payload", "value": "9a3e6c7ef5c724d3636000b75f23ecaef38aaf0c8cf861c8d7e7aa999b241998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998828, "uuid": "2e39a931-6148-46b8-86d5-15deafc10a8e", "comment": "Malware payload", "value": "bf64f6a79cad8eb80f70ec77242b77a895c41940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998828, "uuid": "ff202dee-1427-43ba-a0b3-d9e5bcf14bca", "comment": "Malware payload", "value": "6eb3201b9b3f74ae2325291b3e14fb1c310d9c73ac84f64dad33702a6290ba5f626038afebf50d61e469341c203f971e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998828, "uuid": "663fce79-becb-4560-ab8b-752d5cced9c6", "value": "T148C3124CDB0B54CDC4E9FB788370D2EE63E30AB5EA6D289320965577B28E04CA35ED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998828, "uuid": "d7f9dbd5-82b4-47d6-b98c-8ba475b6f66f", "value": "3072:Y3AON3qD+722Fw2HOrwIEO9y5Q8bZyt6PzTgQPpyPAI:GT1HHH5x1ygvhQAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998828, "uuid": "f405d613-902b-4a3f-b7c4-4e321038bbf7", "value": 127948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998828, "uuid": "61b6e7a2-1633-4e5c-8bd6-9e24d124484d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998828, "uuid": "2a1dab00-0481-4980-a223-20b76982d598", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057996dc-919f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786024760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024760, "uuid": "229f824d-084b-4d5c-93d8-78978527a288", "comment": "Malware payload", "value": "7c3512e42ba320b8f4e686565f47ca9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024760, "uuid": "1bf86672-0bda-4697-9aec-cecc004a6872", "comment": "Malware payload", "value": "9a5ca1dfd973a3d9a3c742a8720758a645faf8705cd46ccceaa022649552623f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024760, "uuid": "b4de51a6-6fe7-4c07-8c45-e26cf05d09d8", "comment": "Malware payload", "value": "987be1d407090af49ccc349dc629027115b27341", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024760, "uuid": "73946ef2-0122-4fa8-a26a-008a43a17b5e", "comment": "Malware payload", "value": "760a5a27d22796e0aed964c47df3f4192d73d87fd8ec0ca64b1365e3d5eb4cb08e3108857b513537fac40392d8edbd50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024760, "uuid": "af947f26-0df1-4b29-883c-c809dd6e3cc2", "value": "T1667102CEE4A1763018DDCB62337A2A58F284A59319C23F2599CC38F25A4FE84344EF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024760, "uuid": "e7f949ee-f9b0-4950-9e7e-02587bc4fb6b", "value": "48:xUx7Ixux09VO123anuBeUKcdGUs8yjr2pu0XWqy+R/d/rdNdvd4dYdV:xCY3iuWoJijy4qnyWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024760, "uuid": "ed60834b-cd97-48de-b305-a3c17b9fb2ca", "value": 3779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024760, "uuid": "3cfffd0c-e42f-4a9e-ba69-cd4195e728ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024760, "uuid": "0cff7990-bd13-47bf-a18d-fbfff8402e25", "value": "9a5ca1dfd973a3d9a3c742a8720758a645faf8705cd46ccceaa022649552623f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757cf457-91ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786058448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058448, "uuid": "484d6ce0-d79f-432d-bc73-4038268dbae6", "comment": "Malware payload", "value": "f49c2c9aa9d52ba001569913a47a1f13", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058448, "uuid": "2af7d310-3588-42c0-a17a-2566fc196c2e", "comment": "Malware payload", "value": "9a89598b0696c5ecade5ff4af16042e57fb5c88c4fdbbef94d8c03230a9fb6f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058448, "uuid": "956f2bf2-adf3-40c9-a238-fea833f9c73b", "comment": "Malware payload", "value": "5e495b95b36062cdf188e5595f1b215a5fef69a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058448, "uuid": "1473d692-5b44-40a7-b06c-3b233924ba6f", "comment": "Malware payload", "value": "01796f7c04f37bc2c8f55de2502eb495bde421e79d1999266dcce1de73c100d619ec7115ae09a1cc60d59c9527930d98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058448, "uuid": "2c04501e-672d-4411-9599-8bf7f723f584", "value": "T1A9237D552A817C14AA99C4371D7E2F0CB9AD43E6320492EDBFCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058448, "uuid": "015dce52-3ac6-4c25-8a29-4c2f0380c2e9", "value": "768:tXOGVvO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:5Lzcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058448, "uuid": "1d05c9d0-c441-4ba7-8f5e-8770e77ad15b", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058448, "uuid": "5d9f88a9-93a7-45b5-9157-cf32a6502108", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058448, "uuid": "c55e5f9f-2f93-4840-b495-2d2894468a4e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3628e0a5-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005514, "uuid": "7b154d30-863c-4ab6-9ff0-ad2d1e667778", "comment": "Malware payload", "value": "ec1d7cb42ba5c485a0b92ee471875810", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005514, "uuid": "df414371-e3c3-49e1-8c37-4fb29b64a11f", "comment": "Malware payload", "value": "9aaa0bc5f89bd38042e4d10dd57e71d9dad2fbc1595ea023477f7ac273a2310f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005514, "uuid": "0e80124e-a902-4720-94e6-7259cdb7f733", "comment": "Malware payload", "value": "1486927049f94a9a4e8cfa9e41345022a7d5646b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005514, "uuid": "d1a74c10-62e1-45cb-bb84-a1f19eef9dc7", "comment": "Malware payload", "value": "ddf64fbd7250f9d4415a928f96631a38c33b444e92712995e8bde427480d22d5d2ed72658909509b076a53e4d69f1de5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005514, "uuid": "4edfea87-b9cf-4ecb-8c3a-845efd78786e", "value": "T1C735C3A6A3C7652BF7C1644AFD1AA00F9F7910BBFAE6112F7B4CE4C03431A425095DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005514, "uuid": "db97b208-fbc5-4c6d-a40d-9edda8d66f60", "value": "384:9JJpG9O1a+N9JJFa1SJhd9pJy11yV16OBhJCJFuJGBdJptJRuG1OJJmJpJpJpJtE:2ONYzlsR1XihxUw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005514, "uuid": "02685756-632d-4e22-a220-7b7533f0bb55", "value": 1100475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005514, "uuid": "dbb71f10-e78f-45f2-bdb7-1317054c84b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005514, "uuid": "bdbe04a6-013f-4520-bd6e-571a011254a0", "value": "SOLICITUD DE COTIZACION REQ. 1784.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10882ea7-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786005451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005451, "uuid": "caf95ef3-df6b-40fa-9ade-fa5d0a3a3c00", "comment": "Malware payload (XWorm)", "value": "1aee1256d7ceba70c62d93b7c2bf3fd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005451, "uuid": "cbcc848c-96fc-470d-b1fa-ca4e3b53f47f", "comment": "Malware payload (XWorm)", "value": "9b07add3577cc11ab7b2db5e506dd6b7780b5d51618472ff1de02d8066a68b79", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005451, "uuid": "c9e80899-df2a-4f8a-b386-0b5628b09931", "comment": "Malware payload (XWorm)", "value": "d1c862524079a5b407e8642ce08491e5a6a7237e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005451, "uuid": "d54f7dae-bc18-4919-ad9f-7eecb65bd916", "comment": "Malware payload (XWorm)", "value": "dab711c9c0dd14b66c432da97f1df91bbe85bdae4f5d7109254acdd44006c6fe3ef771bafc3dec7ecd06b463697e78b5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005451, "uuid": "1b9856fc-ad07-45b2-9566-359e3b569756", "value": "T11C252FAB42627432D3A12008FC9555B36F67064C9F59E10E7C2FE8F5B0561ACA1FADF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005451, "uuid": "2a0a3657-3291-423b-94ba-ba8f41445dbc", "value": "192:wXX4jAGHLkzX7pqNjMxBKHmpcHerRYpa+YwjKPFfU36:w+AGHYb7pqNjMxBYmpc+rRtdy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005451, "uuid": "b404abb3-a92a-487f-b7b2-5bae6eae4702", "value": 1007092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005451, "uuid": "c351a755-9b12-4080-b972-03f647b951ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005451, "uuid": "62aec39e-28f6-445f-918d-03cb1079234c", "value": "Fuente de poder HDR 1524.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0947264b-919f-11f1-bd95-42010a9c0009", "comment": "Malware payload (XorDDoS)", "timestamp": 1786024766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024766, "uuid": "4727333a-b94c-4c92-8bb2-63c508ffe766", "comment": "Malware payload (XorDDoS)", "value": "2a31bcfd1f8412c44ebd27700cbc40f9", "object_relation": "md5", "Tag": [ { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024766, "uuid": "5c6ce43f-476c-4223-850c-bb8f775f4bfa", "comment": "Malware payload (XorDDoS)", "value": "9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728", "object_relation": "sha256", "Tag": [ { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024766, "uuid": "ee599d07-9db8-4b22-9f32-fd4825fcd08a", "comment": "Malware payload (XorDDoS)", "value": "b187e9693549218a798a804a3cb3bf5a9f04c166", "object_relation": "sha1", "Tag": [ { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024766, "uuid": "5a14f2db-b6b8-44ea-9bc6-ed957692b496", "comment": "Malware payload (XorDDoS)", "value": "d0258410a12dc0171d6a659628a2f2e1384d19b9a2380155a7201cfca1e9dd04eeac0d2d6b8faf455478ae4190174428", "object_relation": "sha3-384", "Tag": [ { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024766, "uuid": "49cea84c-6348-4fa3-ba07-dbe7076cd506", "value": "T1D7C45C06F283A2F7D42705B0124BF7BF8620F63594129D9BB7989D5AB9338F12A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024766, "uuid": "7a74acbd-e942-4871-babe-bdc6be185540", "value": "12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXSLLp6yWrk3:VB2WCH/eMU9Uc8gd49N94BJXSLL4ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024766, "uuid": "3defcbb5-c743-46b1-b9bd-14a526b96d9d", "value": 555272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024766, "uuid": "bed7e881-d611-43a3-b6cf-1e1d9264d904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024766, "uuid": "9e8e8f88-ccdf-4567-b3db-9f555f561bd2", "value": "9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71960eb-919b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786023367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023367, "uuid": "dcbbaf4b-b33c-4f34-af76-cff3b489c866", "comment": "Malware payload", "value": "5a816cb12c7f1b69491ed0627cd6e1b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023367, "uuid": "8924d5f3-937e-49f2-b8e2-7db0c7263730", "comment": "Malware payload", "value": "9ba04ffdc5b2a57af2900d04f9c658bead3e9637e4226ea93c23e9d35e06e362", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023367, "uuid": "9890b503-34bd-4671-a47e-e15d460090a2", "comment": "Malware payload", "value": "58bae3cc6ab33cc2175a54edffb0bd5b1ee8a107", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023367, "uuid": "938871bc-d532-46c8-9268-f723ef4165a8", "comment": "Malware payload", "value": "6c0a560e7ce2b1f1929c473ec5910293801d40de4e0a9fa41e6da33c89f2dc278718eacdc947f35fbc97bfd39e963df3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023367, "uuid": "72965c17-b456-4a29-a824-097a8ee3571d", "value": "T1D047DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023367, "uuid": "f98293f5-9017-4cd0-ae7f-262c6d15532a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQY:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786023367, "uuid": "7fb9bb3a-56fe-4cf7-8d06-bc1a901b1d70", "value": 25067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786023367, "uuid": "37421c8d-e025-405e-934d-0a1c43de6f36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023367, "uuid": "eef01bb8-8ece-476a-81c9-d5960071ecf5", "value": "9ba04ffdc5b2a57af2900d04f9c658bead3e9637e4226ea93c23e9d35e06e362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a634a0e2-91c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786042639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042639, "uuid": "c5068e64-17cb-4558-900b-d82066348bfd", "comment": "Malware payload", "value": "5ed9b7cee2abe5c850c578d920bfc6c6", "object_relation": "md5", "Tag": [ { "name": "anit-forensics", "colour": "#1B1475", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042639, "uuid": "151d073e-3865-4dd9-8b16-f5755eb59b40", "comment": "Malware payload", "value": "9c5e17322f347d45cb986cbae838d5e2442a658649ca7a601b04a2951e7ed85d", "object_relation": "sha256", "Tag": [ { "name": "anit-forensics", "colour": "#1B1475", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042639, "uuid": "1c63b94b-b267-4b8a-bc07-d33215b05142", "comment": "Malware payload", "value": "545e29481b7eebe67aa0edf7276790357c3de8f7", "object_relation": "sha1", "Tag": [ { "name": "anit-forensics", "colour": "#1B1475", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042639, "uuid": "b9a32cfa-d28a-43a0-bc72-9cb41eb01596", "comment": "Malware payload", "value": "53835c41c461eb6e3565aa892dbe5aa9045168183744854d992b46d26559be49f62c216fcce9fb33b5160ca94d050e9b", "object_relation": "sha3-384", "Tag": [ { "name": "anit-forensics", "colour": "#1B1475", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042639, "uuid": "9d940f3a-d772-4190-b669-70012330bebe", "value": "T140F3123E4610A175F85206FFF4132E01BB590BD84EB4B06BD4AEA650F8FDF1819963B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042639, "uuid": "bd7bb652-54fb-401e-9803-06eda892c400", "value": "3072:FnEEn/SWR4zpO558xKkS5zHm3xOSXAmzWXWRSzpq5R8xK+S54627yVWM:FnHn/L2llB3/zrcRnb62y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786042639, "uuid": "66b6cc4c-f530-4e6b-ba96-034c71a94c96", "value": 172629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786042639, "uuid": "f136c81d-0b75-4648-b7e1-d83734b5f8ba", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042639, "uuid": "c2f786bd-7747-4534-9074-2e6791cfc8be", "value": "payload.bin.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74542416-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034395, "uuid": "88b65aa7-efa6-41ab-9127-3471c21958c7", "comment": "Malware payload (Mirai)", "value": "f6bb6cd60b188608ac1f563ab98a7e98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034395, "uuid": "8b8e09c1-13a9-4e06-9a87-abcb4a1434dd", "comment": "Malware payload (Mirai)", "value": "9c65254164709d57c329416517f0b68fc10a125bcd472421fb099acf158b9539", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034395, "uuid": "e9d3331c-2e60-4a30-9435-5fba71a1fba6", "comment": "Malware payload (Mirai)", "value": "ba195e6255acccbb3749632a6b90f6ccccc7bd1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034395, "uuid": "2598a102-81a2-4961-ae05-9a8c2272844b", "comment": "Malware payload (Mirai)", "value": "e5845258925f82bd706c47492f09807c57ff661e232db5571408071cf4856256886a02f91fce98eeeb51faf5ab22be17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034395, "uuid": "221b8d1e-8ee8-4ed0-8f2f-3cee1c253e2f", "value": "T166B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034395, "uuid": "8cb1b287-dcab-49c8-a4fb-4534e4b7d68a", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhQohHw0pJbLK:XFmzY5mXBypzjYYZ/5+J9lHLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034395, "uuid": "537c460b-8aa3-4767-8594-2a4e83cd9429", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034395, "uuid": "11f53372-5128-4b19-9bcc-e0624267ef4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034395, "uuid": "2ce84ac5-576d-4ae0-b1bc-735009af573a", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6ca6dd-919c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786023805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023805, "uuid": "fa56a46f-145c-4a6c-8869-f5f6b5aa674a", "comment": "Malware payload (Mirai)", "value": "67da8412e42eeed6c8ca39dfc95d3ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023805, "uuid": "63796c31-7fb1-4f31-89a7-8f1509256b61", "comment": "Malware payload (Mirai)", "value": "9ca4cd6ab1aa1f4eaf7c1b2b961d922dc360728ebc2e3f59c204da8f858ee4a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023805, "uuid": "1f84e5b0-1499-4dd7-b58e-51375ca2c66c", "comment": "Malware payload (Mirai)", "value": "9af84d12702274703e747b74d63b7f8ffdc8b644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786023805, "uuid": "91fd5f41-69cb-4f94-a472-f02cd8f0d356", "comment": "Malware payload (Mirai)", "value": "ed48f3164f93d8cb0b2f13be7025f780a30ff7a945c75c598cb2183eb151205942fb89e9d192cd94d25a52523ff19097", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023805, "uuid": "8444c73a-d742-4d80-851f-84c9d605ff0b", "value": "T1B1A48E45B54F7D12D3D6E2FCEE0DCAA1B20779B8C1A3A0B27E42434CC1669E1CAF5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023805, "uuid": "927af2b3-5454-40c8-b320-8232f6449b0a", "value": "6144:DE+Zug7iovaW+Sa+J0FQDsPcQgYfvKyA70pS+eJGIRam+ASdS6:RLZrWQgPcmvPlcwmR+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786023805, "uuid": "f6ca15c9-4d69-4a35-b512-45e6dec16551", "value": 480432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786023805, "uuid": "22199e3e-c68f-4738-aa11-07474fbe0a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786023805, "uuid": "4e674dba-7ac5-4807-803b-c4bfbd0b3740", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b72ceb2-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026085, "uuid": "ad9d5b00-a6b2-4a29-820c-af38464f21b8", "comment": "Malware payload (RemcosRAT)", "value": "3b0b7165cf108cc61ac8dbb4143b0cc9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026085, "uuid": "b1497bf9-7e0a-49e3-a616-62b4ef250b2a", "comment": "Malware payload (RemcosRAT)", "value": "9d04cf6270ffd3503268068f18ba8fa4aa3b13c3362ed768de05d924760db774", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026085, "uuid": "a1f7f876-7c99-4661-8193-32af4dba260a", "comment": "Malware payload (RemcosRAT)", "value": "288d6d688ee3bb75b6792c16b00f2782bab0ffc7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026085, "uuid": "21d9c0cb-8e76-4369-975f-bc0821d7c164", "comment": "Malware payload (RemcosRAT)", "value": "390fd0b806a6ad9fd6b0816e379e59d7b668944626a4c2a3315d015aa6ed7be8f149460d6e2d69974bcd713c0c3638f6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026085, "uuid": "fdd1ee70-cec5-4f02-a1c9-1843404b6aa4", "value": "T1A8151202FE80443BC99257380F93A6D1960DBC5B6D6B4A4E2B45337EBD3B6F4D8A2D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026085, "uuid": "2556f195-b117-4a1b-a674-11821cf5da87", "value": "24576:qKNt1QRT/64rmMu1UiVNEuH0OmA4F1xvaS:qKNtmB6Ou19vEuVd4D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026085, "uuid": "027ad485-2563-4ca6-8f4e-0cfde7d6afee", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026085, "uuid": "b0dfa004-0bd6-4528-9064-6891fdc5be83", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026085, "uuid": "aac351c0-3172-471b-8075-222f7621347d", "value": "Document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7268a78c-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034391, "uuid": "bbd4ba98-309b-4a37-b6c8-e3ee6ae66d3e", "comment": "Malware payload (Mirai)", "value": "51663834a20b23e392c5aef3a671db46", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034391, "uuid": "272b5dcf-d414-445d-9cad-4f0a4a1998ea", "comment": "Malware payload (Mirai)", "value": "9d2565c23c294282ca51cfa67b018d653e72b84bb130bf32dc68e03191a44f92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034391, "uuid": "006d5429-7c86-44ae-b01f-52c6ffc5dd9a", "comment": "Malware payload (Mirai)", "value": "4c8f304c1ccb104bbcce3f14f81ebf4d5128ae57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034391, "uuid": "cf0fdde6-1aa4-4d6a-b194-84195283f52d", "comment": "Malware payload (Mirai)", "value": "5bafe966e93bf8c8239d9ba57bd051c4dace9d3c55cbbc8ce88832262ed4e057421a2011d4a430b1a58b59f8ab50e991", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034391, "uuid": "ebde0591-03b0-4654-a3ec-e9d2e4a76b37", "value": "T18EE34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034391, "uuid": "f1514b1e-b7cf-47e6-9c72-02f3ec83afce", "value": "3072:CotWnBLigk1Tc3ECC0DvZe1k6aU6zL6EiueCo2kB:VWnligqTcUCCqeS6axIueckB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034391, "uuid": "c5b59961-89c3-4235-bcbc-567f8107977f", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034391, "uuid": "c6aec5c1-3bf6-477e-9fb5-64b0685fc84e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034391, "uuid": "55c34e35-6016-4c5f-b3d8-bf2fc142edc1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54288b74-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048944, "uuid": "a7d72657-1e59-4d18-8249-77478211a88f", "comment": "Malware payload (Mirai)", "value": "02a228149552678e5dc73bcb7f9abd60", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048944, "uuid": "0bdde1fb-78a8-4fa8-a3a4-6258826561d9", "comment": "Malware payload (Mirai)", "value": "9e0513e9ed78932b7351ff77d785def4d90fccf6cbc6ed4a840a7c7ee9fe2ac1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048944, "uuid": "b11608ad-8659-46fc-bbff-bd163130ec93", "comment": "Malware payload (Mirai)", "value": "4903fafe6e6fec6a132b3e82a40734817d9a5bea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048944, "uuid": "6e6d53b0-11fa-4c4d-aae1-4ac02ca76e25", "comment": "Malware payload (Mirai)", "value": "a18e43149eae0ff30a110e70fa6f339bebba7ab6ca30b8462793cbc19067599c32af6bbb98d7af728082abed2f4c3088", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048944, "uuid": "9d3e881c-bd4e-47c0-8590-d0ab7c698ab6", "value": "T177147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048944, "uuid": "4b55980f-05b3-4d8b-a400-799345997194", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRdUKG:IcY5JpMByVs9jS4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048944, "uuid": "20a1b1e3-cad6-4bea-8f82-cc69caa763a7", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048944, "uuid": "60106ab6-f1b0-41f3-83ed-a96397a6aaf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048944, "uuid": "73a8af76-e476-4bd8-9881-184aff42ab03", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c260c7-9152-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785991820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991820, "uuid": "d9e738bc-a8f1-4097-87c4-94ca9f7bf182", "comment": "Malware payload (Formbook)", "value": "48122023782c245c2b14b295a442150d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991820, "uuid": "43b658c1-5fd6-4641-b5a1-07840fd64f27", "comment": "Malware payload (Formbook)", "value": "9e4635b5b43a8a5ea8168ba501a0f6b4b0ac5a101961c5f32a3df9f9413bce73", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991820, "uuid": "584c5f7f-36e1-4ef7-9383-e5a7020370ba", "comment": "Malware payload (Formbook)", "value": "8be26a8162b691063726bea68c380c597bf8c3e5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991820, "uuid": "cf4446ad-afb8-4346-8f5f-8cb123d60c80", "comment": "Malware payload (Formbook)", "value": "22e5c8f44e211d58998eac5efc2372076dc20150f4d4b9c213dcd40c82b25868ee0673f263233ef94992200d93dd64d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991820, "uuid": "0da97eb4-4c13-4243-9bb7-2607cdc479d1", "value": "T10B250BDBB371035C184872CECABC6EDD2864FE92D110E66AFDB83747D60C659A290F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991820, "uuid": "f05180d1-aea9-49c1-96d8-73ed665f2ae7", "value": "1536:kPYaCwAQYb9kDqopaz6Qaf3OTclxL/sJtSZUD8OHwNifTF4/zrVpXCX2vJjOlta0:kPkeDqAUDTYiizXXCGtvXq1mrNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785991820, "uuid": "dfb50670-1f9e-4864-8dc5-ab14ab741ae5", "value": 1048079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785991820, "uuid": "06de2ce1-11ed-4d2f-9bdf-44b61d6abc57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991820, "uuid": "b36abf12-c1e9-4682-a42f-8ceac7223596", "value": "VESSEL_STOWAGE_PLAN VSL_PARTICULARS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa01f655-9132-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978221, "uuid": "b0462462-b36e-4dfd-a81c-ce431be6db4a", "comment": "Malware payload (Mirai)", "value": "1db82515c31b29890a53c9bb67cf92eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978221, "uuid": "289a5797-4a7e-407d-b61a-54c6d1f8ca38", "comment": "Malware payload (Mirai)", "value": "9e7ca69553ed9649a52a8a4e35e6df16b37a17b32d9fcc96c9b22473b37ca48c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978221, "uuid": "4419e842-57c1-4041-80eb-e53352ab357e", "comment": "Malware payload (Mirai)", "value": "73083b451f41de9b11bf7cb1c90c94f1f9574e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978221, "uuid": "e251fbd7-9af8-4cc3-9a3d-c7d6e01ea8d1", "comment": "Malware payload (Mirai)", "value": "99a82bfb230e4101fe57c99d75aaa2a24929502bb2f01fcf533195aed168b112f3c118b43fe39be4dbac5fe4c9c1115e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978221, "uuid": "96ed2cc5-a2a7-4965-be66-37d5cbd9c36d", "value": "T1E0F2E161DA8DE52086735C3D6DAE00C1AD3BAA3EB9E070F2B044D664B7001479AB4BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978221, "uuid": "cb0e5448-f0d6-4025-8927-beab1555cd8d", "value": "768:SEUMB4BGxOrwZ+VD//EWxbObFbbb30nbq13drVBosidFy/3Gs3Uozw:SEUMB4M0cZvQSd0bq133ayfrzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978221, "uuid": "cdee7415-45a3-4734-a33d-c563e541c785", "value": 35228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978221, "uuid": "f0b9f120-50ad-4af0-bd16-b5bf1e84ff10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978221, "uuid": "7f6dc5a0-e5a9-4c9f-be9c-3a2355490bf9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aa57f5-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786005225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005225, "uuid": "21f9c973-ff91-412e-8c90-8a3ef51f956a", "comment": "Malware payload (LxBaseRAT)", "value": "7a3996eba75ce9f012592fccd6138c48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005225, "uuid": "ef63e8da-73f2-4758-b715-2312add41fdf", "comment": "Malware payload (LxBaseRAT)", "value": "9f3a86b405215f41fbead814db46b71b70fdc6d3be85d8e0a963914642335f31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005225, "uuid": "8c8ed9dc-fa08-447e-94c2-c6a7dd4a154c", "comment": "Malware payload (LxBaseRAT)", "value": "274198c2e26ad353950ee7d8255170b9f435821c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005225, "uuid": "423d7782-97ee-4b72-8fda-24adee7b9206", "comment": "Malware payload (LxBaseRAT)", "value": "e016d080870d66e2793bf6afbb379cfe565beb2d38de6bd352a9fd10f7def7bfd838baf0a27c41ae7c17350f5972cf5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005225, "uuid": "b2ac7ec4-7664-4505-a2cd-5f074db546b6", "value": "T123055C1341998D2C0AD9F1E11D2784C933DF65F2A0E98AC0129EC733B69A97ADDFB171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005225, "uuid": "5a6c328b-694f-49a7-8007-515ae33e2751", "value": "24576:m+Cv6yC/nEgYIs4kS5NYYxAEyjMcH2uTxikx/4svsXBmNrnhAc:d+6t/nDVb5xyjMckkx/cXBUrnhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005225, "uuid": "5688c582-5efd-45fc-b758-21caff823b4a", "value": 826040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005225, "uuid": "9c898992-2c72-46ae-a8c6-4df72452dfd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005225, "uuid": "8005cf14-0003-422f-818b-b876539e3166", "value": "\u0110\u1eb6T H\u00c0NG _GI\u00c1 M\u1edaI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221c60f5-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "6d8087ab-ae63-4701-a0f7-5495c2c805bc", "comment": "Malware payload (Mirai)", "value": "7df50caab0dca9b69b230a9e95cd08e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "d14dd6db-172e-4d99-820b-38f0c6797186", "comment": "Malware payload (Mirai)", "value": "9f5372d58342c98892588edb4c05af2e7d237f79448d51bef2412fed77f0c495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "e7bdc33c-579f-459e-9a0a-781605265b17", "comment": "Malware payload (Mirai)", "value": "80f1fc2a1142a40a4ccb717d2f6c14d5f796d657", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050578, "uuid": "233b7e50-295c-4b62-94f1-e2ee5c6e9f99", "comment": "Malware payload (Mirai)", "value": "8ebf01187baa9cedd29f75da7cbfbd9d18b7cb33ac0cabbb61b49cd0ed4215a7382726f2f7f1b7183731e8fc97476f48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "fa986235-3c7e-4b4d-b3d3-b2fe86a72386", "value": "T1F414E846BD518F23C6C311FAFB9F429C37266BA8D6EB3102DD157FA437864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "b4c6b7c9-e3f6-41c9-9a5e-845177010006", "value": "3072:kJ3PN65WmjekuyLAo8hgVbquQiTGFV3b5ZMLfKlv3ftKYjI7nG6gk0L:Wc5rGysjGuu5TCV3b5OLWfftKYjXk0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050578, "uuid": "e6704496-f71c-4ae0-9cd2-5cca53182ada", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050578, "uuid": "81f8dd5b-0368-48e4-af2d-c92df422fb97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050578, "uuid": "7359dcc3-d558-4fba-b197-aa8f4afaeef9", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b7229a-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978661, "uuid": "29638aee-e674-4e47-a77a-bab39f9fe046", "comment": "Malware payload (Mirai)", "value": "7ab30d127b5e17f257b9035e87d6124c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978661, "uuid": "ed0afcb8-aa6b-4b69-a500-4490f7ae0b8b", "comment": "Malware payload (Mirai)", "value": "9f53c9c4daf662aca794c22b08cedfed2634acc40f5d6b9c89728462c63be3af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978661, "uuid": "287dca0f-8ae5-4544-8760-735d46db9771", "comment": "Malware payload (Mirai)", "value": "86b83a419ae8e5d82d146a140a2752e1f7c1ff28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978661, "uuid": "b568e3e6-e64b-421a-8033-411608e52292", "comment": "Malware payload (Mirai)", "value": "3cddd58e406924c6be9502adddefb2d2828c0bdfaadf9e7c347482a4e72ee21a316c038b88f12e73b7afeb8acf3cdf6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978661, "uuid": "777ce9fd-936c-407b-b414-49e2d6034fa0", "value": "T12AC329A9F890DE52C6C52676FB5E028C33231778D3DE7105CE109E34F7EB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978661, "uuid": "5157d92b-ef49-4504-b5b3-3ee249d46eef", "value": "3072:GMS8HWIzZvDVsINudJj+3scYEEU3cRE4fOAvLSKykdGER6U1yGk1Af1Dl:GLMnlUQscYEEU3cRE4GsLLVdGM1l4A95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978661, "uuid": "6fd9e69e-181e-40ad-bf31-e032dbf72c97", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978661, "uuid": "a2bafa74-49d8-4161-9a37-59fd551080cf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978661, "uuid": "d64d00b6-ebc6-4414-ac8e-92fe1f748c09", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0f98e-9160-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785997774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997774, "uuid": "368581c3-f6bb-49a1-9e2c-1dcc31e05a0a", "comment": "Malware payload (Mirai)", "value": "618adc0822c3235412e7eab396e55ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997774, "uuid": "8fda8060-0e46-4319-9d0f-9d5c407990e4", "comment": "Malware payload (Mirai)", "value": "a1298a905c1315d95db765f879e9942926189938bbbdc109494198da299429ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997774, "uuid": "e74d6257-fbe9-4ff7-912d-2a67f56fd93c", "comment": "Malware payload (Mirai)", "value": "1aac3b0f4ddd832129862e1c80f9fd23d5d376de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997774, "uuid": "debaf827-07f9-4863-a023-100b80e3e0c1", "comment": "Malware payload (Mirai)", "value": "88ffd5c136a7477c2bff7c99a0f398aa308c5949da4eeaf0ceb33a4de6466e64e9952a6cdd3b9611a635502b96674841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997774, "uuid": "d0be5792-914a-4676-8b6c-9763e4b075df", "value": "T12A043B4F7710CF61D728D9300AB38B5666E5266226D28949F32CDE08BE74349B82FFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997774, "uuid": "8df8c700-abaf-4b9d-b15f-e09f73a32a13", "value": "3072:VDdA7Jc/6UZ+CZ1tkTblBfaFG4DDkOrn1DzjE:NDDZdTaO0e4Or1TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785997774, "uuid": "f57021b4-61cf-4824-b6ca-cc165d89c421", "value": 182500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785997774, "uuid": "a7f108d4-dcb3-4641-a9ab-5f95492ae7ea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997774, "uuid": "5d5e8f13-c6ee-48dd-a13d-c2aec25896f9", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f7b8b3-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SyncroRMM)", "timestamp": 1786049084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "0ff445ea-7359-4a82-be5e-75075527facb", "comment": "Malware payload (SyncroRMM)", "value": "b2daee69272ac088ba3af90e630a7b73", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "5e433f20-83df-466f-a1db-fcf51c6f6c25", "comment": "Malware payload (SyncroRMM)", "value": "a1b471e7cb4cabe80828dfb0b96cc6f5f87bf867969c66bc8511715ecd70459e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "2559b3de-eee7-4799-bc04-f234f6e24b20", "comment": "Malware payload (SyncroRMM)", "value": "6682841224071055bf109254dfc7a65d46ffbb9e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "b28fa847-9e06-461c-bb4c-5731482a21ba", "comment": "Malware payload (SyncroRMM)", "value": "ca4d929f8820c86e0d06b3fc034dab39a1a3ad0367f58e748eb331ac9a182ff79d46c3abad8e142e3e6bfb0252d59e42", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "c2a138fc-5384-4027-96f7-92b120dbbae7", "value": "T1B1461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "c757a91c-9e43-452d-956e-ad91b6ec8e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "030703cf-a146-4be2-8e7d-62000da08a1a", "value": "98304:gh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OI1:gh/ev5eTeW90kSIbDoUcfOhzT9cEt72S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049084, "uuid": "c84bba72-8673-4014-a78a-fb7ad41a4890", "value": 5858848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049084, "uuid": "8afb7378-b5b6-4d33-902f-ec022f6add37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "881b18fe-a5ca-4f77-a69a-b0f731fa90b8", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d96ad88-9166-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786000480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000480, "uuid": "5b567510-57c8-41b5-a8f2-2afda1e3328c", "comment": "Malware payload (Mirai)", "value": "b6ea03ffc56bc0fd22d914a7bf87ec9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000480, "uuid": "7c5d0ec5-cd03-495c-8d96-781491d1d1ff", "comment": "Malware payload (Mirai)", "value": "a32a5e90b2a75078d249b54843527a804b23d33a6c55c5a83435817a151bd58b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000480, "uuid": "0e28cde4-bca6-4002-92d2-4c5b1cc492f4", "comment": "Malware payload (Mirai)", "value": "0b451082cac417024181cd156fb83e5235e63b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000480, "uuid": "ddda6c31-3c82-4a90-95b4-c6afebc7b5b8", "comment": "Malware payload (Mirai)", "value": "9b37d966c558774c2446008a6e32dac94db022188d5ea327bcf57c515a06ffe5f796ff8fd0ce7c37371498374b9d1441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000480, "uuid": "2a985dcc-0954-48a2-b185-0a7b20c0409a", "value": "T1A8845B92F2A228FDD952C930835D6522F63874494311AAFB27C8DB753E16ED06F3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000480, "uuid": "340964a2-b681-4cc7-bea5-33ea34f0259b", "value": "6144:QMVIw3+NDSLUdloHjB/NYgZYFBYmddTQQmTQ9Nd8LOosPci5TECuGPBKB:QO5+1bMN1Ygq/h7mycLOosNtZJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786000480, "uuid": "112bf2a3-9ead-4d03-9cee-10028881bad7", "value": 395168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786000480, "uuid": "04840106-1321-40ce-bfc8-ac4c37a1dbe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000480, "uuid": "c57f17ea-1389-4430-bd48-0da87ac016ac", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccf8f19-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786026893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026893, "uuid": "236da3b7-ff04-457c-af68-e74d77f24acd", "comment": "Malware payload (AgentTesla)", "value": "fa1fbc97e4a691b9ec18a849b7823199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026893, "uuid": "53ed1fcc-06a3-4894-b74b-52a1ed630d80", "comment": "Malware payload (AgentTesla)", "value": "a350ab3e8b5c27a43323b0c05bcf9a216d3702778a44763e50303bf5b5bcb26b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026893, "uuid": "99f520fa-f47b-4615-a51a-3b893143611c", "comment": "Malware payload (AgentTesla)", "value": "3e8eaa0136306314dd9817bc142398ee8ed5caee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026893, "uuid": "1c38935a-b6dd-4bb3-8073-bcacc29ab4f3", "comment": "Malware payload (AgentTesla)", "value": "105ad458c9b7c2c2f8ca733514d9673f4a01548d018541eeb87068fae5242a1bce3970625bebc787ff5d0101bcbeba01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026893, "uuid": "282122e9-a30d-4b89-b1b7-6cc77586c708", "value": "T163D5E781678485737721ABAC523ADE319E0EB00368C6EF45312DE708366DD5FA35CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026893, "uuid": "90526b44-ea7c-449d-a138-7334be33b379", "value": "49152:DgZiXxViMqayyiAM6PdAem/MhX5oIrx84nUiIkwWzioeH8bhPlKttLzn4M6XJ:DkiXSUyyiAM6PdAebhXmIrxfUmwWziof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026893, "uuid": "bef7df89-bbd4-45d3-9994-373bf0dd7e90", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026893, "uuid": "dfb7c6db-810c-4eb9-a116-d51452a6e126", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026893, "uuid": "b1efddfd-b0e4-42d4-8443-fbde8d7961fa", "value": "Detalles de los recibos de pago.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f25672-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "1d8c0c7a-643b-434b-97b2-bb89584d7cac", "comment": "Malware payload (Mirai)", "value": "ead803e7bbf1e67b9eaf53a4e91613f6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "1c505dc8-4f27-4c5b-ac7a-db53c0bd66e8", "comment": "Malware payload (Mirai)", "value": "a3b4052307fb2f2a66477e8640bc0937e3f5c86240b9866559eb52d1a6876f24", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "a0b9e270-a30f-43e0-8722-6f945d36953d", "comment": "Malware payload (Mirai)", "value": "98332c85f48df784d630216e4da88bb624ed0a9f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "eb29200f-3025-4863-95d5-ce9d3662073d", "comment": "Malware payload (Mirai)", "value": "c88edc8c82326b072774e059ddd44327bafa4784207096eade9ad3e354654f73dd7f7a7557f90f7c3a5b01bf4f8d9d04", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "cdd0af0e-31cc-4f08-98fb-cc78afec51b9", "value": "T19774F8113B47EC7FFD6A03744AF78E7477D865A225A1858AE26ABF4D0F250D10E0CAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "4ab809ac-9258-42a9-8d41-af385c81bf45", "value": "3072:L9QX4IfoljD6IhEu3tXk48h7CJDVPRTfdX5zF/Bn0/P/BM4on8dDDbIR/PVpyHyg:ZioljD6IhXXAm7IHBsoOVp8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050584, "uuid": "42ccff12-509e-4342-9142-d0caabcf58bb", "value": 342296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050584, "uuid": "c6843f12-be25-42e4-a4bf-d32fbaf6c07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "7ef6aa63-ff00-48b7-aa89-fac5e4b99223", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f2df00-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996061, "uuid": "db38e6e6-db50-4cf4-a4ba-eade2116033a", "comment": "Malware payload (Mirai)", "value": "7b32f5ff3e1769ff825f739a0d4c08b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996061, "uuid": "91fcbcd1-161a-4bfe-823f-74c95d9813cb", "comment": "Malware payload (Mirai)", "value": "a40094d0a0fcc6fad49a4fbf585327946a9870f4b285b6e1067e2aef5c9d8dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996061, "uuid": "595d155b-4256-4e15-ad65-54c098612141", "comment": "Malware payload (Mirai)", "value": "f51b59cd0bd7f2ec3f2ef1afacbf87f3e4690f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996061, "uuid": "d52b9a51-8a93-4c53-8791-5bcda3d8dc00", "comment": "Malware payload (Mirai)", "value": "535bb4a1208222d688d1ae7e1b9981d66b074fe4590d524143ea171bf0cbd8136893987fa3db03d2bb4df549dda971e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996061, "uuid": "ede58cd9-467c-433a-9aa5-0a90779b1b78", "value": "T1CEE30856F880DF62C6D12A7ABA4D428D33231778D3E97102CD249F3577EF95A0B3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996061, "uuid": "cd927362-1d6c-4313-987b-b29f4442afc7", "value": "3072:l+DT8GQXFjkaTFOfZIUuM1KNlrD9xQG0VojD201jCwESOINti:l+YFwaTFOfZduVrD9x0VojD201v3ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996061, "uuid": "6d2ccd2a-8596-4597-bae0-e8bebf411d1c", "value": 149048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996061, "uuid": "250f1519-8f75-4ec9-b5dd-d39bee579f2a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996061, "uuid": "e7f7e2c1-dd3b-42a8-9358-810829403fc6", "value": "disconnectraw.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51703a00-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "1f19b0f3-73a3-4c29-8c8b-798d4bdf0e28", "comment": "Malware payload (Mirai)", "value": "ae57c65cb81213c0f89c2f26c7466582", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "7d03072d-ac07-4894-8ea9-5a06747ccc68", "comment": "Malware payload (Mirai)", "value": "a428aa8e45ffcdaa9f14f823d9ab1010b563f5e03e7ca0a04fe2d59e2811d332", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "b095cdf9-6396-41e0-9654-7a5223bd5dcb", "comment": "Malware payload (Mirai)", "value": "d8c5b68bd53811c5dbcecf1117a1ffff4ac600eb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048939, "uuid": "020bbe26-cda0-4bd9-a916-0501ec00b4b8", "comment": "Malware payload (Mirai)", "value": "2c886a379cf1df26819b79700808ef2766af37535b4fb5e9b22ca8de7c10e332130661ba393acb2aed2093e9c4a9c260", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "d13ed5f9-8dd5-4114-a508-c09ae725f0b8", "value": "T1CA04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "71436f2a-7e79-45c1-ba71-4fe1263607e6", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wlUXS:7eJpJUVD1A8n0YNgEJi5ami", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048939, "uuid": "163a3c10-73bc-4169-9af9-a93760cfcd28", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048939, "uuid": "e21b03e1-b234-46e0-8ca1-12aba6907563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048939, "uuid": "22f3d2fb-c179-4648-ab3a-d378e53b5246", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f20f63-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786049562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049562, "uuid": "78575fa9-3a5b-4c4a-8dce-d5b52463b4f9", "comment": "Malware payload", "value": "e5c4a6f40f5bbd19f090c1f95626687a", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049562, "uuid": "c30b6856-14b1-480a-94a3-f6cbd9a1be19", "comment": "Malware payload", "value": "a43abf1be5dd450dd88370d503721ea3d1b228d06a3ad4957f57a08a73cad669", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049562, "uuid": "d34fc6c0-65c3-415b-88da-25534b93393f", "comment": "Malware payload", "value": "84d492bc761bace055e847f34a410f57cd90f53f", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049562, "uuid": "dfcf0383-ac0a-4936-bb39-aab172ffcd15", "comment": "Malware payload", "value": "3dd0b38707bd7fd42b80a94e9e4a883098ffc6c8228955001d712e56b9ee52f6182f5a063b200420e80c4d6d6c895f9b", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049562, "uuid": "37bec081-c6b5-4732-b83a-6ede0d7e2ad7", "value": "T18C46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049562, "uuid": "63f41e0d-b4bb-4d2c-a395-c27bbf1f26fb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049562, "uuid": "6db18026-262e-418e-a634-fef24c1addb9", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049562, "uuid": "f23bc500-cb38-41ec-b606-b73d543a9c71", "value": 5641584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049562, "uuid": "9a244741-784e-4114-878b-7756217cc256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049562, "uuid": "b760f441-a3f6-44f2-bb5f-49c9e8b42ad1", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f111f1-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786049084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "14db88a8-a376-4acf-b608-c308dcdd999c", "comment": "Malware payload", "value": "62970f47c59799c603c5909e8ce1b657", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "125ae44e-c0fc-4d9a-afff-2a371629a3f4", "comment": "Malware payload", "value": "a4a71972d8ce03e9555bb0101747b5e5dfeae4023e59f6bd99dcc606cbbf66d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "ea8271e5-d084-4ba2-af2d-da6084064032", "comment": "Malware payload", "value": "a2a8c194c249d8d6c6a750e0080d555824ea6399", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049084, "uuid": "48d77633-12ff-41a1-ba8e-89f6ab04e495", "comment": "Malware payload", "value": "932f97af25faf6e0613b7c8f617abc89cd943efc7fc37b8ac1dc7a1109a5b48ce3d5430cbdb451e6622d64e26894ee3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "2155339e-8c30-4da4-ab50-81bff9ef53eb", "value": "T170235C62F98376B03F5142789F91A5667F5BDC3B4E682B41F0866D1CA1346BCB0B24D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "02924ca0-b8e7-4ea1-aa64-8d32f1b5ebed", "value": "768:i99DHuydzUKO8EorVMuMN0NBF7SsA6cYtNGTiPax+dFVcglW:4DHuYUKV9x7aahW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049084, "uuid": "9a947b1c-5891-4042-8e6b-141c61364315", "value": 48472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049084, "uuid": "c74f5134-fb91-4066-8cb5-73e3bdf56e6b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049084, "uuid": "18f338f6-6d31-4bb7-b234-94c6a550d229", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71653f90-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "ddf8f4cb-dd01-4a54-b5f1-c44cfbaf2fe8", "comment": "Malware payload (Mirai)", "value": "508291ffa95ed1b83698bda32b17678a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "94892981-5d13-4d28-bfc2-91c1e01acfa1", "comment": "Malware payload (Mirai)", "value": "a4f3da9e28b795649434c2e2d0a44fb76c8bd48781b01ff3f058eb394d1f2637", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "f5195245-61f0-4888-b72e-c93d5e781b91", "comment": "Malware payload (Mirai)", "value": "3385b932bf9c2ca5b95eb3ef20fd9ae905462fd1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034390, "uuid": "0ee6c2ca-df7b-4205-bafd-f236470e11f8", "comment": "Malware payload (Mirai)", "value": "18215bfc801cd59853bc9d853aebdd00efbba8bf94befb04227826a494f06d6d51d7af5f75996a3785e196ff274bfaa1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "15103aab-d585-4681-ba73-95089d3bb05f", "value": "T145D33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "b5ca118f-0048-4145-b0d7-1f6aa671ee50", "value": "3072:JuVeGJFWOgt9ctajH1I7sg41o+YLyXzXgvn:JuVwt9cUH1I7sgMeLmLgvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034390, "uuid": "d658b4d0-8fbd-4c7a-b189-e1b50cd56903", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034390, "uuid": "ec0be482-e055-4dd4-8a70-a969014679fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034390, "uuid": "f6308eb6-43a6-4055-95b0-2707a97156ba", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94616dbb-9130-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785977325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977325, "uuid": "0d16c419-0d97-4736-9d02-1fb3a7880bec", "comment": "Malware payload (Mirai)", "value": "41d64fe83d22e3fc6499130384964b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977325, "uuid": "8bf1358c-8883-4185-9fb6-445931df2239", "comment": "Malware payload (Mirai)", "value": "a524ccbc295bf3ac6c30a10b75007e8799487a5367e6a6542037c2e6dc1bd749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977325, "uuid": "d8148534-276a-4d9e-ad6d-84232bc83707", "comment": "Malware payload (Mirai)", "value": "9899ed6986f534df56134067c253839261eff3b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977325, "uuid": "c6038db7-b35f-4118-b575-4f286224acd3", "comment": "Malware payload (Mirai)", "value": "e55409477aeda476a694ed664ee44d409a6a23ed21f982e4b151f1d1678dbe0b24405b150179d4c61ba49caac66ffe54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977325, "uuid": "93359405-7b00-40e8-b93d-85534d765d43", "value": "T1AEC34A0675A144FCC156C074C73FE937EA31B85D12353ABF6B84BA31AE22E355B0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977325, "uuid": "1723f6f5-954d-4840-81a6-e94ab138d3bd", "value": "1536:jkajesnuoaftVIkeDsGPb9a4xDrMd7yzi/eSqCucY/pfmqbzr6QG4Hor4TRm:XjWtVIkLGjtli3eFnfm4r6QG4w4Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977325, "uuid": "aad4fd9f-c627-4c31-b813-56305a72377f", "value": 124792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977325, "uuid": "e5ee6f29-0b2e-49c3-85b0-3e566cc7a864", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977325, "uuid": "2146b6de-b0e7-4bb6-b369-4682fc25bc41", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be740cf-9136-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979834, "uuid": "f4d4da4b-16ac-43b1-b25e-ad16d5129386", "comment": "Malware payload (Mirai)", "value": "46cce029960fb7272176960e3d560e6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979834, "uuid": "1fbd65f1-88c3-4d91-9391-14e8630ac894", "comment": "Malware payload (Mirai)", "value": "a56ec538bb6c72b724cce88be69161b418fdc0f6ee41413400a388568daf154f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979834, "uuid": "f77b955b-05bb-4578-9cd0-64a83d52d7c0", "comment": "Malware payload (Mirai)", "value": "8d9a2f0cbac4cb47c80e1e47cc0d540cfa145ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979834, "uuid": "a2a8e10f-e49d-408a-838d-74da174d24b7", "comment": "Malware payload (Mirai)", "value": "792d25944b21ee5708604ef601631eda9c06b93a7acdcb894b130d7ebf855ac407693cfdd9172868be6eb4ae5298225a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979834, "uuid": "ccc809f5-3180-4fbe-8391-d79bc00a169e", "value": "T165C36CC1B10C7E9DE5932E7CC20A17176E1C9A559C83520190B5FE47E9BB2E32E36AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979834, "uuid": "6142abb0-6bfc-4d73-a550-518fb1c7ca1f", "value": "3072:J2NK4Vl0SLPfdtcfafKlPtuLi0kvnOX+QLLjcow:UNKkjfoEKlPyyvng+QXFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979834, "uuid": "e9f9263c-735c-4ac1-af3b-5701e3aa753d", "value": 125296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979834, "uuid": "cdad56e0-0c3d-4f74-ae2a-7a013c974c2d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979834, "uuid": "15822082-da17-4240-bafd-180a644378c3", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f37a2d0-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040668, "uuid": "de0fcd77-c643-4a2a-99ad-fe2d1fe9a266", "comment": "Malware payload", "value": "1e52d2f068305b7fe49588bc509da359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "rogue-server", "colour": "#1DF917", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040668, "uuid": "81241b04-a6c6-4746-961f-3fae76d0a4b5", "comment": "Malware payload", "value": "a57edcd75708383acc728a3925c032c3480f496f6a86a7e9a15e64ae07a05ea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "rogue-server", "colour": "#1DF917", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040668, "uuid": "644abced-c6be-4641-b8bc-4b6f1c501698", "comment": "Malware payload", "value": "e91202996ed53a9674a5e0af4c372363eb934654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "rogue-server", "colour": "#1DF917", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040668, "uuid": "1f2efa9b-dd61-442d-88d9-67770497864e", "comment": "Malware payload", "value": "500629625b4127942a34a89584b278071a8647943f13724f6a64f16359396efa1769e0c65aa8705956827365f7e55db6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "rogue-server", "colour": "#1DF917", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040668, "uuid": "a4d0e3d1-fb05-4822-9bab-2684466d118f", "value": "T14513732FBAA18C6FC4202C3CE8BF0630DEF075BD5D555E97960C24E9BB4E18827496E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040668, "uuid": "a2057178-2637-4a7d-8f68-dff2185a153a", "value": "384:3AY5iD3dMaMJ9hzmlzRfWcmkNAjOzYdqAXMqpK43VgFgNL2C1:3APDyJ75g43Agp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040668, "uuid": "0386b543-608b-42d5-a06e-191c7e435d13", "value": 43986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040668, "uuid": "aa775aa9-9574-4341-9878-cb7df1c1733b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040668, "uuid": "618f7648-1ebc-4440-85e0-fb71528680ed", "value": "a57edcd75708383acc728a3925c032c3480f496f6a86a7e9a15e64ae07a05ea9_from_13.52.56.206_redis_slave.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ac65dc-9160-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785997757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997757, "uuid": "0914a25d-fda1-463f-b61a-abdf906a79a5", "comment": "Malware payload (Mirai)", "value": "92e2d120f1036f4388a578b12ecdb25d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997757, "uuid": "800765dd-d2d4-4201-b6b0-2fd4a97f1089", "comment": "Malware payload (Mirai)", "value": "a5833091c2ec0124c8f26e5461137ffacab95e4ae0f99bddaf61aeb81f164f5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997757, "uuid": "cb2e8808-5032-4d5e-b81b-339c28cc67e7", "comment": "Malware payload (Mirai)", "value": "682bd4aac423a14c371046212f162d01d2fdce76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785997757, "uuid": "4fc7afd4-55bb-4f8d-ba87-0029ff37745e", "comment": "Malware payload (Mirai)", "value": "f420f8de2b4cc9659cd0751ca52ee5c2ea03bc83315a5392ed4ec214820bc6c809cd23bc4a7624c6f67b1917539ee21f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997757, "uuid": "ff6a35ea-f421-4c2c-880e-1ca65657e7aa", "value": "T18C63026E7D1103E0D8B794B8B29B53F24A990C5257336C4E5350EC43AFE77E2258269E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997757, "uuid": "cea3d438-0b5f-4d53-93b5-ccdb838d03f2", "value": "1536:OK9kSXXJRknej2g3oK0UJByjd5afnbdgOk4ABU8KtmtDjb7V1cqPZ2y:OK9kSXJR+O24JBAdQbdNA28SKjb7V1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785997757, "uuid": "33387e46-8e02-4e4b-8b67-97eb55140797", "value": 73032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785997757, "uuid": "5a1b4697-cebe-43e0-b4c9-a40abf8c1b16", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785997757, "uuid": "d7c6e0e8-e6ed-4005-bfa5-08781ea79706", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72b5a3c-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022159, "uuid": "4ecd1d8c-c607-4791-aaa7-c2899534cd35", "comment": "Malware payload (Mirai)", "value": "be636dfa0db7cf4819750f48b28cab84", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022159, "uuid": "b4d6c3a0-b6eb-4969-8154-682fc65dc6b2", "comment": "Malware payload (Mirai)", "value": "a5e6fc6ef65e5c29ace34bec5a3c25e58d347be6b9cf0e520170299df216095e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022159, "uuid": "28b2326a-f519-4a53-98e4-94bb0f3dc23f", "comment": "Malware payload (Mirai)", "value": "36abf8745d2ab957b4f54db886d363827b6f8cb0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022159, "uuid": "5f0ccc06-fa34-4f50-a5b5-b9da85deb3f1", "comment": "Malware payload (Mirai)", "value": "5deb04891c3f06ec62d8c7788e9ae32c0ed1ce0d644b00a9b48eb1b05dd7e90d9eed42d71c96c4cec1a68ead59ee6552", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022159, "uuid": "70bf05c1-4f62-491a-a181-76920ea9f556", "value": "T12D51478E11709A3DA46FDDAC36F74B00684485E235723F295EA80CB3ACC6B747369E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022159, "uuid": "3e7b211d-5b4b-4150-a2a8-04b099c4c839", "value": "48:7CYI7WAxqL/9ctSEl5XsYX09hTQjfVMPfXSXYMkKS24x1D+qQOd:7CYIDxu/9ctSEPR0fcG/SXYMkx2y1D+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022159, "uuid": "99e5ecab-b2cd-4f5b-a73c-575a994072cd", "value": 2554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022159, "uuid": "96f28de3-d611-42c9-8a03-d7996aa880ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022159, "uuid": "ce9a5597-051d-4834-a062-99195bcf740c", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f08af5d-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996187, "uuid": "c1f7872d-c78e-42ca-b4c1-66330c5e4177", "comment": "Malware payload (Mirai)", "value": "86553b384d434caf90719627eb1a5ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996187, "uuid": "d36b660e-c41d-46fe-8090-89389d92f2ed", "comment": "Malware payload (Mirai)", "value": "a5f4c70fd85f792b7a557441ef19cd6e02cb57f02cab160fb48f25e935d97609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996187, "uuid": "b825fe5b-f162-4921-a7cc-570285f2e788", "comment": "Malware payload (Mirai)", "value": "7f8385df59f202f60b3b355850307cce4e9f38d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996187, "uuid": "eadb38af-5d33-437a-94e6-78e1c40c4fba", "comment": "Malware payload (Mirai)", "value": "c88399c50112ce0429036a0f8e5513380002b2d644911ec2e23b0194341a7956fd291874874d2a0fdd983620d78f3093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996187, "uuid": "6968841e-feb5-46a0-86ab-eb096740112a", "value": "T1C1732A16B9469F0BC2C2567BFF5E8388332727A8D3EA3203DA156F51379F55A0E2B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996187, "uuid": "806e767e-1c40-47e7-b7c0-1b26dfd2a447", "value": "1536:2GD+nQOUewRZmfLUI2mmRiLiSXupy1+b8Qf3EdvXIYEMZcS1FnEon/Ra:2KIQOUZTmfYIuQLx+Y1+b8M0lXged1Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996187, "uuid": "5c461403-5238-41e7-98e2-e3502a562a63", "value": 75676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996187, "uuid": "8e556190-3d08-4491-bb3a-7e1fdee0ac14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996187, "uuid": "28a4526b-5f0e-4fda-b477-9b69d0234f4c", "value": "F9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592b9c24-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009009, "uuid": "018a39d2-dac9-4a8d-aecc-b5c94ff2dcbf", "comment": "Malware payload (Mirai)", "value": "fdc9e04620b21eda72730fa13b513f78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009009, "uuid": "db067a63-6e08-4071-93d3-a190c24fc4b3", "comment": "Malware payload (Mirai)", "value": "a6f01dde493013ef221bb8b6e5d6c4c959330b000bddf44ae831e5904f18cdf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009009, "uuid": "464db69b-7e50-4165-9c0a-4c94c0c1ee19", "comment": "Malware payload (Mirai)", "value": "e19dd3e5f5b9456da53e17616b25671bb5f1cd81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009009, "uuid": "3ddb0d6c-308f-4687-ae3b-5cca17ec4866", "comment": "Malware payload (Mirai)", "value": "e82f1d43a129c3a31d836f304281dcf770f38d31528b98cc570fce4f524868a2a28d136da585acc96e12acd8e1432a9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009009, "uuid": "5731bac3-fbc9-4d56-936e-37b0f8604840", "value": "T13BF38FA9961F5D81D7C7F7FCAD5D4FA2303738B80264C1B70A00665CD4EEEE788A2562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009009, "uuid": "7f63e03d-793f-47b1-82da-a01e45c5deea", "value": "3072:v5X+XXyfjwXzX6eqyFmlzagndNphthhE1UcvKV:h+XMjwDX6hyFmlzaOp/hsUCKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009009, "uuid": "9559a079-3f92-4e77-a139-30df57d2718e", "value": 165768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009009, "uuid": "9456eb8a-5e29-4b70-9ded-262e1455a9b3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009009, "uuid": "249b9d69-49d2-478e-9dbf-751e5918b910", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.17163.25947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de09e9f-9196-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1786021123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021123, "uuid": "09a01e89-b3d3-4105-969e-5e815a2cf7da", "comment": "Malware payload (Gh0stRAT)", "value": "5b11b38bf0eb3f0952f306ad5be9d5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021123, "uuid": "70f97140-bfd0-420a-8ae3-15a2c9b31b35", "comment": "Malware payload (Gh0stRAT)", "value": "a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021123, "uuid": "b5c5f925-21c9-4772-89fd-fd9c4867de1a", "comment": "Malware payload (Gh0stRAT)", "value": "99fbd400260206d8480d97d2a1f1b0de9c0bb44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021123, "uuid": "3fb5ad89-517e-4c1a-9835-a2421ebe75e3", "comment": "Malware payload (Gh0stRAT)", "value": "f331e97d0354b1d419ca62f903b555570549de7febe4a28187313fc8476f86f65a00a01a615ce8a2e25718d9371b21ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021123, "uuid": "7544cca5-78c2-4ef0-89f6-a1503018dbed", "value": "T1BE557A591BAB4256DB5837B9C8A6A69409090F432F58C4B15E311E1EBD2734FFC23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021123, "uuid": "dacb03d4-eecb-43b0-a822-dede34fa3833", "value": "d3fd57e9d566c5faff8dc0be327ba507", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021123, "uuid": "28e89101-1f4d-437f-b3ed-11617af146a1", "value": "24576:QOyHutimZ9VSly2hVvHW6qMnSbTBBhBMND:ZHPkVOBTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021123, "uuid": "17d2d402-4fae-4366-9261-10f33b0210a2", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021123, "uuid": "c5635b8b-89a6-4e89-b86f-4514692f65f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021123, "uuid": "5dae7733-3ef0-43dd-887f-ce3fb4907c2c", "value": "\u77ed\u4fe1\u6d4b\u538b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd69570-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996189, "uuid": "c6268592-9786-45ee-96a1-9356483b4bb4", "comment": "Malware payload (Mirai)", "value": "f6babb3513328e21613cf07462418f72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996189, "uuid": "d9c5ad66-fb3c-477f-8a29-c115388e6eb5", "comment": "Malware payload (Mirai)", "value": "a7636fdf59d35debed3ece2ac83bc524a43de41820809a66ea43d1ed20ea7080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996189, "uuid": "9b130d33-89a0-4630-afb5-b9d224d6acf4", "comment": "Malware payload (Mirai)", "value": "f54e39b6e1fd2aea91f24be1a1e8165a9b60c623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996189, "uuid": "7fd1353e-000f-45d9-9219-33e9ce3da523", "comment": "Malware payload (Mirai)", "value": "546103d882bcce4ffd124c5e4c0dfb82dfecf751f20bf38dc45b2280459636c2ed98ca60fd5f0fb1bb715f7614340dfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996189, "uuid": "ff58f204-a848-410c-a4f4-804ecf47754f", "value": "T10C732A2AB9518F16D1C0167AFF1E534D73132BB8E3DE7213DE146B646B8B52B0E2A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996189, "uuid": "7eb513f7-fc79-4b5f-9119-d4e1a24ad56e", "value": "1536:y9nwq2wrHk1x11SBmjyGRH9s44YqaBAYj8AgXiGAuKJnBEQ:Pq2mmWwVGaBAxLAuKJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996189, "uuid": "77a2882a-fe41-4515-b386-a08f40d97d2e", "value": 75900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996189, "uuid": "b5f3c632-29d3-4f33-8eb2-26534734ad6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996189, "uuid": "9378788f-c3e5-4762-a21d-b1a9e9052733", "value": "6wH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32435759-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026982, "uuid": "7fe74609-bee3-4f0a-b383-c8b47dee7f14", "comment": "Malware payload (XWorm)", "value": "ecdd7876aeb82794eb5f5043001b3a45", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026982, "uuid": "64e88aa5-da98-461f-9782-bbd618ddc624", "comment": "Malware payload (XWorm)", "value": "a77da805202bbf48288c9364a233da404b6859eee717c35814a152affca602e1", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026982, "uuid": "cce08da8-50a3-40b6-951e-31187f772475", "comment": "Malware payload (XWorm)", "value": "c739e683b6887339ba68de7785766c005a3b31c2", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026982, "uuid": "bb401763-4ef5-4e22-8305-5b323ec0ec42", "comment": "Malware payload (XWorm)", "value": "88508f247dab582c1cbbdb8792e254019429719e45db05da887f05a0a6622d0a629f935854443b69c2b0d91ade4198ba", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026982, "uuid": "74ed11a3-bf23-47d9-8970-7fb5d2782a05", "value": "T148431C385C4ACCFCFA528641FA52FA09EB735348C1A06769981FB7F36ED4C29801D796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026982, "uuid": "3dd2f5cf-5c52-4379-915e-1c0cbd469fed", "value": "192:BViPlDKhna1yO1pFj8ttFdNzBS5bogWD5v:BViPlGhapFQvFdNzBSygWD5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026982, "uuid": "702d522a-a89e-4164-8753-1f93ca8cdef5", "value": 59002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026982, "uuid": "c9324ef6-bcc0-480a-a5d6-399d0786f170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026982, "uuid": "70ce07fa-60df-4391-b84f-c27e454afa0f", "value": "Halkbank_Ekstre_20260806_082357_541079.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6d4636-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979622, "uuid": "65312edd-87da-49ed-9b63-bd60e044c770", "comment": "Malware payload (Mirai)", "value": "08d053f8dfe1e66c54bfcaf71783cd6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979622, "uuid": "687898a3-7200-4519-95d1-9619964ef5a8", "comment": "Malware payload (Mirai)", "value": "a79c069996a02e251222db1ca25b83a07741436a98809b0315341271403ab0b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979622, "uuid": "9662fa9c-a7c6-4a6d-ba74-2bc7e7f4a989", "comment": "Malware payload (Mirai)", "value": "0fcee9c4e754b41117ae4b772a8a283425d418ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979622, "uuid": "11feae51-6869-4073-bd7b-a7a6f6985def", "comment": "Malware payload (Mirai)", "value": "17aa3ab6c8d484290aa2f0b1398c169f380df7c52fc23f8caf728f4a3382c06714e87f8cb26f6f883c48f00e50baf3fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979622, "uuid": "dc0b7c27-7fb5-4da6-88f6-aa7f25d8f5a0", "value": "T19304290E7720CF21C76DC53105B3CB8656F926522BE28849F36CDE18BE64349A95FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979622, "uuid": "b786d04d-84c7-4a50-9a21-77b4ba4cf3fc", "value": "3072:tyJBGWHHw18/ZaNm3NYFblp3N3vlZy1DTjzc:E/xHlBazb3d/lZobg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979622, "uuid": "773f11e1-6927-4d53-9924-f7db9a69e1e9", "value": 180904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979622, "uuid": "562a0a34-b072-47d5-b198-a541911c2855", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979622, "uuid": "9aef48f2-b820-41a2-ac31-f66a714dafcd", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6b206f-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994306, "uuid": "11d623f5-4ff9-46f9-8728-b197c5fe3a7f", "comment": "Malware payload (Mirai)", "value": "e0ca79858c0c7334f7071d6fee70e3b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994306, "uuid": "53e54d9e-49b5-44fd-bc6f-e06b215b324d", "comment": "Malware payload (Mirai)", "value": "a79f926a5febbb3a3975551ce736a0960d7da071fd9c7ec31d5181ea57fa7280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994306, "uuid": "eee26eca-0bc0-4666-9f60-5243368369cb", "comment": "Malware payload (Mirai)", "value": "63134b827172bcb5821122dfc46b889f55de92f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994306, "uuid": "26c4542c-f99a-423c-952b-b478161c4cb0", "comment": "Malware payload (Mirai)", "value": "ab067d8e7e3fd7654e41caba60e7c82c863275aca1e0d42eba95b36b52746089bace8ad23335ecfe7abb2da2dc53dfdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994306, "uuid": "42a0bf21-def0-4ae8-9443-b65d8afda18d", "value": "T199C32AA9F890DE52C6C52676FB4D418C33231778D3DA7105CE149E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994306, "uuid": "c4651a08-ebfc-4957-8da0-e53e11c50e3d", "value": "3072:MNj6juBHdI4ozVIHLcYEEU5ZjMWwNwhA4oj2P7/NiF3Heuyf1Dl:MlQPVSLcYEEU5ZjMWawZY2Pg3Zy95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994306, "uuid": "dab446e4-c56d-4bce-bd35-297edac60a40", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994306, "uuid": "ab0ce16a-2b70-45ed-bfc6-fb7d920dbaa2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994306, "uuid": "97456e6e-45c8-424a-9cfc-2c28f44e4e49", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f2ef28-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996192, "uuid": "2f4b05fd-45ea-4830-a221-3cb3a0b5db0e", "comment": "Malware payload (Mirai)", "value": "63ad672667055f2215273f096ea93ddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996192, "uuid": "2345d4db-8a7c-4746-9260-aef5f8826157", "comment": "Malware payload (Mirai)", "value": "a7e7171bf00c928ad8db6e2485731cb3b5c9dfe6a8f1be318d3e495d9b7bdf07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996192, "uuid": "c4dd6d78-6f7c-41dd-ab5b-e07128d57db5", "comment": "Malware payload (Mirai)", "value": "20c773d35165a77ce7b46d5935c5e3191473a8f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996192, "uuid": "6cb690b2-a638-46c9-8f24-539ee870b6db", "comment": "Malware payload (Mirai)", "value": "74322292ab6d5a61157a0fea92ced42451b206ba9479a8bd29a89a395af461535494079c93992bfeb8d85dcb93a542c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996192, "uuid": "843ed91c-1ec0-4223-b367-d14576c2ad39", "value": "T1F093124D9CE3B148CCDE153E43150EB2AA40B91BB1245FE548B28C8DD7F599BBF42B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996192, "uuid": "4dc418d0-7edc-47b6-88a5-454dc74b6df0", "value": "1536:9oJEQS06H64PPaJHwRLLQdRoiwm0kddm48PWXssVCSxoBF/4IWLLffNJq:GJET06H6kSJH7+iwTVPWssVpxuSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996192, "uuid": "93d265a5-696b-4074-aee8-4738fe9d9106", "value": 93632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996192, "uuid": "f01b054a-d9ec-4960-bfad-9c304fac5ef4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996192, "uuid": "59c418bf-baaf-47fd-adf0-0b68fd761fd6", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ea9b50-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005437, "uuid": "47916f54-4eef-46ec-a357-18fde80a846d", "comment": "Malware payload (AgentTesla)", "value": "03abadfa2c7911c08f3d71e00d0f3033", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005437, "uuid": "27f85f90-236c-467b-83a4-4af35fd61f20", "comment": "Malware payload (AgentTesla)", "value": "a7ee2070a76bc47901c29c61c6b629cd007b6cd3deeecc3d2c74611eb6808b84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005437, "uuid": "07261f4a-7e6a-4483-ad97-6a8ffac4263d", "comment": "Malware payload (AgentTesla)", "value": "ea9fe88258dd9a33e61bd92201f0def104a8579d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005437, "uuid": "07fc6a1d-5684-474c-a9fe-ba5f95fc8811", "comment": "Malware payload (AgentTesla)", "value": "73956a7ce2ecac2521809f8e2a52b93247ae134a9fb766bafea43fa5ff0f90eadafdba08859df9449f843afab599b1a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005437, "uuid": "9556ff32-f77c-4654-bed6-3211cd282e62", "value": "T18F3541B143892527DD5076B7CC2A20D4EE2B669E82B10D69FF44B1AC3C28D54E2CB5FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005437, "uuid": "13ffbe1d-a087-40c6-94a5-5aa03d8a770d", "value": "768:8EtjxJkYtMfD7jkznReRrzzG9fzstWntk7sYYY9mnJjnR76zjtQsnJ6ek9GRetIv:5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005437, "uuid": "5408d721-b68f-4035-a5a5-226018bdd1cc", "value": 1090269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005437, "uuid": "3603f876-1f34-4f41-a351-c961e3694d62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005437, "uuid": "571234cf-0ad4-4cf6-be10-f5e1516b8c1d", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ef5e31-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009002, "uuid": "468e22da-32ec-499a-a06e-1fed8cee39de", "comment": "Malware payload (Mirai)", "value": "0139e95157bc253fbb08fb76edc1f70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009002, "uuid": "01496784-4809-49d2-908d-30bc10f94eef", "comment": "Malware payload (Mirai)", "value": "a81c9aad13bbe44905b2314e38d8f5a08db92d9695aee36d58a6a87edd3fb039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009002, "uuid": "667493b2-2188-4ea8-9d74-eeaff4efa624", "comment": "Malware payload (Mirai)", "value": "a706fc3da12549657894dc171cab61b4049a5345", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009002, "uuid": "3e1b3d6c-6549-4552-9e3e-5f00eb65f4e3", "comment": "Malware payload (Mirai)", "value": "abbcf42fee5e044e48ad6c040a2b269240b26b8fa89f646eae6f172e6a42d785c94f1d804daea175e558a96690d6ab5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009002, "uuid": "5a9897e8-f9af-45bc-a019-619b9aaa28ca", "value": "T142342A4B67508FA1E375D63006F347A7ABAA22C216D39545E36DEE107F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009002, "uuid": "33263f25-64a3-4090-ab77-0f4662ce9ac8", "value": "3072:MRETcj/Kv5TcJmKvtLLBS8y22LoHWOMKfNgRdAlOsd2U8HOLfZgATLfNyTVHGyjj:MSwOvMLLBSfdEH710Gp5z6ATLAThGg/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009002, "uuid": "ebaf8485-965f-4ffd-9e3d-014f877b93fc", "value": 233392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009002, "uuid": "0a600ffa-c5aa-4a60-84b3-5c7a34eee450", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009002, "uuid": "4ce85b14-b232-4e48-818f-d0419284299b", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.11591.12976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e3bbe-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040663, "uuid": "32f6bc3f-9e7a-4585-a0af-8ba246a9236c", "comment": "Malware payload", "value": "10c194042254e67b916ee28d8c923dbb", "object_relation": "md5", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040663, "uuid": "4aee3447-0d16-4d7a-a471-4e5adfef747b", "comment": "Malware payload", "value": "a8255ff26a84188080f3b4d81a2ef10ec7bb8b567bbbab2c313e90c966c63e2b", "object_relation": "sha256", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040663, "uuid": "d4b0a8ef-cf68-4b79-9610-e5268ec04088", "comment": "Malware payload", "value": "1573385e987083c11bf35199dfc6131395ab2c80", "object_relation": "sha1", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040663, "uuid": "fb4e9f95-2eea-418d-98ab-79d0554e8e59", "comment": "Malware payload", "value": "e956f859d2c9852d752e60e8669e686e15697a2be8e0b2484f2f98975a92ebc2462266067493e8877a9c360f3946ca27", "object_relation": "sha3-384", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040663, "uuid": "70cfa811-9bec-4d4f-811e-118a12a56f1d", "value": "T15CB151A6F9A0D471BE7A002D3ADD9A47A68A072B031D784D70CD65A43B7C504F0F8B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040663, "uuid": "6d2e4aab-f807-4442-96e7-a6ee1285d16c", "value": "96:bEeWBexbAjwt7zJZzHA1LN26ahJzYLx+Qy+lEQJwQTKTNjMDAsT5eEl1mWqKS2iq:IeWkx0wMLN5x5jn+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040663, "uuid": "a8ecf77a-c82d-423c-92b7-d51fca713f5b", "value": 5544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040663, "uuid": "18c4771d-e85b-4b77-b7c1-1c2eb0dfb75f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040663, "uuid": "2ea9478b-9167-4558-839f-a0f0c1fd9290", "value": "a8255ff26a84188080f3b4d81a2ef10ec7bb8b567bbbab2c313e90c966c63e2b_from_104.156.150.223_redis_set.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ac4008-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994085, "uuid": "bc621e60-4b62-4ab3-bb41-ad810b0b7f31", "comment": "Malware payload", "value": "1f3aed673de9d33f53ff57979ef684ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994085, "uuid": "e9ed556a-7fd2-42a7-b692-4c43706f9b11", "comment": "Malware payload", "value": "a83566043e748093119720d9365ee26c3cefebf431fa98e556de2bfc4da50b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994085, "uuid": "bfc0ac6e-c2f0-494a-a9b4-40d0f145dffc", "comment": "Malware payload", "value": "86753add32b1a50021e243a293a869a84935af09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994085, "uuid": "26742f0c-40c1-4a0b-a5d3-ac88d1cfb50b", "comment": "Malware payload", "value": "75bb63d12d35937b14d9b22ba37bb7958e2cc43e9357bcf48e93fd1cf9d3cd296acc3d02c1ab51cfd805c1a5d07258f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994085, "uuid": "ed0c872e-fc29-4361-a255-fa09c2dfdf50", "value": "T1D2564A07ECA555E9C0A9E2348A6B9213BB71BC485B3123D32B60F7386F72BD46E75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994085, "uuid": "ed279f86-6036-4398-a11b-dae990e0e749", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994085, "uuid": "45c06a79-50aa-4364-bf4d-9889b8c5529e", "value": "49152:fejSXVdoCb3Ba1HpEVyjVHNwxSboH1Ws3W19LsJKv36IVnCrV5T7zO/WcfKiK9KG:fEjklS8H1vm1BVWf61bWCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994085, "uuid": "7dc2b46d-83c4-4df9-ba11-0a0e22ba80f9", "value": 6384128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994085, "uuid": "1f71cbdd-66f4-42fc-94d6-8a368a6614a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994085, "uuid": "36e21777-f724-4202-aa92-ff3e4bc3587c", "value": "1f3aed673de9d33f53ff57979ef684ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e40594-919f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786024782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024782, "uuid": "ff571d15-3107-4ad3-806e-2c22da017beb", "comment": "Malware payload", "value": "689a54aa9a10c259fe13876ecefe78cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024782, "uuid": "80f3b89d-df0d-4c1d-919f-41698b37435e", "comment": "Malware payload", "value": "a862e1b45c630da865176a7e496162f6af94e5f112df98d336cf16a7e8dc2c89", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024782, "uuid": "9c1d35ac-ac1e-4a08-93f6-aba22e769036", "comment": "Malware payload", "value": "65d51577d8c7455ba08b4736828fabbd3f48a5c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024782, "uuid": "f3591210-3402-42f6-869e-ef6e55253e3f", "comment": "Malware payload", "value": "d2886f2f8dd45d5b70dd3dac7e334e750a34390a5d1f26a87b1ed391b5c54a8aea65068f6201d4cb5d3eb2238729ee86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024782, "uuid": "abd7197f-500a-41e9-a4bf-33492628b03f", "value": "T11D7125CEF0F2A23429DDCB1233B56914F690A1C661C62F3599DD28F0558FE92350AB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024782, "uuid": "b64c5fdb-250c-4ff9-b9eb-28c609501200", "value": "96:vu94GDjRQQXn+qZrE3WXihv5f0I8CNrS+0O:YrrEaiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024782, "uuid": "8892e250-9263-4511-b547-530ccb732b81", "value": 3809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024782, "uuid": "4000b423-24e9-4c70-b9f1-17c1f85e666d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024782, "uuid": "289ccb21-ecf3-47cd-823f-640056f39300", "value": "a862e1b45c630da865176a7e496162f6af94e5f112df98d336cf16a7e8dc2c89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff9d0e5-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005718, "uuid": "def95554-ec97-4156-9618-686749a3f3f1", "comment": "Malware payload (Formbook)", "value": "813dfb2b5405d00451d4eb0a308548d6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005718, "uuid": "48bfd41a-5147-453d-83b1-4e07e021fffc", "comment": "Malware payload (Formbook)", "value": "a8af219a8047cc0cdeb31deba1e3836a51e2c83c3f6433939cf55ce76d6b688a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005718, "uuid": "e2b620a8-6eb3-4300-a9a3-208d89c14d76", "comment": "Malware payload (Formbook)", "value": "d229e651b7c948b7b2793339873d7f41e3dae335", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005718, "uuid": "d93809bf-cf54-4664-9772-47079bd647c1", "comment": "Malware payload (Formbook)", "value": "2e57479dba74122a145c79dc3de4f4464984dce950bbc343fafca562502e528238eda96d2f7cc5ce05d826f9fa29318a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005718, "uuid": "dd279971-e7e4-4fdb-ad5e-dce4a4c28e61", "value": "T1ED62423BF50CDFF40B2E25D1518B7D12109897A5B53A4DADA8CBC0947F26B008EA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005718, "uuid": "b98a7026-77b6-461f-b393-0066843b6c36", "value": "192:ok/iSghj0KD+QFvIUpAvc3FCY/Ok8zy9IzSbGGIGca6kP5d4P+CXiMPTg:okCh0zQFvNAvcEc7GGIjTkxiSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005718, "uuid": "c01c8c51-cf4f-455f-84b7-2b7298d429ef", "value": 15656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005718, "uuid": "44dcb27c-30ae-45be-969d-f53628155933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005718, "uuid": "1627500f-cf75-4915-a28c-9ceb21d67d5c", "value": "Signed and Stamped Agreement Attached.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5631b4fc-9167-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786000843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000843, "uuid": "5151b35f-32bb-4a41-a6a8-d896db08125b", "comment": "Malware payload (Mirai)", "value": "dda5f903d337ece7232e04c05bcda227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000843, "uuid": "a3e4fc68-ba75-448d-9159-7746294becbe", "comment": "Malware payload (Mirai)", "value": "a8c87b71022ebd8b0ca4bd32d3af2633588b58965a6abe7eb076b00e1479e901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000843, "uuid": "e07a84e6-543f-4bf9-bda4-86ed9c465e18", "comment": "Malware payload (Mirai)", "value": "97bc9aadd414cec33f00b76a7d9a9a696ffc1d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000843, "uuid": "cb3841c2-7813-465e-9a64-2b9b5e2ad8e9", "comment": "Malware payload (Mirai)", "value": "5baa316ad832c951d434d0ddd6ea49303c26c9548bafe329980204dafed6d5ea06f95aacd0da62cdb0e3df2a1b67d936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000843, "uuid": "87c4efd8-836d-4f53-9857-16646b460dd3", "value": "T10DE3F855F880DE52C5C42A7AFA9E428D332317B8D3EA7102CD245F2577EF99A0B3E941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000843, "uuid": "5c3fcf4c-c11f-4e6e-9f18-6e12047f6b50", "value": "3072:STs9v8fTBFXOZ6QetVgmD9tYskk8PflmZWzOGBt8+iPkIJT3:SQv8f7XOZ6QeHT9kkymZWzOGBt8B3JT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786000843, "uuid": "3b60633f-562a-4ae8-9d34-3b2de44ca0b8", "value": 149060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786000843, "uuid": "063a1e3f-390f-432c-9662-dd2c485ff5d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000843, "uuid": "abd7f270-9158-4fe1-b882-d3e6653819d7", "value": "disconnectraw.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd6b815-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978576, "uuid": "84627a1e-96f2-4787-95fa-e5379db1a0fe", "comment": "Malware payload (Mirai)", "value": "453453deadf1f003189ea5d7ee8fc19d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978576, "uuid": "986c05f7-81d0-40e6-95dc-f600dd8872d6", "comment": "Malware payload (Mirai)", "value": "a916b91671fbecdd5d92285b3911228d49785bfc9c740305f8bb040e3b1a3ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978576, "uuid": "f4ce5699-ba0a-439a-a7c6-f81d6248bd20", "comment": "Malware payload (Mirai)", "value": "ee61d564c99154ffeaf235740e13c3bd9a7a98ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978576, "uuid": "fee6b9d3-502a-48e5-83d5-f5060d5d4cbf", "comment": "Malware payload (Mirai)", "value": "c66d9832e4214c4f25c49777cdf97ac1480ff7d9c60ad0c61baa55b5fa6117d8b9a8123292df31560fbad52410097e39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978576, "uuid": "67e6636b-bfd5-4e59-82ac-1ada5b79c3f1", "value": "T1CF330260406A66F3DB481C39FB7B800B579617E83AB3231523047F6CB7E7059317AA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978576, "uuid": "d2f57e0c-e920-45f7-a4b7-c81a5e6ebac5", "value": "1536:+8LB5BPyiL/8yviYQG+L6gnOcEKl69H/0tobKMBQfI:tB1Rv/+1OfKSH/0KKBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978576, "uuid": "92ab2e11-e610-4479-a1fe-3f43c39812d4", "value": 54604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978576, "uuid": "5d2f2692-161d-43d8-846d-4cb2d918c66e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978576, "uuid": "ce7ef2f3-5db1-4e97-8bbe-7fb717ba2c6e", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29932197-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979294, "uuid": "52dedba7-a833-4fd6-b26d-a26867751b79", "comment": "Malware payload (Mirai)", "value": "ad2e9b110527e59e2867b791f1659369", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979294, "uuid": "f58bc125-5333-4441-b6c4-e8da55905638", "comment": "Malware payload (Mirai)", "value": "a962a71c3da3b8d67c97d0d3db1ef7548998640eb55564830986398376f31e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979294, "uuid": "cc3b4168-e51f-479f-ad41-04e96b8159be", "comment": "Malware payload (Mirai)", "value": "de578f46e973f0bd122b5116f0be81fd10110536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979294, "uuid": "e10e41f2-45cd-4084-9e64-ce497f143459", "comment": "Malware payload (Mirai)", "value": "6a1c8de86010caa162199ecfc843d023bae229c257ec7713a48740074c921107abe4e93b1ffbf97821db3b217656154c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979294, "uuid": "ac71815c-09cf-4c4b-be22-0dc1d68082b7", "value": "T1DC03F1F1CEA29C70CBBC28365CF606DB85510BA8D87F61A70E44D3AC6BE454A15D76C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979294, "uuid": "8314b5ac-58ba-4084-983b-dfec067a8b6c", "value": "768:X2zVupXAei/cvWhjExFigdrCGxzt3SUY2pWJy9q3UELb:7X9WY6w7j5xzoiKnLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979294, "uuid": "9fc761f5-759a-47c2-8c67-9cb1d816731a", "value": 40424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979294, "uuid": "859a96e4-eaa9-4762-be75-bb0895b81bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979294, "uuid": "22c2e9de-1fb3-4d48-a3e3-523662f5c4ad", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acd9e2b-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005200, "uuid": "410c77c3-eb42-4b24-8462-f82a01b0a019", "comment": "Malware payload (RemcosRAT)", "value": "a64c9c09df4ad4310a2ad06a6b4ae2f2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005200, "uuid": "62c56729-6a93-4751-92ae-92b9e17e7445", "comment": "Malware payload (RemcosRAT)", "value": "a99039b4ba0da4c05516d43a10dbccc34757b1e3c7b9de7a67d35d667b19948b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005200, "uuid": "6c6b38c7-f406-4046-8c32-ada60f95d768", "comment": "Malware payload (RemcosRAT)", "value": "73cf6ba7daf8aad1ff29decbacfea947cb6a0d63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005200, "uuid": "b335364c-a737-4665-96b4-573f02b97c6f", "comment": "Malware payload (RemcosRAT)", "value": "1b9d0cfcb4ff38b78b82d8ac5afcac3d3459730ca70eab06ddb23af653abd81ebfa893901708a6f380d1b8dfc45be147", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005200, "uuid": "f92ee40f-9554-47d7-b70e-331cd9689dd7", "value": "T1F33559DF21634A75EC2E6099BC5781446AB28059D5789CDE332DF2788FD1E2A4383C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005200, "uuid": "905e2f00-a9ad-4dd3-a75a-c894c86fff26", "value": "96:xU3Ah3AahvRHaYB3AYBHYq3AGvRHGvRXvRHamAeRvRvR3AeRvRUUHmAYlRU3AhHN:1qDxsDvlNDNQnW7L/6OetUUiJiaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005200, "uuid": "816905fe-532b-425c-b4ac-50b2c5e0f8b5", "value": 1161348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005200, "uuid": "c7144db1-f1d6-4e1b-b790-5594a5f35426", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005200, "uuid": "38a09783-d8a2-4ac7-93f6-7e1b6e01fe11", "value": "SKM08092026_076567.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a83eac-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004089, "uuid": "25b70684-2880-4d03-89d2-b8aa9aa1e29a", "comment": "Malware payload (Mirai)", "value": "e6211ef047a4f58eaae52ea95466bdff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004089, "uuid": "cbc25918-0ade-4dba-bb2d-1cc702b39c71", "comment": "Malware payload (Mirai)", "value": "a997912ca9727aef183e9c0b9309d8dd8e47209fc46b4d25daea5e75d34fff71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004089, "uuid": "8f7d10ec-6664-425a-b89d-a5091dc12a2e", "comment": "Malware payload (Mirai)", "value": "0bd90d4e28472118d7d01001beee96a1d09606d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004089, "uuid": "7a900952-59af-42a6-940b-37f4c7e11833", "comment": "Malware payload (Mirai)", "value": "7fee59c6c0c2fdd4e33eba164eadb5fbc1b93aeeb4783dd100aba6ad6ea253e26a87f03ca0a85e474fe00980e07637b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004089, "uuid": "fbef53eb-8870-467e-b3f4-d3d11500a4c3", "value": "T160C32B46EB418B13C4D5177ABAAF42453323E764D3EB330689186FB43F8679E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004089, "uuid": "771fe914-dd41-476e-95c6-565fde59b009", "value": "3072:PQ0Ewp9dOID9CXodp5EoniLpICWbbDM/9mh:P3Ewp9dOIDoXodp5E2ihWbHM/9mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004089, "uuid": "746b15fa-bcba-4b3f-824c-4beb28506204", "value": 121087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004089, "uuid": "95672e5b-431e-44a9-aeb5-1c31672bfeae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004089, "uuid": "eec0ac49-3958-474d-a21f-ddd9ab17352e", "value": "c61c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7803feaa-913a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981573, "uuid": "423c8209-6252-4b7a-a782-56c5b823cab4", "comment": "Malware payload (Mirai)", "value": "d9a0a9910bacc0322590a2fbf74b4ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981573, "uuid": "c349773d-c115-459f-93e6-8519081f6922", "comment": "Malware payload (Mirai)", "value": "aa313a14c9387d8dbcb098ae6c056f2fa58e6cefda798a0abef2742471f1ccf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981573, "uuid": "75f22d38-6883-4c8f-8cb8-6dfafc6a0357", "comment": "Malware payload (Mirai)", "value": "26830a1e430bd6d45d15a79ac043428c60ddea80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981573, "uuid": "8e32a138-ae99-47fe-b9fc-07c4175c5983", "comment": "Malware payload (Mirai)", "value": "35e1d9572e874ed8a1853e6db9cd83b34fd654144d2e9779972102695e2c2220845d2008e26e8a2e0e2cc35f6d86c7b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981573, "uuid": "15364fc6-3c8e-4d4f-b2a7-6117cc103ae2", "value": "T1DCF2E0E1F33EE475D06562F65A9E0344BE6A381BC40F196E18D973A98EBB5082B05230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981573, "uuid": "b94214bf-2b9b-4d3e-ac43-46c01b7dd83d", "value": "768:I/RFmm2gNI4m2a20SuVKlN1xVc1N7FAGpkUaXhHSPQIa3cLujK/x0rwB:mOjgG6aBAgAXhyPJa3cLujgjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981573, "uuid": "e2cc3e35-ac54-40ae-af5f-43a7038e47dd", "value": 36716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981573, "uuid": "e0dce1f3-99a5-461d-9e55-be40cc0ea957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981573, "uuid": "877107a0-6877-445f-abe5-ffc2050bd710", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512efb3-9185-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786013807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786013807, "uuid": "35c3a821-c105-4b1d-a948-50a8be54ab0b", "comment": "Malware payload (XWorm)", "value": "714fc16c608a187c3218dc858ed87cbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786013807, "uuid": "37c04c91-4f64-4529-b187-d646b6755e96", "comment": "Malware payload (XWorm)", "value": "aa6656a2c30c4ac0a97d8b1ac86692f5c0a5d41092ac02be096b74e1533405a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786013807, "uuid": "8d8e41fc-fa47-4405-867c-9f022edc4d18", "comment": "Malware payload (XWorm)", "value": "f8ca388d8352f9af2947c2bada5010f89d8877ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786013807, "uuid": "0d49e811-b17a-4002-8484-95827205104e", "comment": "Malware payload (XWorm)", "value": "651118ad03f6ea19ac3fbcc262a60295a601fdc1e6c82ee5712f138455b1f030f939c7459ecc2883ef8eea427dcb8353", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786013807, "uuid": "98d87b62-4529-4ada-88d6-205c0a31b503", "value": "T128B5C3A02B8894B777207BAD513A8E32990FA0136A81DF00765DF704762DEDF7358ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786013807, "uuid": "5b976bc7-eaf7-4632-b5c5-bcffb3e27a0c", "value": "49152:92his+FsXhz5i9dAIoy/Xb8aSv+I5/Yxe1JzV4cjHKlU/evqo0l:QivFsRz89WNcb8aS2I5/dHzV4cjHKlUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786013807, "uuid": "b14dbcd0-b816-4b69-95b2-dd1f9e8b443d", "value": 2288114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786013807, "uuid": "7c9585d0-4eed-48d7-a19a-3874def4cce9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786013807, "uuid": "ed10dd8d-6ee0-44d2-8e4c-6e3d2453975b", "value": "SUPPLIERS VENDOR FORM UPDATE 02REG5654655680000 0060 PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cc6cbe-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004082, "uuid": "8bd2acd9-8521-4417-ae0e-2fe1091c267e", "comment": "Malware payload (Mirai)", "value": "66885281d436b13ce2871623caac9be7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004082, "uuid": "0a379229-4970-4280-9d54-0ea52a7f88e4", "comment": "Malware payload (Mirai)", "value": "aa9f127dedf4979a78a3ec4c05952d80da695d7577fa36da62200acc0fd07fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004082, "uuid": "89170b3c-99c5-4be3-9d1c-d1fd00bd0f35", "comment": "Malware payload (Mirai)", "value": "94f19102e4e4518eaa7254d58b7c9b6a210f2805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004082, "uuid": "13e61b0b-bda4-46f1-bc41-7761ac3edd4e", "comment": "Malware payload (Mirai)", "value": "4de153f6a0cb4187c3a22395c5209b9a99554426b02b7674939529618b299cf2fafc7f1ecd3947f82e1f010c80dd15ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004082, "uuid": "982f55f8-300a-4dee-86fc-d8a58da5fa3f", "value": "T14A334A22797A1E1BC4C0A97A32F74769B2F1174F65E8CB1E7D620E4EFF24A4061076B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004082, "uuid": "7c868d78-a2bf-49d1-88b7-cfb4370322cf", "value": "768:sfPQAx/a7q94s+qWtOGNnSommFpLQlJMcO+7e6O:sAAx/a7S4shWtOGNnStmnLS9CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004082, "uuid": "4ebf5bc6-8ebf-43db-8838-736a8f2b94b7", "value": 51628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004082, "uuid": "beb94656-fd99-49c9-b0be-d2324f9cd7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004082, "uuid": "d8a89a69-d79f-43ec-b2a8-a520d287644f", "value": "1cbba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d091353-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786046462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046462, "uuid": "0d6257a0-674c-438a-a253-cabb9a7cfdbf", "comment": "Malware payload", "value": "d14fbb80d58350f6798bc02276277cfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046462, "uuid": "890a5c92-7fee-4735-be1c-3760725dcc7e", "comment": "Malware payload", "value": "ab07444470e41f39a41a9b9fef53a3ebb388a1cccb6b50a7df84e4568ae3a560", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046462, "uuid": "a7f994e3-e0ed-4d71-89cb-7ad494e207fd", "comment": "Malware payload", "value": "9a1528b442e4679fd70f5d3326a235df1d05a53a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046462, "uuid": "606b1569-c2fd-4e76-8b08-ef9dfc2424e7", "comment": "Malware payload", "value": "5d907f0f1e9d7d7af30d8f24bdabe5189aacb727a059e0fc7e09143975b6e3eed17d6225d39f68ce25e03b24e37cc454", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046462, "uuid": "d08001fc-216e-4c2e-942b-d3d79b9aa7b2", "value": "T1C1E122D5B9E3687235EE047CABB5B04AA2C7683302197C41F59D77207F281AEF07A719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046462, "uuid": "721f2839-4571-4bad-b1bc-7dd33d795d6b", "value": "192:l/SsNXWsdWUiPe1i9L9ivMiBlnn4zigfiynisY:bcQl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046462, "uuid": "c57fbe4b-06b7-4043-b9b4-7d8dec7adfc6", "value": 6811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046462, "uuid": "203b6210-11e2-47af-979a-a7cf734e93e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046462, "uuid": "bee57a8c-6d2a-46b0-96e1-638c03f0a2c3", "value": "dl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216621a7-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044993, "uuid": "28931c4f-6ebf-4ad2-a614-0cdc537f1e88", "comment": "Malware payload", "value": "4696355edd31c533e3621cfcdd2ea00f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044993, "uuid": "4ac45ae6-1e2c-44ab-9e44-987045ce2e5f", "comment": "Malware payload", "value": "aba148a6454ff6370fdf9697f9bb36a17e52eb53d3d73665b5b91d926653b4f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044993, "uuid": "f2d2be25-64ca-4e76-b871-0c3cf1412e2a", "comment": "Malware payload", "value": "803c8fbab8a4fb06aed1c3494db33a74bdb8efff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044993, "uuid": "352f15a3-7763-4b1a-8897-f73b752a1dd0", "comment": "Malware payload", "value": "035861d3d876a3b8510ccde4c0e1a966de9a27d8cc540eb227b5410d9469aadafc1b2050ad5ac4af7e04c9ca922d26e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044993, "uuid": "8d7568b6-d7dc-4f1c-876e-c68155f2960c", "value": "T150C57B177CE118AAC0AA92328AB2A692BB71FC490B3123D73F50B37C2F767D45975744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044993, "uuid": "6d2e596e-d8f8-4127-8657-6b816ae9493f", "value": "49152:2hAPIoHwyHKx+pv/lHDYAMHajKBDPbAJeIz:2El/lHDdODPbAJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044993, "uuid": "bc2b339a-f0e9-47b6-b021-a1e43b631ca1", "value": 2665097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044993, "uuid": "46412f23-ea17-4e3d-880a-16b2e3212d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044993, "uuid": "93ac7773-0591-4cd1-bc20-00cb9d91f6c6", "value": "main", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b47095d-9196-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1786020931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020931, "uuid": "4a56e5bb-6745-4bd6-957b-7c2f41786f9e", "comment": "Malware payload (Gh0stRAT)", "value": "26f33ae36ad05582393a6d6ec6cb3273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020931, "uuid": "da30e382-34e6-4f7f-bac4-7d90c3276d7d", "comment": "Malware payload (Gh0stRAT)", "value": "abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020931, "uuid": "394d57fe-ea86-4575-8e8e-a17f266c6437", "comment": "Malware payload (Gh0stRAT)", "value": "313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786020931, "uuid": "de9e02ea-1ba9-4a13-96a9-5c7361770ce0", "comment": "Malware payload (Gh0stRAT)", "value": "d87090db57ad199561c11f070c26608dba2b33a724704d46f108fda54f62d43053981883d20249fe58f87f98d3a743a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020931, "uuid": "7470bf86-29b3-4cf4-9428-5c585a03699e", "value": "T1CC862313A6CB653FF0AA8A360A77D112593B662069134CBB9BF4085CCF261D52E3F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020931, "uuid": "6e998544-d37f-4eaa-8af4-879d30a0aa09", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020931, "uuid": "d1755e35-b18f-41e0-8614-90ef06dfa3ad", "value": "196608:ib+yMc1wJt+mZbfISvEZEMxDx8HGIsCWpQda70Z1:ibtMkUt+lSvEZBxDxPZQD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786020931, "uuid": "0ff537e5-23a4-41ec-841c-63b04b74fd1c", "value": 8466238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786020931, "uuid": "e9f658ad-ec21-496a-a138-c516e61149f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786020931, "uuid": "e0e86c3a-a94c-4f19-ba27-2773ada6dbf9", "value": "AnyDesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02869687-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "b063df15-8a2b-404a-a069-ceee697e3073", "comment": "Malware payload (Mirai)", "value": "d474d071536dab62701ee1321203dbf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "6c2bf583-44b1-425b-a4c7-ef11e1a74184", "comment": "Malware payload (Mirai)", "value": "abfc654f545cb437714fde5b66e5307b9dea78a67ed7a8c863d82f2daa2fedac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "8000148c-ae3f-4c74-81f3-d90fa04dd069", "comment": "Malware payload (Mirai)", "value": "075663fe8c21b2ca5fe47c293073ede4bc8c559d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "6412d8d9-b496-4f02-b039-a81040c8de0c", "comment": "Malware payload (Mirai)", "value": "b8b6e03f7061f4d06da488575772b45246660ed29aaf4b875fca281ec6801f70d071e3b7f509b1f551ada966ee35dace", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "424e8c89-81ef-45ae-80f2-02eff7c07e37", "value": "T1FEF34B06B30D0943E2632EF43B3B27E1D3DF9A9121F4E744655FAA4A9172D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "5f96b7a3-2882-4f80-88f0-061018962e05", "value": "3072:VP9PvxYHWUxplVVQxMj6L9FSSNKWP4I/y:VVPvtUxzPQCj6L9sSZAI/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048377, "uuid": "d999a49f-936d-4a56-bf1e-c5af451c6c5e", "value": 158924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048377, "uuid": "42ceb370-5584-4448-950c-146797a2ee53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "82aefda2-d32e-4584-9dbe-f72c1c31ecfe", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c451ec-91e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786052750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052750, "uuid": "bd5cc746-57bc-420d-b5f3-6b1bc48444ba", "comment": "Malware payload", "value": "b0eac77c609e979069a74923fe5816de", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052750, "uuid": "cc975d69-0511-480e-8d9c-013bc7fea82b", "comment": "Malware payload", "value": "accbe9fca34638def5aa8a0c9d4cd7a536cc631c00a391d75e5a7b7548bade4b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052750, "uuid": "d92c62a1-0a05-4586-9768-ff977364009c", "comment": "Malware payload", "value": "a36c2fcdb5895a8ab12f57409b855bb945f11112", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786052750, "uuid": "157b55b5-e34b-48df-90ec-e9b147308134", "comment": "Malware payload", "value": "9b709e0847210be9ae602b67bf9984d2a10ad6e36a5f00ef50a73b5ec3a41efbaf4a71c83136ab56e00b1e8bfc96decf", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052750, "uuid": "022ce173-ab12-40e1-b177-b9e29f356dfd", "value": "T1E4C602059E5D5270CED64D76E1AA4B340F3A7711E310B4EBAF88828D46FF192D2E364E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052750, "uuid": "576ba7cc-cfaf-42dd-abc2-c2d5dbac5a9b", "value": "fb40ad72cb65f1767a2e06fa73fcbc83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052750, "uuid": "a1f0122e-c149-4ef7-b13a-11c2595815e4", "value": "98304:64EdCO388idcp7+hHL9XEYiUDeksd3p6ro26pHdOwd83r:64Ed3sTI7OL90YiUDhsK/6pHdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786052750, "uuid": "8f87d3a4-3049-49bd-a868-b098f62ea964", "value": 12075520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786052750, "uuid": "964e802f-dc4e-4ec1-bbcc-40d4b5903e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786052750, "uuid": "6062051a-8d4c-4d20-af1e-245966684f09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02802723-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "1621d5be-98bd-4d96-af9f-0ab50fef79a3", "comment": "Malware payload (Mirai)", "value": "478bfc392b2e0ac6bfd686d387d94c6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "92b7d9df-e0ed-4130-b186-8596c457dfe5", "comment": "Malware payload (Mirai)", "value": "acf2825edd91314e55eab3806067b61a6f3a952aaf6f62d61d994ac94da78ea7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "81e167e6-6d6b-47a1-a017-ea9ed2674f39", "comment": "Malware payload (Mirai)", "value": "6a1f4e19eec442a47150104473460cb91d5c7378", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "d66afbe2-de61-4963-8369-8a287906a0b9", "comment": "Malware payload (Mirai)", "value": "7d65137acd5292e15081748207bf6dabb5cf67e4dd3d56089aec349cc14c7c12b998f4d515a776f2b1eb32e1b39a0221", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "2656a73a-31e3-4fa2-8d27-f06720e4b3bb", "value": "T1B314855E6A328F7DF368873447B74A34975D22D627E1DA84E2ACC1041F6434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "ecbbb6a0-e669-4ba5-950b-ea80d84f7806", "value": "3072:xvPPiLe76ygG4jOn9zPZidj9BJA4AnpSrOJgr4:xviLe76pG4jeBGjJwpSrCgr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048377, "uuid": "3bc82fa2-8116-48b8-ba6c-744f351ba684", "value": 209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048377, "uuid": "d49792de-d172-4a3a-a2ef-bcbea2e12068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "ca480f51-6a03-46ae-9086-75b225b9011a", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f13610-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049507, "uuid": "10c0594e-2840-4577-9565-46fd40a0eefb", "comment": "Malware payload (ConnectWise)", "value": "ad425d7410a864bf63a61ed811a8e77b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049507, "uuid": "e307226f-b5b1-4103-8ad2-c82c1eabf066", "comment": "Malware payload (ConnectWise)", "value": "add0e262bd554841dc12c106294dda4f8c6b73e7f28fca51a6f57e4d52fa16dc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049507, "uuid": "85cc74ca-a70f-40dd-9cac-7d76f6183210", "comment": "Malware payload (ConnectWise)", "value": "5707a2b7c3ce31544b627354182418dafb7307c1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049507, "uuid": "cfc52fc6-e48f-4952-b22c-5239851a4f8f", "comment": "Malware payload (ConnectWise)", "value": "b849cf925320753048f69d5d0751c4e24548e9f0bd462431e369e4062fe9471ee77486f1d7642aeaccfc644e592e1678", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049507, "uuid": "30a64446-15aa-49dc-a236-e423d8cf7d54", "value": "T175646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049507, "uuid": "2672aa9c-1b11-4c21-86e8-2444ee582c40", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049507, "uuid": "9b1fbfa3-51f2-409c-8fa1-bffdc9b656d6", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji90:51iw7gryNkSV1hy1Z1u2JLu90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049507, "uuid": "8728f968-5761-4e10-bd15-74ccdc8d6816", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049507, "uuid": "0a1d59c4-0145-499a-995a-379d51cd845c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049507, "uuid": "c3deb905-971e-493f-9cdc-cd7f82b9c34f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6c1cef-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "54bec2bf-23f1-49d0-808b-5e083e3cbde6", "comment": "Malware payload (Mirai)", "value": "8c5ead19dc65aa718d090514260130c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "8d60fb70-cb79-4a48-a3bc-fb154b3ac20c", "comment": "Malware payload (Mirai)", "value": "afafe5343374a1df7232db22e8bb7ff03b64bcc9e7ba120945f24184cdadee4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "32a7a706-93c7-4c58-8e32-982aaa038a63", "comment": "Malware payload (Mirai)", "value": "c26742f218cc33ec4c8c66cb6a03dcb8d7ad0658", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "98a59fd4-3662-4d78-b925-74816ac07bb8", "comment": "Malware payload (Mirai)", "value": "088fbf4766985e0759c9bf4c41ade4c9aa9f4a9f6010b93aa82254f92e2b67e1ab4da5992cb0e5f76591d39dd3fb4427", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "3b49e4a4-0eda-4ea3-aae6-84b212552d1b", "value": "T181B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA93E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "bb88d084-802c-4786-90af-c803ad135329", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhoohHw0pJbLr:XFmzY5mXBypzjYYZ/5+JllHLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045741, "uuid": "defffbeb-081f-4fb4-aa10-baab4e003897", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045741, "uuid": "4f84518d-1340-4821-85a2-8b03d817448b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "0a853a35-d4bd-4f2c-be95-29215a14b5e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e8001c-9199-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022175, "uuid": "2206446c-8f85-424a-892f-20ea4dab6886", "comment": "Malware payload (Mirai)", "value": "3092909a48aa6330c0de8de5b70b1030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022175, "uuid": "67fd8e7c-897d-4f70-8591-f59272b0cd94", "comment": "Malware payload (Mirai)", "value": "afe86bde95df45ca3dca8c600521b0be377f4f238196621ae6b5052e3633c0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022175, "uuid": "c9513651-586d-48c4-91da-53ca67596fa0", "comment": "Malware payload (Mirai)", "value": "66ee801ea3c7a3c50c93aaf51abb04f208326311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022175, "uuid": "974a37f7-d1d2-4299-ad91-768f977d727c", "comment": "Malware payload (Mirai)", "value": "a13dcfb6e7f02136bde573a5d5e40d596020c45dec361b1e18c13e8ecd2aff62db4134d025dce214f07b3da346be56ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022175, "uuid": "3874c829-fcc7-4e22-bd6b-c22e99c93f50", "value": "T171532A23FB0C0466D8D36DBC0A3B0BE29325AD5120FED015750D6E9A1B36F316A87BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022175, "uuid": "ccd86b11-e5ce-4309-b5ab-4dd08f22d53e", "value": "1536:2xAbA7bloY6C7cPOlm+mOVG8GVA5etH0D1cL:2xAb25t6tPhOVtGVAWHO1cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022175, "uuid": "13329c84-dc29-46f4-ac37-b32b87d24bf3", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022175, "uuid": "cded537e-03f5-43fa-8248-c3cf82e9bc4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022175, "uuid": "9e0a21ee-c460-42b4-bc60-da9d7fa38584", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f77b36f-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786005261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005261, "uuid": "6031772f-3d49-4c33-9985-41cb7e999d9a", "comment": "Malware payload (PureLogsStealer)", "value": "cdeda1bc7e2a93caf9b04d94b81c38cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005261, "uuid": "eeb7a5a3-90bc-47bc-99fc-bdf48e47398e", "comment": "Malware payload (PureLogsStealer)", "value": "b07a4a75cdd824940753b01d05e7111f115c53b987e915f856b67c9a5817e39b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005261, "uuid": "a276c266-2d48-442d-8d6a-84b0d47ed857", "comment": "Malware payload (PureLogsStealer)", "value": "935537f235315909647d79b58a4469345d90d44e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005261, "uuid": "3f0deb70-2490-4fc8-a893-b09606ba8b02", "comment": "Malware payload (PureLogsStealer)", "value": "8103fdbc0a4f146dc8de704d1c6c36cf2dea09bd7a48a4a3693ead08419b42440cd0c44c6f120955970ef55ae5106a65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005261, "uuid": "2667ed98-fe23-44f3-bc9a-f61488b33d34", "value": "T176250BDB9FB6D6890A287D6EC43DBE9D248BCDE004D0AA5BEDB94147F30E64501C4B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005261, "uuid": "8a1e992c-f583-4ce1-9b04-5e491418b321", "value": "12288:WrxHnbVYbN5mI8C/HzA9h39d1/MbMAs0da2CrtRqpN9MTTFMcTaJoJei4OCdwSK3:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005261, "uuid": "e0f88e6d-18ac-4260-86c4-40c09ac7bbda", "value": 1012384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005261, "uuid": "347483e5-b99d-4946-b609-6c914fa66b2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005261, "uuid": "5d241889-dffc-4496-a656-7816a99e7b77", "value": "PO_40026271_Proforma_Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51fefb4-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785994614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994614, "uuid": "c22e5085-79c7-428b-98e3-cdc2a6521df6", "comment": "Malware payload (DDoSAgent)", "value": "1e7083e7aeabd141a0a3f3799b32e0a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994614, "uuid": "d804f4bf-a9be-4c86-bb4f-8bbb625ff9a4", "comment": "Malware payload (DDoSAgent)", "value": "b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994614, "uuid": "4c2b2389-e40e-42e5-ba66-d78347bf73c4", "comment": "Malware payload (DDoSAgent)", "value": "93e86f4a175b39ddd85495bd8385257de9234b6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994614, "uuid": "5ae793d3-189a-4a4d-a16b-4209e4b9673c", "comment": "Malware payload (DDoSAgent)", "value": "453b2cb13ff392a18bda4a653b1e3129022c1778a8df3686423c8a13a27f3a8137fa0dc31d588c51da4441dbb23c7508", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994614, "uuid": "1f40fe8b-6a55-4a59-b3d4-7bb8235b6491", "value": "T1E2F03085FB14E9336507CE9733A803305747B8FAA4C31656AC627D9A18C9AC97407EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994614, "uuid": "88b022ad-39b8-4c2e-88a4-e5509405339b", "value": "6:IOnFflR0mvwd+n2GvwdKNd9UFovwiGvw59UFovwRE2GvwRg9t:IYn27YNdii75il7aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994614, "uuid": "9ada454d-b451-49e8-8ce2-2facd251e010", "value": 536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994614, "uuid": "2a19b8b0-4842-45b8-a321-19ad37384c7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994614, "uuid": "1e0d3643-a202-43e4-9694-d3a6ccab77d6", "value": "phantom_bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a865545-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785983590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983590, "uuid": "f1371aa4-87a0-4190-a09c-9dc28b08de5a", "comment": "Malware payload", "value": "bd4187782911531014435e70be06f6be", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983590, "uuid": "9e581dc0-1173-44ad-b699-83cc10598f72", "comment": "Malware payload", "value": "b133af2fc6335073a8742691d536e97409b04c59c23b2440b26b23da66c76b81", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983590, "uuid": "c2c50658-5cda-4170-8324-d2494195d39e", "comment": "Malware payload", "value": "36936a1f13fb3721ab84c5b74875e6eb9e221f33", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983590, "uuid": "cfde2d03-787c-4cee-9363-2c3e7e7072a2", "comment": "Malware payload", "value": "a8417544934f2f1c4a54ce54cf4e40e84abdbba8832f6cb65acb68a893984c4fcb8197110fcec79a9b66806c0a554d69", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983590, "uuid": "2cab1196-56cb-46a3-9c6c-1839aeb3d79b", "value": "T198D523D678F214B5D833C7B6CFD2F45EB22A77C50B664D8676CD29108E826825C3A738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983590, "uuid": "bba64f26-5eae-43e8-be78-1896f353cb33", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983590, "uuid": "52a2d9d0-54e0-43de-80f6-a59b994aa365", "value": "49152:YnncZwHu1r8bkjkp6OrqaxBr7bdHSilmnTDea5L5rGypEYIsQLz9UTas4:YncZ5r8bkjktTbdHPl2TD7LEyeiyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983590, "uuid": "106dfaa5-cab8-4c06-b64a-ed5bd2c7cf0c", "value": 2982912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983590, "uuid": "42ed6793-6016-4b8b-879e-d25563f3649b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983590, "uuid": "db205b50-edc8-499d-aca0-09cf7b8254c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a13081-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "1cfbb758-7788-479d-8fda-6d11e8000839", "comment": "Malware payload (Mirai)", "value": "b28b24d33b7cda91be1c45cd5fdfd8f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "bf509a80-5a37-4738-a376-021c261b5504", "comment": "Malware payload (Mirai)", "value": "b18617585fc14db14883e99827c75ac6713c8e56f344b0605ed213a3754e2ce6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "28e7c6a6-a4c8-4042-aaf5-4df93853f33a", "comment": "Malware payload (Mirai)", "value": "204e8810d9e4752f5a70e9d7754de06d8e3a1103", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048376, "uuid": "18b2a7c6-b7d2-456d-a836-710c5295794c", "comment": "Malware payload (Mirai)", "value": "cb93f4433c7184129e2ac40befc78f45a60b00eab74548bf622e116fb1630e17f561d9ca44cc2a3bf3b48778d939e44c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "fdb40423-da11-49e8-b70f-9f91f1db189f", "value": "T126E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "155b6f4b-afe6-47aa-a517-cc05fb7309d9", "value": "3072:nOtstuCDxzd9xPSmQZf9iq94cZwiSXUquVY1iH8qQAhR6:n+stuCDxzd9kffJCcZwiAUqu61hqHhR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048376, "uuid": "bab1420f-336c-4050-80d1-a9e44cbe2f25", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048376, "uuid": "135a7095-0b5b-494f-b145-fe73dbad5c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048376, "uuid": "6746fbc0-02eb-43bd-ae3e-4fa89a5052ed", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be502e21-914a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785988563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988563, "uuid": "47d061ed-2c36-47da-a1b2-e6ec85c677d6", "comment": "Malware payload (Vidar)", "value": "fbe1a04cc1775de718372d31d6b89aba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988563, "uuid": "8ed809a5-d09e-4a52-b672-da22da6d7e5e", "comment": "Malware payload (Vidar)", "value": "b2134f3c37e669227029cfcebdd496fbc65c9b0504a2d2123bfaa45474c08885", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988563, "uuid": "7b7d3b68-addf-4ad1-8936-8a01f9eaf9bc", "comment": "Malware payload (Vidar)", "value": "d7ce3534465c07fcacb8ec525c0473bca404ed89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988563, "uuid": "91603525-07ea-4465-9aa4-928c2cf338cb", "comment": "Malware payload (Vidar)", "value": "0e66a8501cc727c60f39f9ed373881a8cd71395743b657a20b1adf9b9429f3f8c1abb9d04a16f7c2f05803f6cf996460", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988563, "uuid": "0ac04e3e-71cf-4d66-acea-0b9f01dd5ecd", "value": "T12E85F922B2D097BCDC2558F30F979B74C372760E71169AE818BE1F04AD2B5A16B127DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988563, "uuid": "963beca1-dfc0-4bb6-8026-bfdb7e31b84e", "value": "314d410bef1e80ee695ecc184f2190cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988563, "uuid": "20725271-bbc4-4e37-b398-dda1b8070913", "value": "49152:PpuFDCcM9WjB5kShUyd3avfXdsNFNJfGw:xLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785988563, "uuid": "33165432-46bf-4808-8442-228fbd73d31e", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785988563, "uuid": "2b216726-cd19-4535-a740-e68c6d69ba63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988563, "uuid": "6810e902-5dbe-4a95-ac50-6a79c551c2f2", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf68d91-913d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982841, "uuid": "7da1e1c1-5317-4522-9f03-8acb46b11fcd", "comment": "Malware payload (Mirai)", "value": "cf5df11f2527f30d2836723a1ec94ebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982841, "uuid": "77da32b6-2c61-4739-8230-9625d3321022", "comment": "Malware payload (Mirai)", "value": "b26ce9d2b84da259a16cff2788c9d36011f60f4fcfaf08a2a736490db92e4949", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982841, "uuid": "dcdcc843-f88c-4c14-a07b-0c03caf1cba4", "comment": "Malware payload (Mirai)", "value": "3f8d93239910f688e14a3690e145c2bc599fed7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982841, "uuid": "1d086d02-c5fc-4431-862d-feeb296c849d", "comment": "Malware payload (Mirai)", "value": "6ff6b1b0ffe7e0d6b92bc4480ba5c8086274a98221ed34d6a782d6d1f658604a3655485454020b6376842c9cee03159c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982841, "uuid": "122e9654-48fb-4913-b663-eb28bf7c9cab", "value": "T18813F15AE32E4652CDB35E71DAE82C0732AFC26890ED30B207AD5A9065C270D5DF97C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982841, "uuid": "af9d1cdd-0cd7-4ffb-9016-c6196e1824e6", "value": "768:ga6sPPGAgp62bwuFr54xdJk3jVR9FRC0LNZSU81uS9q3UELrw:ga6sPfgp62bbIdO3jRLLNZS51uHLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982841, "uuid": "dcfe319e-fc1f-4064-941b-ece38d636d31", "value": 43308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982841, "uuid": "f8305b0b-7b81-43e0-816d-3de177af1674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982841, "uuid": "3b5894ed-459e-4211-9f72-750a87646b73", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc31f3e0-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993767, "uuid": "5a8ecb0d-ee6f-41c0-a494-f016841ba368", "comment": "Malware payload (Mirai)", "value": "8f70c445cf6dbb57e734d6585a8236e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993767, "uuid": "f37a3864-aefe-49b8-9f28-8a84e7696c60", "comment": "Malware payload (Mirai)", "value": "b33566517e5580d6d2187519db96cbb650ec4c310749ca7e55f87d4eaa81f265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993767, "uuid": "aa29455c-ece5-4222-904d-dec75396ff76", "comment": "Malware payload (Mirai)", "value": "a81d5076a778933b13d466d2d93f74a3ffe9f22f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993767, "uuid": "83ece5db-330f-4e45-9d38-707e61239ec2", "comment": "Malware payload (Mirai)", "value": "d1a24dc8b60a6a052a76e70c5c584a7a628b84d112487cf622207291e252e827fd1a088df1c34c95fc734cd497aadf19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993767, "uuid": "ee977b58-5ff5-4837-959a-8b08caa022f0", "value": "T19D83028B8E3A8624DCA3A5F65643D486FA87112AFCFCF70ED0A4D407793941485E5D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993767, "uuid": "11d95430-9f38-4a3b-9925-d9b1a54aca2c", "value": "1536:9QcJxDX1TerJ3qhiSIg5HRWKhEhfEguP0zFO8zPsmOVnBz1gzrR8wDDbeQj:9rPX1TerQTIg5gK21E7szDHOngrR8Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993767, "uuid": "c0156898-4411-42c4-984b-b7c7c0d0250b", "value": 84444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993767, "uuid": "77184ee8-8fc2-4946-b26b-9403ea692183", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993767, "uuid": "8ffe7cfd-9c39-4193-b5c3-6013fa4d552f", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3eb926-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026756, "uuid": "de474917-6b4c-4084-bbb0-13558d0d46f2", "comment": "Malware payload (Formbook)", "value": "22f28dfdd662924ff39de0dcbc04a518", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026756, "uuid": "9f92b15d-5bf3-4853-9be5-07a2ebcde183", "comment": "Malware payload (Formbook)", "value": "b4030f06fa3ea85a34443c760019f9b7b447794c6048457eb41aba18069575ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026756, "uuid": "5bf6fac2-b6b8-46d3-8799-b02ec5b49882", "comment": "Malware payload (Formbook)", "value": "38ae4408f6865f3d7b0be854d82d4ced4c99db24", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026756, "uuid": "dae2ec84-a3ee-4c23-9b76-547b217dbcce", "comment": "Malware payload (Formbook)", "value": "eaab3176cc679c11b8c131a55499d679d50da9466e937a8b0017f0c0bafd3502cf4cc5e5a8574ae61ba74c228b4a7863", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026756, "uuid": "5a3b3363-518c-4144-8a40-3d0a478b2561", "value": "T1EAA31F0499827480633A6B7FB22AD8E5F3760B6B01805917B87C7880DFF6D09DDE5DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026756, "uuid": "4b3400d0-479a-42d1-9b4b-d8655ffc0e3b", "value": "1536:JF6K/2oLcKcUyFj7eVbsZJQsmdEPY7vXMSO9:JUKcUKUEPS/M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026756, "uuid": "d4809789-2c2e-4fd1-9bf8-941d9518a82b", "value": 98758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026756, "uuid": "bf8b09a4-1210-4e0f-9f39-2d229346274d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026756, "uuid": "21c82f59-b514-4f73-8d47-2dca40df4cb3", "value": "06.08.2026 Fiyat Taleb 600508 - 10107161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2306dfac-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050579, "uuid": "3640788a-a818-4fec-8f56-1ebf3c4c2464", "comment": "Malware payload (Mirai)", "value": "9e30eb70b8e1f97d439abd9f09d331bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050579, "uuid": "a6e031bb-9af2-4879-b146-a2caee322a4c", "comment": "Malware payload (Mirai)", "value": "b435762e4fbe122df3b90b006bad194b4293755389be09b3e53e6b87bb0f9c2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050579, "uuid": "42bf215e-e1a0-45c3-bc2a-5832f90d2013", "comment": "Malware payload (Mirai)", "value": "4a07065a40417425d9f23404a8e35bd319224bf1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050579, "uuid": "b6dff47f-fc41-4ae2-a897-f6f80a1b1137", "comment": "Malware payload (Mirai)", "value": "73d9f4482d81f5faaec0770ddde230d67ea4af49253a0b6391ef190383fcb842f5b50e0cd54308b95001805e8d0d7627", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050579, "uuid": "20c78f4b-8b3d-406f-a2aa-d8dd32064ad9", "value": "T1ED14F70AB9919F11D5D231FEFA9F419833136BA8D7FA7101DD206F6033C699B0B7A216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050579, "uuid": "bb32b695-24b9-45d3-a0a9-c9caecc2ea59", "value": "6144:xQjJUveb5+Ms0zcPXKUCas/MPVztIPJhPt/iO8jj2i:xQjWel+tScPXKJascVztIPvJiO8jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050579, "uuid": "8419c64a-a170-4847-94fb-9b02f88c8e86", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050579, "uuid": "fc401582-61a8-4bfd-96dd-f67fa091cf3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050579, "uuid": "aa2a4baf-f520-4c5c-a22a-c8d1f2c89469", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432130a3-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046338, "uuid": "0300c69a-e94f-42bc-a97a-fef3fade1e71", "comment": "Malware payload (Mirai)", "value": "d016a3a85ba7b9f2ac2b9abb3aecec5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046338, "uuid": "06cb9164-c16a-4edb-89f4-05077cb6dae7", "comment": "Malware payload (Mirai)", "value": "b464fcef34f164d36266545296db3999fac790a1522a7f5ff97e467756c63f53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046338, "uuid": "cc5fcae4-c7ad-4e57-a1c8-d4e102f3b18b", "comment": "Malware payload (Mirai)", "value": "0df4f10d5a21b856f74d51f809ee59fd0919d86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046338, "uuid": "447acf21-be1f-4c94-b06c-34ef52cd7f6e", "comment": "Malware payload (Mirai)", "value": "cf735a01215a22cd42c07aa199854208d3b37bfa10c324aab8d18c14d8342290c60f69326499615c49a0e2455ceffd1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046338, "uuid": "def63673-4b11-442a-9c07-b19ba1c39101", "value": "T13BE35A1775C180FDC8D9C2B48BABE326DA73B4291134B11F27D8AE271E5EE206F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046338, "uuid": "c6a2f7d1-b8f0-4ca2-8bf1-261f2b2d9428", "value": "3072:uJeu4UXoJCsXO71dwKUWU69oO36DQgVCo9T8O2m0B:kmk9P37oIlm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046338, "uuid": "ca26d0cd-bfbf-45a3-b135-8186dadfd923", "value": 147400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046338, "uuid": "ef219d52-fa25-41d4-ad4e-ae7f0d5c6e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046338, "uuid": "57266685-9940-47eb-8fb4-32a9aae91497", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c67c11-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998831, "uuid": "e5729cd6-01a3-4596-a82f-4fe17ff1b377", "comment": "Malware payload", "value": "18842dcdb0382ba0ac2a7f9f6197c48a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998831, "uuid": "c5d25fee-3cc4-491a-bf8a-61b55712ddb8", "comment": "Malware payload", "value": "b525ea9a22bba374036eed952d0f6065d9544268444564afad781e1d106ec77c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998831, "uuid": "c440f69a-32b0-40f9-9418-169f9444c316", "comment": "Malware payload", "value": "2dc4ee6b7db495be7f2482a298186507dc4d8459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998831, "uuid": "2dd8fc38-c3c1-47d1-86e6-97eac5f57057", "comment": "Malware payload", "value": "134d9deae23822fe534b0575bbf73fa6953a318780b114e2e798dfd4dc4608e10ec28e6bbb3680734ed31a3defc4be33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998831, "uuid": "a77278f7-84de-4b05-aa68-fbcd8f449ed0", "value": "T196C312204AAB2742767FBAD70869DF5673FACEC071B686E14740FFF09421A497D948E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998831, "uuid": "e056425e-3c71-43c8-a89e-8e9f9aa9d0e1", "value": "3072:FOmJ4Bu06f248NjixNSj3bnH5ihVT5yWc5a6Zk44u+qgw2un:AY4gQ48NjiL23bZAVANxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998831, "uuid": "55480403-2da1-432b-ab5a-ee1764e05654", "value": 121088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998831, "uuid": "5b4f97a2-b941-4c00-868d-74dc5affe901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998831, "uuid": "b3243726-245d-4f9c-bd59-f6db7eb9af0a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290d85c7-9136-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979722, "uuid": "915d00cf-417e-4fb7-8d25-433f9edded97", "comment": "Malware payload (Mirai)", "value": "a3f9ecfddcc355d142f6a7335b853504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979722, "uuid": "71e51754-7461-4e08-a072-63454563c37a", "comment": "Malware payload (Mirai)", "value": "b52b605b22e497caa6930b9cc46dff2be18eaf63dcf7c2226906dfc5114f2b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979722, "uuid": "f0593afb-009e-4618-966c-849d69539efa", "comment": "Malware payload (Mirai)", "value": "e05025adaf8d204a7369b699eafac52205414031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979722, "uuid": "dc2e2875-1f80-420e-97eb-7d021d174db4", "comment": "Malware payload (Mirai)", "value": "62bf19e5ca3dba1380dc0ffb4a490251b79f347390577923b74dc553f403856189b7ac2bc989f7251ccd088db30d39e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979722, "uuid": "e9ef2045-b577-4bf9-bda5-a9d189a4d550", "value": "T180C329A9F890DE52C6C52676FB5E028C33231778D3DE7105CE109E34F7EB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979722, "uuid": "76570f42-4955-4e79-8e26-9b249398038a", "value": "3072:GMS8HWIzZvDVsINudJj+3scYEEU3cRE4fOAvLSKykdGER6U1yGk1lf1Dl:GLMnlUQscYEEU3cRE4GsLLVdGM1l4l95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979722, "uuid": "23e042c6-2eca-4781-a1d5-9b786306507e", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979722, "uuid": "56189734-0275-421b-9777-4c3980721d00", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979722, "uuid": "c3b94f99-b691-4ce0-857c-e7f0a9fe645e", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb709454-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050486, "uuid": "341a2b83-6204-48b7-8e09-0763bc4080a1", "comment": "Malware payload (ConnectWise)", "value": "455f63ee9d170effdb2305c22977cef8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050486, "uuid": "3d60d875-36f9-469f-a466-b4dbdc85eef2", "comment": "Malware payload (ConnectWise)", "value": "b5f7df56de192f53a8122e1e6a7d83c80344d94b401d140004cff8cf04252757", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050486, "uuid": "ff4d37e7-55dd-4534-9945-cf7165ceb855", "comment": "Malware payload (ConnectWise)", "value": "65a8062fbb1555872ba67e696dfc9b67a8a334e4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050486, "uuid": "d069d2e6-57cb-48c5-8ed0-663a0a1056de", "comment": "Malware payload (ConnectWise)", "value": "7e0871edc17e502c04f5392e73d24fb7946ac2f2d6171773966f156f870ca1f74ff090453e74267cb2a6354c756d189a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050486, "uuid": "f3dd72e2-d5ff-40b4-9eee-231527cea54a", "value": "T1DA647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050486, "uuid": "c5df4e2f-88d1-46bb-84bb-f3ecfd223454", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050486, "uuid": "ef9705a2-2d27-46ef-aa3e-df63f6ba673d", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:B1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050486, "uuid": "ed194eb9-fde0-4381-a11e-bb634dfcfd87", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050486, "uuid": "58719415-8b5a-4b9c-9ba6-9746a097c2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050486, "uuid": "4b873a50-d785-4db2-8cf0-62cf8afb1923", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf350fa-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005765, "uuid": "f262d3d5-af06-4c09-84a7-69a097af06c7", "comment": "Malware payload", "value": "e616ccbdbe7415c040f26f193b1842c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005765, "uuid": "fc73b0de-a766-4ef3-94de-e6fe2f087779", "comment": "Malware payload", "value": "b6051439a1d74cdf5066fc1dca6e6a2acb4bd6bf81c115f0b18656ff381985b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005765, "uuid": "aff87a6a-01cb-4189-b51a-cee48a9b8569", "comment": "Malware payload", "value": "253bd7964824c4edbf7585030594351753da3aad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005765, "uuid": "03b2f4ba-1ed4-4a90-ab35-9258432508b6", "comment": "Malware payload", "value": "58d3b456eee730aa9e13897f68cf75fed1fe52ba3eb75866d0ab468f1c92f92f23abcca56edae01bd7b4b73503c3c963", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005765, "uuid": "a3bc42dc-807a-4211-af26-db3284bb6844", "value": "T182C27D956E867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005765, "uuid": "ec2e0d19-4e0b-4d30-be4e-eb320edd3190", "value": "768:Y8vCB+25j6es8RB29FYpMSUpi+20qUpi+20YQX:Y8l25JGd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005765, "uuid": "c2644b55-e575-442a-9406-ece212a9ffce", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005765, "uuid": "74f3a98c-9444-41a9-9cb8-ced87185dc1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005765, "uuid": "d435e9bd-a553-4c1b-ace0-bcef329c6385", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788762d6-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786034402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034402, "uuid": "d284f4d3-cb3e-4b21-897f-a448c5e43590", "comment": "Malware payload", "value": "952f92ec3d9086a8e62052c557094418", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034402, "uuid": "91b32bd4-2e9f-4b98-8965-0198f8be8be5", "comment": "Malware payload", "value": "b6642be009d6b9ac070d7c2b51fa4a0d598ec061d0cbf1ef6112f533d58a83c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034402, "uuid": "67897a3a-16ad-4bb1-ad39-dc576f7a424c", "comment": "Malware payload", "value": "49632b6099ee77cf11768eaed1969439acc0a0b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034402, "uuid": "cd80d8b2-266a-43bb-9514-924d6cfddd30", "comment": "Malware payload", "value": "40a923249c6ee13c7464ee2dfdf2ca39577b5a1a43b576f65a0b3fc03128ce7a9c101a5403a0c5166b4b92e0ad8debc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034402, "uuid": "4ca67138-927a-4b18-8861-79c37fc21590", "value": "T1C5158D5BB2F334FEC167C030879BCB635936F46601226D7B21849A352D93EA11B1AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034402, "uuid": "95d6aea4-f550-4d20-9803-1a5920000b88", "value": "12288:pyE/UEOmdDXjb3pRMe5tPO9DWHyy9bNwBefNLECMhDXucZA4Ey36d9:h/VO6DXj7pv5Q9kwiNoCs6U4y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034402, "uuid": "559a157d-c4cc-4fd2-bbaa-f1ae9d6a7416", "value": 911544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034402, "uuid": "483955cc-728d-44d0-8afd-62b961f57d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034402, "uuid": "617f8a44-bad6-4eff-99e5-9c269a5607e4", "value": "x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdacbfa6-916f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004560, "uuid": "030aad6f-52d3-429f-b05f-d8c63ae1e4a8", "comment": "Malware payload (Mirai)", "value": "a540287b1964244c769694b657b9414f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004560, "uuid": "d4c004fb-d8e7-4bf4-b05b-9b37cdb3ced4", "comment": "Malware payload (Mirai)", "value": "b67d082f6b969b0b4f5c5e0658b106478fd05607d2927ec7cece8abed5c85848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004560, "uuid": "3cdae800-7884-40df-9cf7-2b7e0dc6e0ca", "comment": "Malware payload (Mirai)", "value": "096fc7fabbd7e92415961e1dde2e645b75afe453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004560, "uuid": "8a2d9f2f-dda8-401f-9fcd-e72e03d73cda", "comment": "Malware payload (Mirai)", "value": "3bfc018ae50a23eec7235e9e6bdde58a1521ef2079995eb905b58e1649cf65b0a2893a3f4ec4f5dbccf69a4957a3c6d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004560, "uuid": "ebfa617b-d161-4521-a3d6-82f8f7039497", "value": "T13693129C72026A56C4BBC2B19BC803037EB30575F75A7908A10DE6EB8761E94F7892E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004560, "uuid": "17ff10c8-9d24-4ccf-a36c-70da5af98f90", "value": "1536:CX3LFFwngLNZp7TtWjqwzy5DwHKEB19AeCov2vnjFoaL8i3F7bpO4S++/WuVEWT:e3LFlLDp3YepDwHKETGeCoevnjFJAiJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004560, "uuid": "a8053a6a-015a-4877-9922-db053ef71694", "value": 94016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004560, "uuid": "8bf4ec7b-c8d3-4dd4-b401-be9e785dc521", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004560, "uuid": "c681b7a0-6e59-469b-a1b9-79ce3bd87574", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0b561d-918e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1786017634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017634, "uuid": "329c5072-295c-491a-86e0-34b66edc1f60", "comment": "Malware payload (CobaltStrike)", "value": "82155c301753f48474b18cba9a1c9389", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017634, "uuid": "16b897f6-2db3-4c77-9197-377cefc71145", "comment": "Malware payload (CobaltStrike)", "value": "b6d9f6a54c598edff79ce18b3ed4ee349134eaec2d9c012b7608829660e0880e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017634, "uuid": "d4f1fa2e-462e-43c5-bbaa-257638d82144", "comment": "Malware payload (CobaltStrike)", "value": "19cb0ab37e82443b98c52afb7f4438eca97ba0f8", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786017634, "uuid": "78763d9c-357f-405d-9d28-d40bb006113b", "comment": "Malware payload (CobaltStrike)", "value": "4e9f74a7c1b5568bcf70d2555278d363635a9125b845859690b9a23b67fc4cbd60840f49eeb03b1d6fd711cbf5e70105", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017634, "uuid": "97a9832d-d7ba-4fa3-87a5-87090c7656fe", "value": "T13FD46B66F6E688E9D17BC0B48A138776F570B8584374679707A4A6323F33BE05A3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017634, "uuid": "84bf423d-29fb-4228-ae92-c12c61fc6937", "value": "8e2c5139a9e2fb2ee2dc2f7e688799a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017634, "uuid": "a98a5fd5-334d-4907-9c2a-d9658e54a6ef", "value": "12288:86ERLooooooojjUXEoLqGvksvPeSrA7X4dD:zKXEtGsHV4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786017634, "uuid": "344131c8-a335-4d79-a7bd-6f35c14b6ec9", "value": 622257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786017634, "uuid": "164e9b75-2700-42a5-b54a-52fb5df1b511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786017634, "uuid": "6ca8f2a1-4ee9-41c1-9f02-7cb4c860269e", "value": "dbsql35_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e5223b-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040654, "uuid": "c450bfab-2caf-485d-92dc-bc025a613ef6", "comment": "Malware payload", "value": "ad94eaf0e86cca296d7c0139c8514a50", "object_relation": "md5", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040654, "uuid": "5d4c5f08-4a1a-44e9-b4c4-0da9e36a8f14", "comment": "Malware payload", "value": "b6e7ea96a21cdcca16033f260bb8b5b83315d072946bad7f6d93bda04fa98907", "object_relation": "sha256", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040654, "uuid": "777ab6aa-56b3-44a6-bd62-3178009a26e2", "comment": "Malware payload", "value": "bd3502b070e88fd054c1d485daf21024c054f2d1", "object_relation": "sha1", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040654, "uuid": "1fc2168c-3b04-4ee1-a995-717166462d57", "comment": "Malware payload", "value": "4da55970ac9fa72e7bea6a7bac7674f076a4ca3a3bcf01aac526c07e25b08668ce10fc95dd5fa26133d886c8f74b7328", "object_relation": "sha3-384", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040654, "uuid": "0a2217b6-8725-41ad-a89a-e240f3ca4233", "value": "T1E3119CE1A43094F7B14B3CE9BE2802E7D8630B6B86006CA17CDF8C28272C966955CF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040654, "uuid": "e5d8664a-c0db-4f9c-aae0-ebb5310742fb", "value": "24:GsPHza63jwIf/lOlGb2dzXxBABTSBDT2Nvy/FR:RPHzrlOlGb2dNBABOBn2NGFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040654, "uuid": "66d27ae0-1519-439d-a858-22388dbfb732", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040654, "uuid": "3ea8c4ba-9c17-4d58-a210-f71d98038ab1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040654, "uuid": "04a51eb9-7a93-47e7-96b3-bbd3f18b61aa", "value": "b6e7ea96a21cdcca16033f260bb8b5b83315d072946bad7f6d93bda04fa98907_from_104.156.150.223_redis_set.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e95327-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786005536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005536, "uuid": "fec13c3c-6352-4d66-b46a-5ecc6d6ba14c", "comment": "Malware payload (VIPKeylogger)", "value": "f0725c8ebbbbe37e01efb01e1972ba3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005536, "uuid": "c45fc059-91d2-4727-9c6a-aa77ee043fe0", "comment": "Malware payload (VIPKeylogger)", "value": "b728b4aafc56b68bcc8dd300cd155c65a586942fca65c84df573b03a5f24d6d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005536, "uuid": "c22150cf-0184-477b-90f2-16f0229369d0", "comment": "Malware payload (VIPKeylogger)", "value": "74bb178568f030c5f6b4a55155b7ab47f0c16b9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005536, "uuid": "0f5067ed-6606-4166-aeaf-f01be55f4f1b", "comment": "Malware payload (VIPKeylogger)", "value": "e3fb037e75d88b9daa3e068be686f3615d0d67eced140d4c7f118f6c5a5bef2485a89d56a69b7e77405b5037d9fac880", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005536, "uuid": "c5939739-7397-47a2-807d-2b9815a892e4", "value": "T1EFE5F6922B8492B27B20BFAD653ACE319A0EA01329D1DF10B15DE609371DD4F6358FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005536, "uuid": "ae474bdb-bd49-4fbe-a881-efd5c81aca37", "value": "49152:/5QHmKZGDLM9UeqvBhZuQm8TnWZWae8WVNntaz9irFHDlPtKc6ByXMWsu04xw+Ot:/56mKW8UeqvBuQm8TWsae8WVNntaz9iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005536, "uuid": "30ea8736-bb5d-4005-8cce-8f69b675fbb0", "value": 3065234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005536, "uuid": "c6d9d1a3-2625-4adb-8303-53cb0a13a9d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005536, "uuid": "951c6a38-ccfe-450c-bee8-389efac1327d", "value": "Documentos de embarque \u2013 BL e PL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b43914e-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786008959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008959, "uuid": "11c02700-4bb4-491d-8324-f6f03df5bc48", "comment": "Malware payload (Mirai)", "value": "3cb0e1861e58ee6eed5f20ae46940181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008959, "uuid": "7dad079c-c9fd-42a5-87eb-8f19828595e8", "comment": "Malware payload (Mirai)", "value": "b741e81dbe57b9162772caf66ef524eb5fd2c8d63ac4e8d179697fb28ee20113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008959, "uuid": "44644a72-9286-47c7-b4f0-352bb49acc1d", "comment": "Malware payload (Mirai)", "value": "90eb85b6015a2fc7c68d5459ce1359ba477770c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008959, "uuid": "2c50a560-43e9-4d2d-8d29-57c63be5148b", "comment": "Malware payload (Mirai)", "value": "47e4c0ca119943aad98aceb67b31c86c4cd47fd91d576344288486064df7712a2c38ca0ef988080d7ea1e96665baf8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008959, "uuid": "5f5c968f-17e7-4a49-b897-f2fc4227eb01", "value": "T10D9312ED1B4E0CFFC605E47912B1075D16BA25DFD828B8477D6012D6EE807F628C9EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008959, "uuid": "1ac25d38-2500-4eac-b229-80f63516b19e", "value": "1536:LKhom9RqHl37dDSfvICnydP8nIIZA1tJLP69sK+N+2tyIPZ4TOKmvIEZsJi0+2qI:6ohHZZD2kXP1td69sYcyc4TO6JdqfSVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008959, "uuid": "a93fb81a-632f-42f4-a790-00409584dc51", "value": 96236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008959, "uuid": "b91be9ad-4f24-48d7-a3c5-7d4b969f7db4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008959, "uuid": "a2bf57ea-c0b2-4380-ad2f-378016b3d324", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.11591.12976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dae6c9-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046316, "uuid": "bca8c1c4-870c-4aae-8274-58f6277799af", "comment": "Malware payload (Mirai)", "value": "15ec96457f125ad4e07b1ab00000dc5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046316, "uuid": "55c7bf9e-6d32-4c7b-a880-ad59321fb030", "comment": "Malware payload (Mirai)", "value": "b7c8c92cf356a62890250edfde4ed623f5cd31db333a8d89be9c89d67459f8dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046316, "uuid": "d7f269c1-a834-417f-b0f2-80a6be5b8f37", "comment": "Malware payload (Mirai)", "value": "d3ed0813e9844d192977721a7bdd45dc9ef12746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046316, "uuid": "7ee58bb0-63b3-4b85-aa6a-1ee8c65ce1b0", "comment": "Malware payload (Mirai)", "value": "12e70828743c072fd112bdb11366c200f34973bcb1fb02f9b76577c8d239b48dbe1c99f0f26ba80ccc5173d4e56d0054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046316, "uuid": "08eeda78-ddb5-4e3e-aeb9-c5dc1e41d5f9", "value": "T13B430137679EF674EBF49C31DA9F208DD06D7923719FAF4B4018B2AC1489905BC2178A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046316, "uuid": "046a1e52-7c20-4db4-955e-aeea94af206f", "value": "1536:Kw62TnCUv8Lp54zMneicgCT/FcOF9aibsbV6Basip:Kw64nlEL8ueitjwnLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046316, "uuid": "267f1d71-2435-4b33-8988-ab3a3daa89a4", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046316, "uuid": "9eeff9fe-5b19-4158-8d25-d42e1a5a262e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046316, "uuid": "90717f0e-4955-47ab-8014-e003bef57f18", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c57771-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786044994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "3b46d6dd-aa38-4273-bd67-0a30358b44a5", "comment": "Malware payload (Mirai)", "value": "41350b12fc4e7da666f205f435c55be5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "2ea43177-2e3f-4aac-b9db-c78f82d6f6f1", "comment": "Malware payload (Mirai)", "value": "b7f2adf5a225000a164f4905aabefeebe11c4c1d5bedff5e1fe8866c48dd70d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "13340ed3-fb4b-4bf9-8283-47027b56c429", "comment": "Malware payload (Mirai)", "value": "aa10c69e4c03240c5fcbc18f8a646a14090c6f73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044994, "uuid": "ed0e6c64-d6eb-443e-b177-fe0c07401d28", "comment": "Malware payload (Mirai)", "value": "0b1e4efb716483f76efa004aed947cb726fa6d6bab322858155f52a320be8cbd275187f0a4b0910dcc548e8333ce6794", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "295fbdaa-4ad8-4e9f-97f4-dabbd5fc70d2", "value": "T11B957C5BB7A2B8BDC517823187AF9B246B3AF03513026F3B218891343D17B945F16F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "e31815fd-7a2a-41a0-817d-67ccdd17d3fb", "value": "24576:6NjYUSUHejrUcKU2ccCCC2qukkkxOBsYFjPyGIbe/:2jYUSUHejgcKU984GjKGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044994, "uuid": "7b1fff4f-5cae-4a10-b424-1336bf1d1eab", "value": 1948896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044994, "uuid": "61240fd9-5d86-4b01-883b-791deb8552bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044994, "uuid": "79287b06-74a6-4019-afd8-3bdfc3c38a43", "value": "proot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f62b49-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "95d53030-7fcd-43d9-ae40-ef17b185c8d8", "comment": "Malware payload (Mirai)", "value": "894da3f6cb68d235f0aa44abe450cba4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "02376fb1-d5f7-4210-901b-451b43622b5b", "comment": "Malware payload (Mirai)", "value": "b7f805cb63ca9bf74a4900314af9fd67c2ae497c089aa59e315f6d4753419c50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "5b49b76b-40ea-436e-8490-8e1961e270ba", "comment": "Malware payload (Mirai)", "value": "ea17e20cf7cbac065eb4b59e8dd75649d39c1d1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030965, "uuid": "8358c3b5-cb2d-49c9-84ec-106b2d4f31b6", "comment": "Malware payload (Mirai)", "value": "07e09e8f2e163be7317fce64c8fae144da6e63e2c3c2c87bfc7a8f7f759d0be0b29fd971f26a265eb34be5746f7345de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "07fefe0d-e564-421c-a150-1cf07f26b218", "value": "T157257C6AA2A3B1BCD103C03057DBCEB25931B47512216EBF66C4DB353E65DE02329B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "7726ce85-8ba1-4aa9-8fba-46889b51b91a", "value": "24576:59UrMTDsFPHNd/vTJbRmQcNNWiFxcdv6rxPuCY1g:HjnNWrdv6NPup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030965, "uuid": "5ea2ba8f-8d64-4331-8053-c8ba5baee6dc", "value": 1039928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030965, "uuid": "6995d2a3-860b-4dd7-ae57-6633e7098a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030965, "uuid": "84dbb8db-6711-48ea-babb-9f9204d2e1fc", "value": "main_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55736e3e-91ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059254, "uuid": "7b39e523-dd4f-4e0c-afd4-16e421ab4649", "comment": "Malware payload (Mirai)", "value": "077b850a4ce4ed02c910dbc592cd77ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059254, "uuid": "0f53b4a9-ae25-4cec-8314-941c649a1cce", "comment": "Malware payload (Mirai)", "value": "b82828da08e4b971257f6091161f0dbcbd350e000f99bf40c967b7348e9045d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059254, "uuid": "3db84e5d-8494-4c7b-93f1-bab4ebb5e6e6", "comment": "Malware payload (Mirai)", "value": "24fdf07e42d5fd926c2233ca21b21e1222fbde26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059254, "uuid": "7463677d-0de6-42bb-9203-fdaf497d0639", "comment": "Malware payload (Mirai)", "value": "42eeb9cf10723e9daa5a9f59356baf2f5bdbe542b91f29eb941530ebc1409cf63b919a73064e2742ab50801fb4e9a4a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059254, "uuid": "f62050f0-8a3c-44fe-9a0d-6b4ca11cbca6", "value": "T138530274D4600D62F86215FCBAEAC1C6C396967E383D4FC25F98EEA43E706D992C14E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059254, "uuid": "476a38aa-6f0b-4327-b8a5-3d54ede7f952", "value": "1536:ACNyK0exfAxE1zTEbMOic4Wpeu+s40mqeC/nmjgxehqM4u+qgw0rG:Ay0yoimbMOb5LmYf8z4u+qgwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059254, "uuid": "4778ef77-de13-4e6a-9e75-10b53bf94e8b", "value": 65416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059254, "uuid": "b5bd4ada-f1d0-4978-bf31-3e710623b536", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059254, "uuid": "e79f7232-d288-4fe9-b2fa-1513df2659e4", "value": "b82828da08e4b971257f6091161f0dbcbd350e000f99bf40c967b7348e9045d4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb2f1d1-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786005389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005389, "uuid": "627b0258-910d-4683-9c2c-4f73fed02600", "comment": "Malware payload (XWorm)", "value": "f6e44e431c537108d9c5c270683e54da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005389, "uuid": "657aa454-37b6-4505-974b-be3202e08b57", "comment": "Malware payload (XWorm)", "value": "b859ddd19d5d8da1d50c62279c1b2a21d7ab51a7104571bff16d9329c9ac3d23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005389, "uuid": "95d99f2b-3556-4ebb-985f-883f8e23c1df", "comment": "Malware payload (XWorm)", "value": "537201f79fe352ced645426c0b4452b0216570de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005389, "uuid": "d1beb016-6841-4f16-b171-8900fc312c8d", "comment": "Malware payload (XWorm)", "value": "252f61fc43226a3092e23a6a9a6b8de731b5d910abacaa4036e82c83a11c1252ce98184aeb8d1ee94f87d9db2b075496", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005389, "uuid": "26f13507-632e-43e6-a717-8494e0c36f10", "value": "T1513534AE3EC6902495583323C95CA823B5BBCC9ED0A57B56F28C1ECB3DB187419E1D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005389, "uuid": "9b187c8f-1bdf-45e7-94cc-b288f685710c", "value": "96:qa5k/9gw6Z9MRTZ4L9I0Stc2nJop9jK10FjcdWyAbRa1nlRGpclv+oM1rjVpcmoy:qx/9gw6zMX4xMWeRCaukgb87qRrJ9su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005389, "uuid": "92a4e623-2cb6-4d91-a649-5299524deea9", "value": 1077745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005389, "uuid": "0a8c5cfe-da43-494a-b69a-02a1531d6656", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005389, "uuid": "f9dd583f-651d-4167-9577-19fbe74f24fa", "value": "Payment Slip-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41218051-91e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786056643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056643, "uuid": "df50ed09-7629-4c08-a969-7c1014d68bc1", "comment": "Malware payload", "value": "81e98b864789ad79176a464a7e1f7676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056643, "uuid": "276d7312-b0f4-49b0-985b-825b5fb0606a", "comment": "Malware payload", "value": "b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056643, "uuid": "bfeb4127-b4e0-43c6-8bed-bc26c8a508c9", "comment": "Malware payload", "value": "01a9fc496ffab7972d6a1a32adbefa8f9e2cec16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786056643, "uuid": "034e313a-65d0-40a3-b4e3-d7bf768341d3", "comment": "Malware payload", "value": "85737e77d161344d4356da5b45a33140f6b5e2645bc277b807b89d3494a2553d22bde9a031800976cbdd2c15c583f1d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056643, "uuid": "488478fe-a2c6-4e0a-85ae-e1f6864db2e6", "value": "T10AB733B3116541ECC99BDCBBE3176DF6B9F603234700787051BDAAC91F4A0A9E36B942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056643, "uuid": "6b8cd598-1a67-4fc3-9c8a-13e850638417", "value": "cd44d3dd99f5947904ffa3d6ca7a61a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056643, "uuid": "9a2b5461-aa37-454d-8b1c-ae2dd35dc81c", "value": "786432:3MD2hJ1MX2DpxgQ05RcvyiQjC+JSM2SqPn7BNEzzA7EQBHoJ8pRGa7GmlONBJhp+:cD2j1wcxd05MSjCSqzBNEvA7EQuWz7AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786056643, "uuid": "c1705742-75de-4375-96f8-a43f9588b9cd", "value": 50139136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786056643, "uuid": "5f3c9765-53ed-4daf-b968-f02bb09cb3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786056643, "uuid": "531cc5bf-426b-4079-bde8-bc0bc0f60f9a", "value": "SecuriteInfo.com.W32.FlyStudio.W.gen.Eldorado.647.26198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab593f4-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040955, "uuid": "803c245e-fe8f-40b1-85a6-4a1a5d2f21f7", "comment": "Malware payload", "value": "8301aab6462f9e249dc31dcf4ff3f579", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040955, "uuid": "33d632ec-b216-439c-af0d-4da858152c7a", "comment": "Malware payload", "value": "b8b59c631b54233aebe11516d0d9432979732a78b95854163c81e5c009a757cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040955, "uuid": "e046ca13-07e0-47e2-a08e-678cc7cadae6", "comment": "Malware payload", "value": "645a7213a48f5e48c5b2b761cf41be9e05891309", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040955, "uuid": "46e5134c-cf1e-4901-91a5-cfd9eb54f6e3", "comment": "Malware payload", "value": "32bb420c0d9b17a65d5ddf300fbb57ce6b67020537b7f3e3c088f8ad6624d6b047b3e52a461acb4e6d0ca53f2a830649", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040955, "uuid": "1ef4454d-d1bb-4f88-b0d9-cf6d629e1b15", "value": "T13625BFF875047DE6267F576BDA96ACED03B626239ACBA4CC806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040955, "uuid": "a00da3b7-df08-4b12-a84b-6536854c26f4", "value": "24576:RV5bYWwU7VaiST7UJBrGiXp09K7dyCZdou3EvIXfeEWBc:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040955, "uuid": "759334c9-d996-4ba0-9a5b-4377c158cc89", "value": 1030534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040955, "uuid": "f7844a20-efe1-41ba-9a97-07c76cb5d26a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040955, "uuid": "1bd029ce-7141-4cc1-96a5-d49261e252d9", "value": "client_carrier.ahk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81192fd1-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050308, "uuid": "eed91e36-1670-423c-bfff-78d7ef7302a0", "comment": "Malware payload (ConnectWise)", "value": "bab937bd0f559a42ebd338416f5ed99f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050308, "uuid": "35bbd30e-09c9-45c3-bcbb-4041f3496bca", "comment": "Malware payload (ConnectWise)", "value": "b8bec7b45605da355b092c9f3e40bab447928839d4eef5a9290cb5bb1dd50f2d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050308, "uuid": "81142fe1-0f7e-41b8-a7e7-4c974cda9789", "comment": "Malware payload (ConnectWise)", "value": "8ffcd01fed2d1735914475f51e33801fd13cceaf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050308, "uuid": "1f36299b-9292-4627-9c9d-7cde8c758cd8", "comment": "Malware payload (ConnectWise)", "value": "e5b225bc141a12b71b632c1a3c95bfdd98affd786f11831f166f8cd445ac1e630e445164ee3a3aebcbda2cebb58b2c31", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050308, "uuid": "272e9d87-dd71-4628-8ae9-75d342b292cd", "value": "T184647D11B9C48432C273383147B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050308, "uuid": "ab4c5496-ef59-4efb-8a1c-1af4fb3bbc6d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050308, "uuid": "2e67d5e8-f9f8-4d26-a1cf-18fa3e34a39d", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji98:h1iw7gryNkSV1hy1Z1u2JLu98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050308, "uuid": "bb829ae0-aae3-4f37-8991-42389162b0b5", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050308, "uuid": "6b687481-a96c-4b47-a675-2b0a1e2ace79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050308, "uuid": "57255cf9-c825-425e-9b30-b9fafd0f2d4b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d96b87-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "177e4f6a-a2e9-4c09-b5a1-c393a37b9888", "comment": "Malware payload (Mirai)", "value": "97cb0c84a75619b96727d163c40640a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "4af88753-a0eb-44d1-9987-2ce42981cd78", "comment": "Malware payload (Mirai)", "value": "b8fa1f90c3611a5f80dd2a16903698e41d2f69e425a70a20a710fccfcdcb4768", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "10e66487-3dfc-4f18-b7d5-4430a7aa3e6b", "comment": "Malware payload (Mirai)", "value": "1b07705d0e78317c6848baedabc5cd763bdafa41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050586, "uuid": "da861d55-20c7-42f4-a8ab-648b78f48b6f", "comment": "Malware payload (Mirai)", "value": "3c962e088c1e5f990b6f87975bf86b50ba977ba38df61cd68b9fc0ed448df53a8692445b82466bb3edcb15cae55c80c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "aaa9d10c-b73c-4c55-99ba-41e21b45f4c0", "value": "T12D2429027B0D0E07D1432DF4267B0BF14BABAD6138FAE681750AFEC957B1DB16449A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "cd5819d3-dc67-4b4b-afd9-d6f321e4752a", "value": "3072:JUEdJWfWs8a85rJ1dNWZMxB999ixFDNJrMh7X1jSgnGu4:JwW7a8tJoZMx/99izDN1MhZj74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050586, "uuid": "8709e55e-725f-43a2-ba17-a80dfb49361f", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050586, "uuid": "851607b3-a4c4-4500-bd2b-920581e8c222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050586, "uuid": "2aceadc4-9372-4fe0-8446-23ebd014ea45", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb48e44-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "315db8f5-5224-4918-9223-bda9c81c2cbd", "comment": "Malware payload (Mirai)", "value": "302e2531fc0b0deecc1eac67ec7ad2a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "12bbf431-1ba5-4635-9778-ac82410c57f2", "comment": "Malware payload (Mirai)", "value": "b90a3de329286c2b1d0e93ba98a18b5b210fe5e4ebe960d67aea771b086a3c54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "d16d3983-055a-4912-8c2b-cd186afb7d83", "comment": "Malware payload (Mirai)", "value": "9b19a7298b93e2c61d06301a66d857f9af488441", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "4b5b5a0e-cd97-4a67-b80a-b7b4fb3f3bd7", "comment": "Malware payload (Mirai)", "value": "0548b709422b53bbb4beb89a68a043412f7f54c912201becd7e3fc629700de2176b522872719d4126e3439da31b49cd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "36c7197f-5412-41dc-882b-0038155a454b", "value": "T13604B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "82337efe-2fab-4880-a7ba-cc681a9947ca", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2z:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045738, "uuid": "08821e54-3311-4f3e-82e5-a0c388eac0a4", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045738, "uuid": "dc1956e3-222e-43d1-939a-5714b6bae7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "a51161f5-7e48-43ac-8237-06a213ec6940", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299f1f8b-913c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982300, "uuid": "2e7afe6e-6063-4921-929c-df61f358579e", "comment": "Malware payload (Mirai)", "value": "c86cfcd5053349b4863b081ebceb57ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982300, "uuid": "b6e3f783-97c7-4ba2-aa7c-a34c1208f18c", "comment": "Malware payload (Mirai)", "value": "b913aed0a412dc14e3bd5570f8aa0bc2c04fdba0ab04a885e2b24638d25f2553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982300, "uuid": "2376cf1e-8f26-4514-84e4-839801767778", "comment": "Malware payload (Mirai)", "value": "95cec8d57a00eeae42fe7bbed02a85ef5e3ee28a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982300, "uuid": "fc06bcb0-b944-4d5e-8620-a47c65a2b878", "comment": "Malware payload (Mirai)", "value": "5316f2e9771eab274ca92a9f81464bd1ac74d7aab74c33721eb27f254f1de67d84371f14a34f35bbb3567cf32c1d0573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982300, "uuid": "6fc29bba-ab20-465d-9a78-5827b56cf49d", "value": "T1E7B3F855F880CB62C6D4267AFB4E428D33231B79D3ED3106CE14AF3567FA95A4B3A901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982300, "uuid": "b626f06d-4c54-4497-9f54-a14d4b8ee3c2", "value": "3072:/4hJ7xmHgbjdIqU3wWqIOItn/S1z1bqhrJS8aLEP:/4hpxmudIqU33q4tn/S1z1uf0EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982300, "uuid": "2da19bfc-4194-4abd-abed-a432678e4347", "value": 112160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982300, "uuid": "56ed909f-6d1b-43b8-a689-4e03d0a10faa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982300, "uuid": "61f92dad-d355-4168-a97e-08cddb6e835f", "value": "killbotx.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b7bf47-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994368, "uuid": "20ade389-c5c7-4132-ae95-fa1158faf49a", "comment": "Malware payload", "value": "e92a104470ec315fb5d66b6b41404033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994368, "uuid": "096a9a56-a606-47e3-ae91-bc6bcc310ba8", "comment": "Malware payload", "value": "b91767d614d1cdd20b573736eed9e61cb46ad46e73961a5b510de5e5055dcc91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994368, "uuid": "52734a74-0737-4561-b031-b098bbfe684f", "comment": "Malware payload", "value": "a4c8531b38d2d32ee0a8ce85842ec9a83067ad89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994368, "uuid": "ea8898af-a0ba-4af1-bb2b-53c54930c768", "comment": "Malware payload", "value": "bf77936734110aebaa65cd8ff029e67cf501a16c8916d0baa0574d8b6f23dbfc524578b5860b6fcc009d41483325e76b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994368, "uuid": "6fadb5b3-52fb-4ed5-a2ae-e81c996e8d22", "value": "T1A6A3B70E7E218FADF369823047F74E26A75923D627E1D685D19CD6001F6038E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994368, "uuid": "2f333702-fcc2-4779-88bd-c94d1d4922ce", "value": "1536:mVOO7z3NyA65PHtRElit8sxwZxRHv0ztuVNeQ2nqEsC3:mMOz6tHt1oXRHPNzC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994368, "uuid": "14418d39-cde5-464c-aef4-a197997c4663", "value": 101148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994368, "uuid": "04a5cc71-4c9f-4544-898b-bfde6124b375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994368, "uuid": "7a23f5f2-c66a-4e7e-8dc5-8e6698df0e16", "value": "lul.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef7cddd-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047995, "uuid": "c8d3839c-7099-4d9e-955c-9ce2dc3de610", "comment": "Malware payload (Mirai)", "value": "75e364bf9615cef7189b60d51658b5ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047995, "uuid": "378c35c1-d594-4279-894d-898d18c1cbef", "comment": "Malware payload (Mirai)", "value": "b9216ecc20864bcbd06d1707ac2dc90c7d0b673be59946f3cb28ab6713a8ae6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047995, "uuid": "6c4394f2-17e1-4e4a-957c-dc7da1aa2b85", "comment": "Malware payload (Mirai)", "value": "6ca9562a44bbfc5c1b4af39023de86a45a673124", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047995, "uuid": "375f43e1-2fcb-4b87-a26b-d03e76cb2424", "comment": "Malware payload (Mirai)", "value": "592dddfbc31d643d27fa0872c311ab484763cb668d26b56703e6d59cc0832a78f990dcd680bd031b150552c86a848744", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047995, "uuid": "9495b9e6-64b9-4941-9eb5-e515a22bcdb6", "value": "T1FC73025241E7D8CAE560D93FD878C1C36D1E5E78089F7CE8B463BE90EF842918425A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047995, "uuid": "5fcc1483-5b89-4700-a3a4-73e4c0736edb", "value": "1536:JCzZvOFMhtnjTCLfMBBYOqcK+kEO6izyyxPizzRzSOQR:4wFMhtjTQMDYUVkEi/PA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047995, "uuid": "88df5517-b2c0-4f88-8f5f-b52dfb1e13f8", "value": 74608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047995, "uuid": "74d8e934-32ba-445e-9bed-0968c4a2ba73", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047995, "uuid": "a9543785-8706-459e-a551-70c21b9de895", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb0af40-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045735, "uuid": "d43af7d7-6ae4-4ad8-9ba7-3a73d996fe35", "comment": "Malware payload (Mirai)", "value": "2c301a7fabad2933693c8d0d11fff453", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045735, "uuid": "12848194-f0ba-448c-b5dd-a8bc8477b6fc", "comment": "Malware payload (Mirai)", "value": "b9392780973629069e7c6c52998dd4cbb79d8b18d0efb83b2b73f88defeb135f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045735, "uuid": "6eb6a4ca-8809-4626-a571-b63339c5cdff", "comment": "Malware payload (Mirai)", "value": "c7398b131336bd5b5b48b5b120fd26692ed401e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045735, "uuid": "23e4d632-8535-48d7-8250-a2806cbd4c11", "comment": "Malware payload (Mirai)", "value": "9c8cb8b41442f187c3e64b1a50d09d82ce31f3733418c23cc73e39077e99cb9ac54e71760402ea070cfab45437c9d7d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045735, "uuid": "987d37b1-642f-4ac3-adca-51ebb708bf90", "value": "T1C893E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045735, "uuid": "783fe243-bbc3-47e0-abfa-8be3b60413df", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8Tn:8+tsCurVDN+ouw8Lyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045735, "uuid": "de615d1d-7a41-4ea4-b504-bfbe077eda4e", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045735, "uuid": "a3449f70-520a-48c5-a922-9d808a1fd825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045735, "uuid": "ef7c00de-1dd6-4a02-a040-90e833c02ff8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a9d54d-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "754b31ca-d5e7-490c-a62b-7597be550515", "comment": "Malware payload (Mirai)", "value": "6ee9aa914eea1ff463b7d9e613746a3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "8e61c293-31e2-46f5-a7a8-adea3bea499a", "comment": "Malware payload (Mirai)", "value": "b9735080d510c445d40bca028c9eff7a56fbf571f5b24e50511f4d71e3ed5d15", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "19bba87b-9fb1-4f9e-b09a-8ca0b42f83ec", "comment": "Malware payload (Mirai)", "value": "f7054f589a331019f4159278160d71828cab98ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "53a174f5-fe1a-4a4e-9856-ae9421c7777b", "comment": "Malware payload (Mirai)", "value": "acca1a9164369426f0a89e8c085ec6fe654f6a106de9097bd85e77fc67448359d387fa154321b4b992c98239421f4c12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "60fa0b56-b37e-47f6-8060-4aac616a4e5c", "value": "T1F1056C06EF810FEFC4AFCD30852E836B14DD899702C1AA75A1FC894CB69D6994FD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "b3207c8f-46cd-4e04-9a37-6d0b99b794bf", "value": "24576:9OzwfrhszV9fSmm4ZOhRZU7ysXXWk9kqBnlb:GV8m1mCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030963, "uuid": "29abfde1-59e8-4506-95ff-fded0036e5ec", "value": 861592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030963, "uuid": "abbe231f-b801-4d1a-8661-2e921cc6c558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "16055178-97ea-41a1-87dd-23ea27099f56", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fee201-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026901, "uuid": "3755c7d2-40b0-4f5f-9527-2781b7c3c6b5", "comment": "Malware payload (Formbook)", "value": "4623d6173759575088a063ffa5e309a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026901, "uuid": "ed79d929-2040-48de-9571-d7fbcccae0a1", "comment": "Malware payload (Formbook)", "value": "ba32aebc04dc365af12126586dabecfd34c70b3f60103410b6f0086761e3f42e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026901, "uuid": "3ef2a4bd-66e1-46fe-97dc-3890149daac5", "comment": "Malware payload (Formbook)", "value": "46013a3d089c3c683692e36cadff8093b2078af0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026901, "uuid": "e5748988-69d5-4108-a64d-6ff979cc3842", "comment": "Malware payload (Formbook)", "value": "d23d5e5171c4b526c67a2c437e992fd3eda69614e5b56b326b367f6a99245e27b3aba2f9a2d0bfb4b063be708e99e6de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026901, "uuid": "601c7694-96f1-4818-b663-0355b4bdcde4", "value": "T1CD25EACF6372091C648A7A0FC8386E9E7A9BCF830510FDB9BDA45947C50C74253A5B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026901, "uuid": "1d4300f9-5b63-4238-8e97-25e0304987e1", "value": "6144:XF3XR9WYdXpKIGu+oQ2qwIh05WqIT0yZ3iEVe8mnBa:Lz2Xbhm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026901, "uuid": "00db2d8c-78af-4f85-9d86-cef826ec6c5a", "value": 1028416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026901, "uuid": "3d6ae117-22a9-47a7-aded-27ec211cb336", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026901, "uuid": "1251b2a7-921c-4c1e-8b62-d48f2e29e017", "value": "ORDER_LIST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7161c88d-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786046845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046845, "uuid": "177b3277-d627-41c8-9aa5-ba0331cf88a1", "comment": "Malware payload", "value": "7f0e5f422dec2a152787e38f22851cd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046845, "uuid": "7dbb35d1-b444-4754-8d8a-7f412cd98a0e", "comment": "Malware payload", "value": "bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046845, "uuid": "9b9ca21c-6884-4aef-b706-faaca62b65c4", "comment": "Malware payload", "value": "2f9d82c69ed3f354cffb8337ed0fa886b14ee9dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046845, "uuid": "c1d89703-2393-492a-bf0e-ad4ca98ea895", "comment": "Malware payload", "value": "41c383cf7f9dba3439573062bba2dbd0c7cd7b4e065696dd910f629c79260773d1c4f17fdaa095642d4ea18173ea19a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046845, "uuid": "769fcb7b-1082-400e-a9ed-83fa971a42e3", "value": "T13F31058D22B17EB1CA4DCF05B0E542D4A247DDC4A2970AF2F4C21E6369D9F80BD55A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046845, "uuid": "f3b5f3b8-b9ef-4d62-93ac-30a587332217", "value": "12:Okfc0dt3NaKt6uODOmj9frTK1uk1YsVbNVb1LBeN04N0KvtqVe77zLBJC6wl7LXX:jfxXFGDzjJKAkrPM242MtjzTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046845, "uuid": "89b39103-c986-4bb6-9bae-c073e4c55ec5", "value": 1834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046845, "uuid": "b84018bb-d603-49a8-984e-a145ed496206", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046845, "uuid": "3fe2ab8a-3671-4e22-b5b5-e55f47e6df92", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70c19e0-9161-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998456, "uuid": "f3aabd21-2dff-4c48-a8e1-db654a648b77", "comment": "Malware payload (Mirai)", "value": "434a0f5c2511f50bb537e752b7bacdb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998456, "uuid": "a45af828-9f21-475f-abff-f419db3da37a", "comment": "Malware payload (Mirai)", "value": "baf4004008576db571fa03d8581169e5164da6842d026fa58e61fd1191fbdbaf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998456, "uuid": "c573bb6c-e766-45c2-a64d-89b861a5e0c5", "comment": "Malware payload (Mirai)", "value": "f88100193cf0126ee80c9f607ca6652499c78240", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998456, "uuid": "95e0f5d3-1345-4aa9-b3bc-4c65ca29ffee", "comment": "Malware payload (Mirai)", "value": "f431effcd1bc9ce63a7ea10606da2677728ee7e3f2145ed7ac2cf9003677d696f7dcf066cb4138e6fe3cfff212a24dfa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998456, "uuid": "06bf9ff3-f927-49f6-aa6b-8f4fb2d9a944", "value": "T1FCC08CF70A91700081C9ACA97257022E43A3863074B81F48F8D926A7CA8A940F818F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998456, "uuid": "938a624e-8914-4ebb-9d0b-9e7b3ca006f7", "value": "3:O22exARvUkZTK2Iq3FOdJ2GL9rSXUkZTK2IbBFS/TWUKT6VVI9LJdvvvF:O25sUktA2GLNSXUktQTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998456, "uuid": "1346298a-990b-414b-a09f-1c4a3a701045", "value": 160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998456, "uuid": "9cecae17-7c5a-4bb1-bdf4-b088a8023d71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998456, "uuid": "7a635955-54a3-4996-87f6-b021e5618288", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f4c0a5-9135-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785979363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979363, "uuid": "38e911f9-9011-44e3-889a-7d6211954c51", "comment": "Malware payload (Mirai)", "value": "ed84bd0ab44e13e943404cb57a085330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979363, "uuid": "eee92367-b6d4-4241-94fb-8a1b8e0d017b", "comment": "Malware payload (Mirai)", "value": "bb0cf0b3a99ce7331be0143e7a535bdcc5e881e6e64c39d256cf1f02fb620158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979363, "uuid": "a590c4b9-ce8a-47ac-98a6-3e0f4b1dd198", "comment": "Malware payload (Mirai)", "value": "d1ff4649d89bfd795ea0c854da577d67fbf0b47d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785979363, "uuid": "7a99d14b-f913-4283-acaa-3502458e194d", "comment": "Malware payload (Mirai)", "value": "054ee374d87ae9fa0578a183518d5ef529ec02897d4bdeaf36709f0c6b77b1799da52e7f2d4fbb696e9c503112eaec82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979363, "uuid": "8b7e6400-9d21-4a10-bf8f-ecd4daca1909", "value": "T183830A9AFD829B11D6C115FAFE1E928D7313077CE2DF72266E14AE20678746B0E3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979363, "uuid": "42097a24-607b-4625-a519-880aa3dc3e11", "value": "1536:GMn8H3TAYwaKnSAelVFDIziukioeowTlSOgx7QU5x5/YzcqoZ:eHDAYwaOX8ioeowTlSOgxv5xhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785979363, "uuid": "e731ba0d-04f8-4b9c-9de7-d9b47f9f3484", "value": 87444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785979363, "uuid": "ae4c4f72-9445-40c9-8ccf-04c48a66b97f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785979363, "uuid": "65095040-3fb4-4324-b280-b54df3284cf8", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541eff06-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005564, "uuid": "5295c45a-5a94-4a70-9297-48691932b2fd", "comment": "Malware payload", "value": "b0230ab93ebfdccc5fb4acd261ee659b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005564, "uuid": "12f21dcc-6b90-4665-b979-860ef0f826b3", "comment": "Malware payload", "value": "bc61b77dc2c45262f6b1fe9cf77c212b362cfe3da9be23958d4753a01fcab2d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005564, "uuid": "dc58d42d-9958-41dd-abdb-477536ed3a02", "comment": "Malware payload", "value": "a978bc0c7f70dad8a083cafa89c76a60b248caaa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005564, "uuid": "d62955a6-0392-4297-97a7-01126e0c5379", "comment": "Malware payload", "value": "ff7df7b8d4cc5902c2cbfe6575a8347153f34eb064822133051e3c88c449df7da390775ba832a416951f76e6b3644c5e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005564, "uuid": "e2fe62c3-8a67-49d2-be26-18be97c2af1d", "value": "T1C3575EF698F811F9E0FA881981C13FBB017FB6A764B1F3B383611B9529178A59F1160D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005564, "uuid": "b39d95ea-2aa5-433f-9b6f-f48a995bbb88", "value": "768:4X89qIqV2y9ZFZzMPR+HMCtX4q1UD15SNGMwe9+XkHLg+RdFs77Q0vuBnE/7KHcz:Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005564, "uuid": "2ff94a45-1668-46fc-98b5-78f24c04e097", "value": 27640590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005564, "uuid": "1455778d-a3a5-4918-a26f-0dee8a132ed5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005564, "uuid": "7ce93256-bb44-4fab-bb75-2c942aa36049", "value": "BA NK DET AILS FOR PAY MENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2de78b-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046464, "uuid": "482aab63-5210-4fac-84a7-7bfd8b575de1", "comment": "Malware payload (Mirai)", "value": "4a0d6f68e64fba32e75d6f3c82fcb107", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046464, "uuid": "b20076ad-f313-4e2b-8169-0a85be6373ea", "comment": "Malware payload (Mirai)", "value": "bc6de63163269552d4441cf0e4171dac35e6cde15592d092e090b8f17175b082", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046464, "uuid": "6a0500bd-507f-44a8-8fa7-51bcf5fc3614", "comment": "Malware payload (Mirai)", "value": "5f666dd38a61783e86a1326c505cdbb4cf58c431", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046464, "uuid": "2cac3679-c3d8-4f35-ae0e-0ad6b9197404", "comment": "Malware payload (Mirai)", "value": "7e973bfa6c1f7281b67815d44ad13ae55c22a97b6c8ebf0bb76424cfd06b44ea52b59dec4c67a385c41ba3e8438a04f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046464, "uuid": "80f4f113-fd83-4865-b42e-49eea6b6ca07", "value": "T1BEA43D8853E3D7CEF254E97003A26D1E6CB5073375E7A18BE26EB63303A719418ADD61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046464, "uuid": "7c5ba17f-ba02-445d-912b-9435fe2baf98", "value": "6144:obiFX1E5LTGP4p5HUj8BgVsXeNPp7w0AUn0on4HwHWq5X:obiVMLTHUHsXoW0J0on4Hw2q5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046464, "uuid": "507cd75f-ef7a-42ce-a027-8195b87bedbc", "value": 462952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046464, "uuid": "640e92b0-dcb5-4f21-a910-1c51743cbfb0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046464, "uuid": "88c48b06-e2b6-4bf0-b8b5-ced271100674", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5a4f9f-916d-11f1-bd95-42010a9c0009", "comment": "Malware payload (NWHStealer)", "timestamp": 1786003323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003323, "uuid": "f439ddef-8b45-4591-bb1d-0762d862ea4c", "comment": "Malware payload (NWHStealer)", "value": "400e745ed5f509e080b370b2509dc2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "NWHStealerbun", "colour": "#0DA66E", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003323, "uuid": "06c721d1-cae2-4477-96eb-eb1e8645faac", "comment": "Malware payload (NWHStealer)", "value": "bc8d75d9c7accde66c9245d519ccc001dea4ddeb863058a19d99e9a773018f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "NWHStealerbun", "colour": "#0DA66E", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003323, "uuid": "502f2357-6cdd-44cd-bf10-607c6e897075", "comment": "Malware payload (NWHStealer)", "value": "b671a845807a459c74e8f018cdea53b6fbc991de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "NWHStealerbun", "colour": "#0DA66E", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003323, "uuid": "5308ac9e-2aa6-412c-a0b5-063ccd957724", "comment": "Malware payload (NWHStealer)", "value": "a1ff65348cb3efcced0b4863d570e90c5cd9cb033d11d1bde3756d7e66d2272e961974c83f29cb2737a847573cdd720e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "NWHStealerbun", "colour": "#0DA66E", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003323, "uuid": "94cdfe42-3882-4a48-b204-a60983a66a6f", "value": "T103286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003323, "uuid": "c6747035-3846-4bbd-be34-2166d85ab1af", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003323, "uuid": "4b3d6672-6012-47a1-b78c-b1e5239829f5", "value": "1572864:XZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:XZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003323, "uuid": "e4224509-cccd-4d7e-8ca9-de5b9ae92601", "value": 97864704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003323, "uuid": "404d4790-6754-4dca-99b0-c3bb6993f9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003323, "uuid": "a4446db3-c99f-48a8-b7d8-fa838069198d", "value": "Vertex-Software.V1.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2debd5d-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005374, "uuid": "cf8945f6-2f63-46f7-bc33-bff8041041a0", "comment": "Malware payload (Formbook)", "value": "d9204250e9589ebb3806b6d3fe9797c6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005374, "uuid": "53e4d33c-9716-4812-9bf4-4f969b2c3b19", "comment": "Malware payload (Formbook)", "value": "bf2c84ab0b460c3a146e8176b580b3558bad4997f8e7c4a2292f824788b8fee9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005374, "uuid": "67b3e2bd-04e9-4abe-a628-297ed5581bcb", "comment": "Malware payload (Formbook)", "value": "847b06fc9d740edf265020211cfd56514a2b974d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005374, "uuid": "543a0616-e125-41d7-8b46-9c661d61250a", "comment": "Malware payload (Formbook)", "value": "da77983f4b44b56ca6b800451910b04599643fddd44ec65ec5f4883236ff72b35b94064f6104844c617f2e37dd0fbd8b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005374, "uuid": "7b3faf71-1ee7-417e-be2a-f2e310248095", "value": "T17A231843906AAD00C10DA3A9AB2D9F328F260C355A8D711AD74AD5977D331B0D2EDBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005374, "uuid": "86de27a6-5cf7-4142-a9e6-2a26993f6525", "value": "192:HZGZWQX4Bj0E9rjMXWFxTb7MWekeBQBLS7Z5F6q7N2lVTHkult+:UZQjiQn7uBQB2Z6q7sob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005374, "uuid": "28ecf42f-808a-4110-845a-43719bcdf7a2", "value": 46082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005374, "uuid": "6805bc42-2aa6-49dc-b447-922315efd654", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005374, "uuid": "0e63ef0e-586d-49c4-b5cb-564ace3c9513", "value": "funds transfer.pdf.lzh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cbed1d-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022150, "uuid": "78a8945f-d077-41b8-b95a-a6434abed24f", "comment": "Malware payload (Mirai)", "value": "cae18c577aee8930e690ee81a2b42fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022150, "uuid": "0f90d113-0006-48ec-af3e-60845805c7b2", "comment": "Malware payload (Mirai)", "value": "c05d9e7c066b34ff31758c1ef678050d6f54b96d2aa6ac14c38a018d7fc9ee42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022150, "uuid": "3d687d06-ca0c-41f6-88e1-505c1aa29934", "comment": "Malware payload (Mirai)", "value": "97fd696cc1922b69285528f092997f0a4a997e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022150, "uuid": "91f27c9d-04c9-4300-a201-319e5e3e1f06", "comment": "Malware payload (Mirai)", "value": "2e0c4ed08433b3012a7eac0792b542acd2cfdf5f1be7e122e87bd7dea5ac451cc4d1007401a1c4c4acaa77abeb01a50d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022150, "uuid": "e7435b88-ecd1-4fa8-94f9-5b867c0a6522", "value": "T18F932A4B660779C0F17001F4A7CE4BD13F2260DB6B3A5EB66C7912F2ABB318A1D1DA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022150, "uuid": "05906fd7-25c3-42b1-918b-070c7f110014", "value": "1536:MiOsaWNa9OR96b1lQ0vVsUOD4W//T4ygxUn5p5M/LW:MiOsakqisb1lHVsHDHsygxhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022150, "uuid": "678f2ba3-f5ee-48b1-b095-f176955030b3", "value": 91612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022150, "uuid": "67e1ffed-4e4d-4e32-b737-78f11cd12d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022150, "uuid": "1c923135-47c0-4fe1-91ba-11f9d2e851b9", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164ab1b0-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978402, "uuid": "e8ee0a4d-4e9a-4bad-8d27-090de6a675b7", "comment": "Malware payload (Mirai)", "value": "b9299214a9917ae17cb98ad84af534d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978402, "uuid": "dd533af3-fa16-4c82-9285-e79c10aef22f", "comment": "Malware payload (Mirai)", "value": "c092a870c7d18acedda48fdc36c4169770f0aea76be5f20d3d8ce5f3c2de2af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978402, "uuid": "7ea45e5e-2933-4dfd-84f2-8b8d0b12755b", "comment": "Malware payload (Mirai)", "value": "8dfaa6537250a3e07fbc795f33aec9031c19500e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978402, "uuid": "137c6baf-1f08-48c3-9fd7-d4f863a5462e", "comment": "Malware payload (Mirai)", "value": "c0f1bda58010852faad3e489427d1695ec58fa5ea5e61f1ad52d39742270f42f607ed5ac3909463aa9618b7662ba279e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978402, "uuid": "dde6af45-0f71-437d-bd8d-beed61354adb", "value": "T1A633F12F21ABABB0CD33A677A5178510C61470C27364C72344A896B50CF36E19BF6BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978402, "uuid": "8711209d-1b6d-4fc9-9247-0b7ae7129665", "value": "1536:0ekzrn/SHxscEGWSko20OJKxnQ/oxicE9rH+:0FzrQaHGVc0ZBNxicUH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978402, "uuid": "0436102a-4c0f-4c87-a7e1-413974f64411", "value": 53288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978402, "uuid": "1a09c4fb-c776-4829-8a50-679f6ab79928", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978402, "uuid": "3b6e00f4-33bd-4174-8ee8-12e9513745b6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b872a674-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785996284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996284, "uuid": "1b70715f-0497-442f-ac9c-477dab298bb7", "comment": "Malware payload (RemcosRAT)", "value": "34aaab4dc22edb16fa5297ef45795dbf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996284, "uuid": "12c546bf-8c92-4363-baf3-26e14e8e3314", "comment": "Malware payload (RemcosRAT)", "value": "c096d3606a939429c0ebd8e53ae76cb7c67fd2098848fd3b1af7af34ef332f8b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996284, "uuid": "bfb91941-1e2c-44e6-b97c-53b9dfcb3262", "comment": "Malware payload (RemcosRAT)", "value": "e2f05d9d4dc554222b224d1df3ce4a3dc4306f3f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996284, "uuid": "6f8cd2cb-5e95-4c9c-8752-408c73adb70f", "comment": "Malware payload (RemcosRAT)", "value": "475d56d71e8dbb8a6bf07e235730365b46d7789bd7e00c149e0b70cac1143e4cc3c38778485d504b8926348fbe5f0c82", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996284, "uuid": "55fee111-f0d5-448b-a747-f3a998b94aff", "value": "T192A40111FF818972E95257350BA371DAD615FC6BAF624A0F2381732AAC37AE0C931D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996284, "uuid": "7c8e34d3-f7df-4398-884d-f0d37fd6f3c0", "value": "12288:qCKPdwpw2F1J+RT/II8fp4rm4y+egBXRsdiO3/c:ZKQt1QRT/64rmeXOvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996284, "uuid": "c74e6699-bf47-4521-9c04-b742629c9b64", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996284, "uuid": "153a51d4-81e6-46ba-ba15-cc53d46e9b0c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996284, "uuid": "ba891484-b67c-4b1e-8975-80f8cd7fb193", "value": "AMBQNKGLOBAL_PRODUCT_LIST 2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09a9d54-91ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058950, "uuid": "dce10935-3d6d-47c5-9112-56260a17c5b7", "comment": "Malware payload (Mirai)", "value": "c008831ee8d964466cf890457726841c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058950, "uuid": "e3948106-a4da-48b4-819c-2405b2f67d1e", "comment": "Malware payload (Mirai)", "value": "c0e6f1d6af634fab562853ba2cd3e20c4b75e5a5a424f9a39bb464fb8ee695e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058950, "uuid": "d9b2fc66-af2e-4276-891e-19918eaa6208", "comment": "Malware payload (Mirai)", "value": "c5004f26a06d228ac87810942878bb892cc49708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058950, "uuid": "55a092ca-8124-4832-9533-24a29b498975", "comment": "Malware payload (Mirai)", "value": "5a4c7b36223baac4eb2b0b409ece039c2316a5e5db56b26662b3e950c7b8ea988276134e93a9b1db1048cfc06ee8032f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058950, "uuid": "c960c444-6699-46b5-9981-ffb33ddd33b4", "value": "T1E843026E4E5AE936E9BE0836E73A47002522EE22D075733B650C8144DFA61CDD4FD6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058950, "uuid": "e9756aa4-54ac-4685-8389-0b28bc6ea286", "value": "768:bTckj2H6CqS8jo9M3sVj3bUzl7L3YXMtVaQsGfNsf3uSHY/rhPC3Gq3U03wfSl:bwM2aCv19M3k3Uz1iMDaQsGfC3uSyf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058950, "uuid": "643f8648-0730-44ab-b7ce-b63fcddbee68", "value": 56484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058950, "uuid": "3d0ef41c-5b39-4ec8-a758-ef73530df026", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058950, "uuid": "b159ef67-5fb6-4082-ab43-2d266a3664d5", "value": "c0e6f1d6af634fab562853ba2cd3e20c4b75e5a5a424f9a39bb464fb8ee695e8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d21547-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057796, "uuid": "c44bf189-5cbc-47ed-9afc-c024c5e04e57", "comment": "Malware payload (Mirai)", "value": "b8caa0a244ae61d98cd412a7e6e0bcdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057796, "uuid": "85826605-f1a9-421c-a1cb-e40e129fceed", "comment": "Malware payload (Mirai)", "value": "c151368e6297fcd311f548fe124e6e41b7c14986465bc558b8ebc69e9265b26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057796, "uuid": "a3c91b0f-197b-4e9c-8e78-6106eecb0bb3", "comment": "Malware payload (Mirai)", "value": "2ab569b71e8285dbf74060d4bd4374000bed38b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057796, "uuid": "df57330a-3122-43ea-b9d6-deb0a492b57a", "comment": "Malware payload (Mirai)", "value": "01085256ba327997e2562eabc3261cd116b23d35ae0b24c1cd169eca3dd826cf29001b7e785fb582535973559146c8b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057796, "uuid": "27c8e171-bae5-4a3e-a953-97503c86c55b", "value": "T1CA5301599DF28F9AC747047A14FCFC590416F58DEA9CAF8F8418B25759132E0B88CE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057796, "uuid": "70d3a0a1-0dce-40c6-961c-f77bdf832d44", "value": "1536:KwWzIeB8WvAIdPPrTt5JCI+CEgJ2LuxYvKMxmIO+5iWQtwnouy8DMw:1W8eBVvA0PPrFCmEOCuCJ3OF4outDMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057796, "uuid": "03eff433-6fb3-4e36-84e2-0266cdad4f2b", "value": 62204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057796, "uuid": "107a5f94-5b3b-4d2c-8ca4-70df1c763e11", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057796, "uuid": "1b56f732-1389-4416-afab-e00a63b2a1b1", "value": "c151368e6297fcd311f548fe124e6e41b7c14986465bc558b8ebc69e9265b26c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33185eed-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996060, "uuid": "3d43bc2d-b5f9-4045-92b3-51073dbb764f", "comment": "Malware payload (Mirai)", "value": "445027feff52eaa4b550365f65504ec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996060, "uuid": "0795737c-8dbd-4f24-918a-9c486f18250a", "comment": "Malware payload (Mirai)", "value": "c1cff30facdb9622d4ed98ca8755da69989c35910980a8cfe988041ff0882b7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996060, "uuid": "3a5695d6-abe0-43f3-8634-363225a03986", "comment": "Malware payload (Mirai)", "value": "05003054d2695e668af0414006ec07b81a300243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996060, "uuid": "6ac425b5-27ca-4ade-aa07-1ae17af80123", "comment": "Malware payload (Mirai)", "value": "7bb93dc5a5deedaeed0aae529844e226f14bc8c363ad8c5072092adb8777e53e80c9686198113e7d7f6afe7ef12bc4ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996060, "uuid": "708ab676-546b-41a4-8659-dfdaab6736d9", "value": "T1F75301F7B394F2BACAE980F6645D1ECEF360050129D6CA4B995D35FC98124C02BC9B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996060, "uuid": "8124276f-6eeb-4988-a861-342a7b9c0c05", "value": "1536:oyQu51P75hD3uWiHRqXKBRlfzreYriiiPeV7rUM6Pv:0U/zCbzreH34I7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996060, "uuid": "156d1535-f65c-42c3-be15-fcf3cc36cb53", "value": 66652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996060, "uuid": "5896f43f-8bdb-4322-8dc3-caea06bfe8e9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996060, "uuid": "85b02519-d23d-4a5d-a962-2f35c54fefa0", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2cd2f4-913d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982898, "uuid": "003ac47b-a420-48d2-a458-52f6e77e1509", "comment": "Malware payload (Mirai)", "value": "c96dea4d6e78c458589c4ce72beab084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982898, "uuid": "caf5b961-26e4-49b9-9f85-21776c3bc9f1", "comment": "Malware payload (Mirai)", "value": "c208a7a095ef6247c309165af0230c0ef8ab9709bd362b29258cff68f58f839d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982898, "uuid": "4bab0b1f-4560-4b5c-9e10-8844e4ef0f79", "comment": "Malware payload (Mirai)", "value": "a03aa93e7976eaa64f766ba901ef8edf0458b8d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982898, "uuid": "39f9ed78-8b57-4e1f-8de9-29cf31e618ca", "comment": "Malware payload (Mirai)", "value": "6f87230bccdb6b48af99022e93c94e95635b26396ea0fc935aac34a23de11522772688f03e38fb8bfb24bd14cb46c5c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982898, "uuid": "716bf0d5-6c16-4fd5-94f1-6fbb83e178a8", "value": "T1D8932996F8818B12C5D512BAFA1E118D332717F8E3DE72229E206F247BC692B0D77D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982898, "uuid": "3c6c5831-d67e-4fab-bf79-c292b2104ce4", "value": "1536:74nP611KQoKr8gM1rrZl/ge7V8wSygWapTPkUInPOMRivdg8vQ58YQ6x:Tvr8Brll1WygWap+qdgOQeWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982898, "uuid": "dcb2c177-ccff-422a-965b-18f617bcb617", "value": 95620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982898, "uuid": "329cfc31-ab40-44e8-a5df-5accde37daa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982898, "uuid": "49913bf8-700d-4fe7-998c-d3d22cc7074d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20277004-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "5d24b3f7-ba87-49cb-b778-17964b3edbf9", "comment": "Malware payload", "value": "905a764f478014db4a211b25ac23170f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "5d69d273-cb14-49f8-8460-d6cd943f0f5f", "comment": "Malware payload", "value": "c21fa4c1d6ed5342e49ef0561cc566a2cbe06a83f6298374fe9cb4f8027b6911", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "bb05deba-4822-4e97-a1c1-5b861279f571", "comment": "Malware payload", "value": "e354b893f73f424624387a67da1575ea52eb62d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044991, "uuid": "b9fb07f1-2b8e-4b3e-876a-e8ec9dcb7755", "comment": "Malware payload", "value": "1523662509c2b775cac345c6d230e15f5df5d6b5e9871c7f78583a0749c8a3fb44b3c2762ae3f89f32ac5d6d466c699e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "77a0abb3-6125-423e-9b9a-2e4148284f2c", "value": "T1A7C58D07F97244ECDA7ACC7CC64ED973E625B499416136273BD49B102F2AE10AF0D7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "8c3ddaa1-27cf-4822-af08-62bad4a11190", "value": "49152:6wzt12U+Ii5tAGYvBFAMTrZaFuiuQzwIU6iXx8K:tvGpCFaMh6P+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044991, "uuid": "c6abefd6-c861-422b-945b-e02d59fd7c8f", "value": 2704663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044991, "uuid": "019f190b-6211-46db-b230-b12b75eeecbe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044991, "uuid": "3a5994ab-f77b-4fb9-8768-f5951d2ee7bf", "value": "cli", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c4eab3-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021989, "uuid": "6f4b200e-9e48-4575-a2c5-86c51c79cea8", "comment": "Malware payload (Mirai)", "value": "f1e8649141130cd1b2d9768a2b690caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021989, "uuid": "bcfbac85-11b4-41b6-ab0f-30e6adf637a2", "comment": "Malware payload (Mirai)", "value": "c26f9ff29660f2a7ddac08f331e32745a8cd5d6ace666188323bb68013b86099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021989, "uuid": "905ee29f-6ae6-4b09-9bd7-391c557287ff", "comment": "Malware payload (Mirai)", "value": "0dadaf200d248a55fca2bb08b793698d516810f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021989, "uuid": "31c08b5f-c9b1-4840-987f-f7e10768b229", "comment": "Malware payload (Mirai)", "value": "391a0a3d80c3a037d3aaac9164063114e77e6e55e530ecc40c115eaa6835d31da2678385d98b97f029fbc0cd11dae86d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021989, "uuid": "c5930a87-711d-4687-983f-743e8e8b5c4c", "value": "T17043879173079A6FFC6A47705AF689F0B3D87DE6387096A6E326BB4C0F310995D089C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021989, "uuid": "71f77e5d-7de3-4be7-8bc8-72c09e455621", "value": "1536:Jl/HIiXgFjtEt7Ul8f6tAd4W+ZXFvnInWPbRGWkbUOZFc73oHvf3HXB+SvcQIKWq:Jl/oX+4OWPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021989, "uuid": "88c94478-fc1f-4695-9675-6fb3dfc2bead", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021989, "uuid": "98dfb3cd-efeb-43b8-a62b-1ddd16dd2f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021989, "uuid": "938bd5a3-bf3c-4f34-848d-b6219b7f55fc", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a90bbb-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994672, "uuid": "6730fc78-7484-4a91-a054-f493f7bffd5f", "comment": "Malware payload", "value": "d96f9485af2a73cc4be3c256b951decd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994672, "uuid": "a7d39a09-bf86-4d0d-ad1d-1ef0c723e91d", "comment": "Malware payload", "value": "c28eb9a5b01d930867774201699ee99beb57e66316fc94831822afbd14ca2624", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994672, "uuid": "ea212df8-91fe-499f-bca6-1ae5e4ce4698", "comment": "Malware payload", "value": "141d70acf5ce9f0804d8860ece3772ded2baf656", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994672, "uuid": "b15589b6-e80d-41e3-ab40-09ce3f4bf7e4", "comment": "Malware payload", "value": "9811fcf324d4bb02058f7af7333c3a51d322570570d57f3579ee574b76ffd108eb11d8aa99cd5df351ca21a2866ca9ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994672, "uuid": "ccd7ff70-967f-43d9-b044-ab7565724721", "value": "T15F856C13B389B93AE06B0E3A4927E544983FFB716906CC07A7E4094C8E3D5546E3E6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994672, "uuid": "04a9e304-2257-432f-8e4f-c71b2327b38d", "value": "1f365d4e2c37b47fb208b089b5f61d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994672, "uuid": "0dd6e2f6-deea-482b-acd2-3367d20db214", "value": "24576:17zJjP252w/6rutl+fbfUpTQ2GlQu1dAcFQU2:Flxc+f+U26DAcaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994672, "uuid": "e9bfb6cd-bcfa-4e75-a1f0-f08d5b430d06", "value": 1809920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994672, "uuid": "1c738bd7-a355-46a3-a584-2ff99788c192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994672, "uuid": "f49bb6ea-9692-4412-8022-79ffbe927cc1", "value": "d96f9485af2a73cc4be3c256b951decd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe46cdef-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022171, "uuid": "9ef4ada4-4e27-4527-a5db-6e609c3784a5", "comment": "Malware payload (Mirai)", "value": "fe88abf817573afdf3782cd06f196890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022171, "uuid": "dd0c25a1-b2ed-47d2-94b1-dad7e204166f", "comment": "Malware payload (Mirai)", "value": "c2b48bfc06814d4f60b56e0dc441e6f536e2cbd7efb2dc393f34393d90970167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022171, "uuid": "741347b8-6283-4993-a8fc-528ee75d4fef", "comment": "Malware payload (Mirai)", "value": "f0f75d26715f459f42c837f0532345e1900bcd51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022171, "uuid": "e29b015d-8a3a-481b-a99a-b543e390aaa0", "comment": "Malware payload (Mirai)", "value": "9617e6fcaf24141f1a765cc58ab1dac058ca773a9bdeb2c2edd967a62257c8e62df8dcba955868bfa2c867cad30d7c14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022171, "uuid": "419312ee-4231-48e2-a1d1-da5b28c87ab9", "value": "T100C3B3576A16187EF4B203B105DECAF83E23A2F792770D16682B1DED5F13E959E060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022171, "uuid": "bbee0e08-0377-4789-917e-437f01368c61", "value": "1536:jjJahji7RPr9fcT3jkJwQb9+lj2Un5p5M/LW1RCyd9qDNbwM:jjJa9+N9MjkJt4lj2hq1Rx9qSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022171, "uuid": "6d432e20-380c-42b9-8491-1585c5d34492", "value": 126548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022171, "uuid": "49f5c581-86d9-40c7-a00e-1c08a7bb18aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022171, "uuid": "50de3d46-4759-4253-afec-347fef94e118", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d61d88-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786005430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005430, "uuid": "b957832f-d12a-4e43-a759-e989e0516639", "comment": "Malware payload (Formbook)", "value": "9e0f49bf7d8e39f472c7f1467561c18e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005430, "uuid": "63ec1b90-04d4-46c0-929e-650efa3f20c6", "comment": "Malware payload (Formbook)", "value": "c2eda59b5a04a3c09e89c72c802f2afb671cd7d1de0bcfe92f242e50540ac487", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005430, "uuid": "8eae7c96-9b01-4b53-b323-17b33b6d2300", "comment": "Malware payload (Formbook)", "value": "020064be38ffa233fdf1db838c84ce8b8736449a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005430, "uuid": "1b5aead7-f808-40d9-92c9-5602e1a3ddd6", "comment": "Malware payload (Formbook)", "value": "7de6cb9d72c21c70de006543ead55919b3fbc51435ebf3a72acfe164b30faaf3db9b3a426de71bce7391dc78ad6955fa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005430, "uuid": "20b244f0-ee37-4bb0-a5d8-8d37f78467a1", "value": "T1EB258E7575006AAD90E8E2B64B5EA24C33D302984EC885435CF6F4E61D7F29FFBB4858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005430, "uuid": "dca48839-c9d9-43cb-89d8-ab3672f9b130", "value": "12288:2o/pKhFhEwixX/n9iMlbUcx0/No/u3PGiBBl03H9SVSzb8EWIuZN4bEA2/:VJw29ilN0u33T0dH/rYA2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005430, "uuid": "c8f7d0e0-6bff-4ec6-b30d-6006267e85e5", "value": 989845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005430, "uuid": "89ab08f4-2b18-4d1d-b346-6f423082a8f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005430, "uuid": "bcab7a61-11e9-4baa-ab95-f050ecb3e2f8", "value": "COTIZACI\u00d3N_623.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5c5650-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021976, "uuid": "9a01f825-9070-4deb-8f09-e7a73f4abec9", "comment": "Malware payload (Mirai)", "value": "4b34a10e3644dbd0600d1bac3ecc9f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021976, "uuid": "83daf0e9-7d5b-4f76-bef6-301047774406", "comment": "Malware payload (Mirai)", "value": "c303427198210a7326fc46db3cf4518d8891b785cb7ee73e068da25192d393cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021976, "uuid": "4615dc0b-81bc-40be-acf1-504e2d8b810a", "comment": "Malware payload (Mirai)", "value": "c9904520ea239c700eaa3b3a0653df2cbb96a515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021976, "uuid": "40386e53-ac16-4033-aacb-03d53a5151cb", "comment": "Malware payload (Mirai)", "value": "e63e3a38e188b16cfe89bf71779a22364c58941620d7663c935ae0fe93f29b9fd5a63c157dc8b0461d68cb1a399678a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021976, "uuid": "6fc2538a-4e71-442f-8a7d-a2e9f51f0dff", "value": "T11023E694F9049B29C6D074BAFA5E42DD33130FACE1E67111DE21AB313BF79194A37A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021976, "uuid": "59eb674c-6f2b-4c3f-8732-4a29396ad3ee", "value": "768:Lng/mtynprEwVx65swLlaMLdsqhvr9hhTLj98/w2CW+TtisOxO+OqOWD+UQaNOPe:Lng+tynVEwVxyswLlRpsqDtvj9J2z+p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021976, "uuid": "460600c6-cb6c-4be1-9a82-194320b4f9c2", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021976, "uuid": "95e2d854-d478-4cbf-90bf-01d6cb9181fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021976, "uuid": "4725dd04-d53f-4125-b5cd-0ec1abdd281b", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3eda48-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005716, "uuid": "5968d064-0ac1-4096-a507-583774e63a43", "comment": "Malware payload (AgentTesla)", "value": "a226b9eb8d7822e44d7405db3933d7c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005716, "uuid": "7c11fcf4-7acb-459c-870c-d7c921578695", "comment": "Malware payload (AgentTesla)", "value": "c35c2d9570c711b9ebe4f1c4a2cab566b723ff7915179ae029a82653b69a237b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005716, "uuid": "6d665cd6-9e3f-460a-b05a-be65ea6334b7", "comment": "Malware payload (AgentTesla)", "value": "5210a64f4bd469de123f08f064143f42ef5bd5f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005716, "uuid": "8fe03bdd-9c9f-4fe4-9f2e-3deb2efa9f9b", "comment": "Malware payload (AgentTesla)", "value": "912033d4910fbdc20902a1622972922def4d53053aeee7d43183bd0400e324618bec0b687659d7bed23b468ee269e438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005716, "uuid": "45ab7d0a-102d-4c70-9ee8-43c79c9db749", "value": "T1CF15BE86C25994278E462D42D3D7DAC87F39383E1226D3E315CEB2EA8CE5850FADD351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005716, "uuid": "bd9d95df-1e8f-4adf-b374-abe9be2ff0ed", "value": "768:f/OPu5DYb66yrATivhLAT7nQ9MzOjpPPks9WnFYzrA4jU9akfbI6kFLV1ckO7OyH:36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005716, "uuid": "e755c0a8-0175-4fc6-b987-4c8f97db554a", "value": 946186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005716, "uuid": "71b8545e-9261-42e7-84d6-95db891857cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005716, "uuid": "d6b311e7-29ff-47cd-a4fc-03769c933321", "value": "Copia de confirmacion de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34da378e-9164-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785999499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999499, "uuid": "9dddec92-a717-4f59-a320-ea97f0ab0e02", "comment": "Malware payload (RemcosRAT)", "value": "a217724e7fa32e04a809ba07935a2b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999499, "uuid": "d70b331b-0cd7-4285-8714-bd96f4d54977", "comment": "Malware payload (RemcosRAT)", "value": "c367627e55bb3bc8289d4610a4e1f9787a70475550d0eaea04d5a5aef7982453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999499, "uuid": "42a1f8e2-8327-4932-9e4e-a3fa7a213f52", "comment": "Malware payload (RemcosRAT)", "value": "2fbbe193e547f93db774bb8f11d22a1d098d712b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785999499, "uuid": "e359ba05-4bd7-4df6-8b4a-28a28be2cc2b", "comment": "Malware payload (RemcosRAT)", "value": "0f723822794c517d5e96f02bf3da11abbadef34867d017b83e0f141abfc5b75858891780a3c93dba6b07de10fba095a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999499, "uuid": "1b699ca8-e9dd-4f85-8e9e-e71b83e096d2", "value": "T142D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999499, "uuid": "1379a63f-8631-4833-a055-6b5666cf3094", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999499, "uuid": "05ed558f-9fc5-4b4e-8b14-6f38af0f562d", "value": "12288:YZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:eQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785999499, "uuid": "90ce192b-ce1c-422d-a93b-064bb6707a3d", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785999499, "uuid": "5058c9d4-8671-4f1b-99b2-6c6dd78275f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785999499, "uuid": "12ed9a6e-94c5-4c0a-aa3b-bd7bbfd25491", "value": "SecuriteInfo.com.BackDoor.Remcos.716.6384.21530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae1869c-9199-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022299, "uuid": "292d9e98-42d1-406a-8719-879ab1564fd2", "comment": "Malware payload (Mirai)", "value": "1bdd02127146d23881096be98f98424b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022299, "uuid": "1cb78731-68ca-41d4-be20-d27bbdcb791f", "comment": "Malware payload (Mirai)", "value": "c3af80ab3698a8af577c11ab1b41132e16cecc19d67c8dd7051236dc6bc2cf88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022299, "uuid": "d1e07768-5e4a-4f21-ae52-cb9cea308738", "comment": "Malware payload (Mirai)", "value": "5d9cdae8f83b77bec119c191279b8024f08042ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022299, "uuid": "611d1dd8-0160-48ff-a602-5413ca198213", "comment": "Malware payload (Mirai)", "value": "3f78f59aa3475a41b54af1a2e2d9cb5404ab88035450d93823ef1d8c61f4ebae6865660cd6984ad5790e432c73294dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022299, "uuid": "94c2eb67-be3f-4686-8767-5d6b3209bcff", "value": "T14D030A46EA519B06C5D232BEFB8D414E37136F68E7FE32359A306FE013825E70A35525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022299, "uuid": "02d9bc4e-b9f2-4705-941b-e96d535a6aae", "value": "768:1F5nTVY9TWPiuAlMLokZqDZmO0J0M4VCi6jtgnw04+aVswM/:f5nTVY9TWPiu0MLo8qYniMhi6jGnw0SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022299, "uuid": "94071611-9c08-48bb-a03c-7c361f652c8a", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022299, "uuid": "edff7c06-57f3-40c4-929e-d9cc92dd2573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022299, "uuid": "0f34a870-db34-4618-b447-cf0679f50d2f", "value": "main.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22b51a8-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040189, "uuid": "f3aab088-7ec6-4e81-9fa5-a78d105458df", "comment": "Malware payload (Mirai)", "value": "ae18735d753a10b6bcd24892425af27e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040189, "uuid": "17d9fef8-1cd0-47a1-809a-0b8da173352f", "comment": "Malware payload (Mirai)", "value": "c41b6c596c078c6d6519abab2ba53038761c9f436d62116e20be679fdfef19b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040189, "uuid": "1bb81f3d-b54a-4454-9967-3277efd9688e", "comment": "Malware payload (Mirai)", "value": "47437a69522e3f999b49c542bc994e6e800290cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040189, "uuid": "d595d1bf-d896-47a8-b32c-bbf00f926b2f", "comment": "Malware payload (Mirai)", "value": "5370bfd164471bc5f6eaf9bc4fa4860f8585cfe18f1fce0ade1b665478101a7e3a82bf9dbb96d9329762f87256cfdb6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040189, "uuid": "3db95f2c-125a-4854-a23e-ee086e185b52", "value": "T1DB44D047738B458CC46046F607D77BFE6E1366284D53FBEE2D29A13736A62DB200A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040189, "uuid": "6ee854b9-7180-47c7-9f04-718a4bba9a3d", "value": "6144:wJlKeEjtGLpQgRf+rtlUbLhbJjmsefMySq:wHStGfoPURbJyseUyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040189, "uuid": "05afbb75-6041-408c-aa8e-bb63769028fc", "value": 263840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040189, "uuid": "0a19b607-c96b-4cc2-b4c3-fcdfa8cd12a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040189, "uuid": "c4b3c93f-23d8-4807-8111-47ab7b602e4a", "value": "pope.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755fe922-9150-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785991017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991017, "uuid": "0a64c6a0-9d75-4f7f-8eb6-7e39b5988a49", "comment": "Malware payload", "value": "2e36f0569c71a08a9474e128ee55e5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991017, "uuid": "6234a47d-0268-42a6-9ce4-0772da3c24ed", "comment": "Malware payload", "value": "c50a87694eeca686259619a4495fc92eac15b6c45aeed8ae7d729b7886a9375a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991017, "uuid": "825f9c36-807c-4692-ab94-944008789500", "comment": "Malware payload", "value": "723d8a2e19e18c98a5a142992ea0dbae5dd084d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785991017, "uuid": "b2ab0506-4c20-4d97-81f6-1f4270044384", "comment": "Malware payload", "value": "e396be17c65b65001247718a8952d3d6c1273e6ed347f9ad87117cc53ad84ff03376f27262185147a62a651794f73c75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991017, "uuid": "84cd67ca-ff7c-4e26-9d71-ff1d53c7e909", "value": "T1CD764911FACB04F6E5035E3155BBA26F27311D068B24EBD3EB44BE29FD77A951832209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991017, "uuid": "6b55e280-881c-4b4e-941b-6118d4be30a9", "value": "49152:+gC1Ym3dSWJO7crqUf4wj5CxYlTWZCd3zOLfhHwcI1OY4YUoM1KqpCeJKycdIyeM:I1YedjOYl4XCZrdIyR74x4K39iO+EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785991017, "uuid": "bbe64501-2a59-46b6-a568-096f94849460", "value": 7270562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785991017, "uuid": "02fb2ec4-4ba8-4225-8b70-806dfc63b0e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785991017, "uuid": "35740ce2-9cf7-4cba-b91b-86aa323c443b", "value": "pikachu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f923d00-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786026924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026924, "uuid": "3b04d3bf-0416-4f40-9811-81493de4ddfe", "comment": "Malware payload (AgentTesla)", "value": "3b32e5358d687b865f305bf002713ddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026924, "uuid": "5df495d5-2d29-49b4-bdc0-3c98c5218d03", "comment": "Malware payload (AgentTesla)", "value": "c5ada905e0d97815d6a0cdf95e5497047e0dc46cc55f3ac063631087e649671b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026924, "uuid": "ece51f77-1b3d-4147-99a6-115e94d7bfd2", "comment": "Malware payload (AgentTesla)", "value": "41a584d4ca962571f0fae028b67f2f13145a4a08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026924, "uuid": "42f909c5-34b2-4c76-9036-64d5819b9ba7", "comment": "Malware payload (AgentTesla)", "value": "77276cb5ee0f1bec4b7a408be6a86239588d3fc75dbf1d57890cbde4b2a67add116c16c6142bb6221e1c037d4df66519", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026924, "uuid": "70ff028c-8c22-4314-a0d0-e259dd1f1d04", "value": "T1B2D5C4912B44D1737B21BBAEA537CE355A0EA00355C1DF08322DE608766DD4FA39CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026924, "uuid": "101f8a51-94c5-4d5b-9567-e784f14715f2", "value": "49152:Cl5cuWeb06DjL5+Z3WSvQW9LWIQsKwlxUZZMoqSWWo6fFyGsiWieE0+s5yl27MGj:M5vDjL5HSoW9aYKwcDMrSWWo6fFyGsiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026924, "uuid": "91e0f4f7-ac0d-4893-861c-74c241e1ca7b", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026924, "uuid": "312fe150-8bef-4587-9fc6-1f2f60590b96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026924, "uuid": "86d966dc-33c0-4494-b59c-c11a8e875a2a", "value": "COMPROBANTE DE TRANSFERENCIA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9631d1ea-915a-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785995367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995367, "uuid": "2654d5cc-f176-4703-8124-6b31d91ab37c", "comment": "Malware payload (PureLogsStealer)", "value": "76a5ae37fa26bc4ef5835dc736ee6d69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995367, "uuid": "e442da81-165d-42cc-a497-63dd5305e239", "comment": "Malware payload (PureLogsStealer)", "value": "c60fe688655f66d08f29937f7e94393f1ac6bba126e53d2fb7ba7c9cc3ffd8cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995367, "uuid": "e8f3df06-4d7a-4154-8628-79b03cf0e69e", "comment": "Malware payload (PureLogsStealer)", "value": "cf29674af6534d6084f9a53a2a427bced1685c31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785995367, "uuid": "ae0e5491-d437-409d-ac78-f4fb9326120c", "comment": "Malware payload (PureLogsStealer)", "value": "66be761ef7669525b1fa8c7d1d5d704825051a4056db6cdc5fe8c3f6fdcd7f65ec93b7f94223f949ec73205261486b34", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995367, "uuid": "e2add0f5-ee4d-4336-84a4-8f1ab0f274cc", "value": "T18155226D990B393CCA3DD3283D730B281E256D93879C83B8DAD4E785269DF1D45B1CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995367, "uuid": "8bc8c894-580e-47f8-af66-e02dd349e6a7", "value": "24576:5Ll6ooH512KpOZOgrcvmqmbwIqO+FkfAABTv0xacMwMmNRsHeIDeWiDU6DvB1:5ox1Py3ykIAVszMwDRsHeauBjB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785995367, "uuid": "cbf8c20a-6260-4207-995f-d158080c9612", "value": 1407506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785995367, "uuid": "742e1ed6-f748-4d2e-bbc4-e196851ce255", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785995367, "uuid": "242f972f-97ae-448c-a4b6-8abb9e35ad6e", "value": "PO24059160.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f85da42-9143-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785985424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985424, "uuid": "43607518-d978-443a-8de1-daed73fa5d61", "comment": "Malware payload (Mirai)", "value": "438bb45167330b05530353161fc1a565", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985424, "uuid": "b44aacc2-0081-4f9c-b0bc-2798384e20b9", "comment": "Malware payload (Mirai)", "value": "c70bd410fd31eb06bac8978b0b2ee3bf9132cce5db023a64f3bbcfb96a291680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985424, "uuid": "d0fde343-762a-4e06-bada-c9d9d09694d3", "comment": "Malware payload (Mirai)", "value": "511a1a50c0e07b6d190c21d6f5b57ac694e3dfc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985424, "uuid": "cbf2b546-e986-438c-8449-299ef5315e9f", "comment": "Malware payload (Mirai)", "value": "d44c4b2582841f3776ccb2791aa0808c686ae7fc520443cd1fb3ada6ecf7671d306399a0792efd743162118656676f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985424, "uuid": "3f4f5385-476e-4cf5-a499-87cb27acf400", "value": "T15E04094F7720CF61C729C53049B3CB4656E926522AE18849F32CDE08BE6534DA96FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985424, "uuid": "84bd9d8b-fd10-4695-9e29-0affae1369b1", "value": "3072:4tY3f9iESxHwXMNcaiOSJxSznNP3TkkfRGzRAc05Wn1DzjD:YTixEPvyyX5W1TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785985424, "uuid": "f91234d3-0fac-44fc-ab8a-9c9132e01611", "value": 182276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785985424, "uuid": "c1870d98-f179-4f38-9954-28e921e294f3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985424, "uuid": "3a9d5396-5352-4b3d-a864-976ae83f68d7", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba3ca34-91d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786046138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046138, "uuid": "54b7bf42-0c25-4941-88ee-4e434069b89d", "comment": "Malware payload", "value": "a39cf5031dd984d14257153e40e9555a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046138, "uuid": "68c331a3-e53e-473f-84f2-296cb64c2ae8", "comment": "Malware payload", "value": "c7110f974b3f2c5fdb5bb2037dbc2c0c3ad3f9b884d8697793c906a622e13f67", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046138, "uuid": "dfcf262f-32c0-44b6-a518-a91abba999f5", "comment": "Malware payload", "value": "8a32d6e47265f1d14b70d89a2373fe84fce932d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046138, "uuid": "e7125dc7-9bd8-4050-8b59-110708091a80", "comment": "Malware payload", "value": "0929d8fdebe4ad65c6099282d596485cf5a3dbe35f4f43122ef577f166718e40f0b78407d8d7f7f36777c0025da91302", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046138, "uuid": "c7b5227c-96ab-45e0-bf95-28f0e85f3546", "value": "T1EA01E2AD1D166B50C8BB8E9EB061C430F00BD6C178D30F47E8895D729AC9660F817BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046138, "uuid": "575c20b6-8ffb-4ef8-9453-5f48d44659f5", "value": "12:HvSHvgxvx5HvYKTxvhNI1HvMxvq6HvrTxAHrexpHLTxQagHQ7xVHGexH5HvxG5Hu:PgvSPvdNhNIZvmtvorYqaCQ7Gq6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046138, "uuid": "ca92cf77-6ded-4bf7-b496-36766141ae79", "value": 750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046138, "uuid": "9f7c1703-dced-4c97-88e9-16d8dd008d01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046138, "uuid": "0e2c1a4c-9472-4986-81a2-e10c7cb4c029", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775379c8-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034400, "uuid": "8b66c16d-f3e0-47ee-9b6c-b8388c1e227e", "comment": "Malware payload (Mirai)", "value": "1a84b52a12bc680a1a9c660b588a32e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034400, "uuid": "0fabdceb-50e3-408b-8069-7b33e0515bee", "comment": "Malware payload (Mirai)", "value": "c73afea96dedfb910531992b4dd8b735c6274c896bb604b6e3dfe3d502778e9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034400, "uuid": "0eee3c82-5e5a-454c-89cd-f02e8581ea6f", "comment": "Malware payload (Mirai)", "value": "b226238d6075cafe693720cbceed7fa798b6668e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034400, "uuid": "bf00e7e5-84a2-41fa-92ea-9ac9d42a61c7", "comment": "Malware payload (Mirai)", "value": "446636100a4e127973e3b5c106772f319eab2dd0dcc5cae5fd566ed5cb296aebf46cd8494e1bcdedf91ceef5bdd2007d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034400, "uuid": "66b691d4-2e1e-4b3d-befa-0187014f581a", "value": "T144D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034400, "uuid": "69af382a-1fa8-4de5-a019-b801ce2116b3", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyhOFe30Hi09lshKwAh:ZUH+FD99IVWFt5OgEmhPAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034400, "uuid": "caac634a-edb1-4d27-ab39-14d4dcefa5f7", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034400, "uuid": "a050f66d-c28a-42f1-a7fb-c126d548de6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034400, "uuid": "303e4bbd-ac08-42e4-a0f1-27491785cd30", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23de1cb4-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "2186b352-65b5-428c-bf0a-8e1c052096df", "comment": "Malware payload (Mirai)", "value": "538c2244d87478e7dfcd65a276bb2612", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "4fd722ef-c73d-4688-8e37-f4dba42696f2", "comment": "Malware payload (Mirai)", "value": "c765ed5690a276fba464020b7b87f827ed9315b64822bbcb216b5eb06f1896eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "fe269d90-fa48-47fb-bc1c-8c4b7d1e839f", "comment": "Malware payload (Mirai)", "value": "6532aaaa6d6f0b13f335caec054dc20614d8da5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050581, "uuid": "d684621f-b928-462b-99ce-257970dd28de", "comment": "Malware payload (Mirai)", "value": "95cbcff0dced394f7f9fca0d71566b1c79bd74f66d759a72386cbe1be6bfad3868ba5aea98f8763120f2ea5aeac7ce73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "c8004815-1323-46ee-9173-88d315404006", "value": "T176141A45FA43CEF3E41304F011B7A63E4B30ED394826D599EBA8BEB5D9236C1661636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "7e723bd8-58c3-428e-80dc-9a1ddc060eed", "value": "3072:czQv74CdX62aqDXqFbg5HwKeYii+Scgcb7OQ3lpDi1:cskuq2aEP1BVmyQnDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050581, "uuid": "8c5790e8-6e41-4578-8043-05d12b78e8e8", "value": 192740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050581, "uuid": "cd749c7f-2b60-4ed3-883d-66243a1df3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050581, "uuid": "9b368433-c53c-4e67-be7c-0e591f18abe5", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bee5f2-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786026748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026748, "uuid": "fabd0a4f-8add-463b-b6a3-9afea4d0e12c", "comment": "Malware payload (PhantomStealer)", "value": "3e8aa69b69b2e01ff656ce8ba7af8099", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026748, "uuid": "f50caa07-edaf-4e15-b7e3-9a32d8b65ea1", "comment": "Malware payload (PhantomStealer)", "value": "c78f663aebe76da3e9ce32305842d0c3060599ae55f1c81dd4cd20a85841a866", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026748, "uuid": "0b3ad641-0e80-4b7f-9b13-907a2198b2d2", "comment": "Malware payload (PhantomStealer)", "value": "28c72f72672ee41bd99d8c69b460999220110000", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026748, "uuid": "f9ceb60d-29eb-4629-b0d5-3c39d580cc26", "comment": "Malware payload (PhantomStealer)", "value": "6ab9e09950f8b87b7d94ce97f883ccddeffb92048a5cc459af2450528f640de991d2f6ecb80f7f7708cdf6eac6742ff9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026748, "uuid": "fc11b4d0-f25e-4e3c-8715-934061432e0d", "value": "T132A31F0499827480633A6B7FB22AD8E5F3760B6B01805817B87C7880DFF6D09DDE5DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026748, "uuid": "5417e9d3-ef14-4e8f-821a-247043c56054", "value": "1536:JF6K/2oLcKcUyFj7eVbsZJQsmdEPY7fXMSO9:JUKcUKUEPSPM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026748, "uuid": "7f2408a9-0189-400e-abbd-e29d254868ae", "value": 98756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026748, "uuid": "03e04819-c454-41be-a71a-3ed17c92ab63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026748, "uuid": "bdc7dc20-cd9a-4c14-a5d0-281dd6e2422c", "value": "PAGO JUSTIFICANTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a24ba95-9199-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022298, "uuid": "b07454bc-198c-4165-95a5-ae83b669694a", "comment": "Malware payload (Mirai)", "value": "f6f17631f28d210a2ec40c57f6630ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022298, "uuid": "44c951dd-102a-433a-90ee-53840fcca2da", "comment": "Malware payload (Mirai)", "value": "c7dea8868503193794cf725b9f7858b41086b248f61a4ac47c9242833275b896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022298, "uuid": "63979230-b6d2-4624-907f-5b5f195123fd", "comment": "Malware payload (Mirai)", "value": "f1d470dd7ca2f451b586afab10f62420036d9dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022298, "uuid": "4da20b40-e1f6-4ee7-b9c8-f82ec97c1b5b", "comment": "Malware payload (Mirai)", "value": "5ed73e8ea8adf383bc7c2990482084397404affb16e112423eeaab4b5204d311b1103bb56a871cc89c423edc4d28113e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022298, "uuid": "13a5285b-bebf-442c-a25f-8fd0d6621f40", "value": "T114030813DB61E92ED44B93B35BDF86259523B9BA0335E00793A0FF655E448F0EED8242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022298, "uuid": "0ffbfcc8-8e40-4c4c-a7ca-70a0489c7c8c", "value": "768:0O5fkPD1zdu20X8EMHKtrmQgSUo0M7vC5WLmkwJLVE:phkPD1gFMNq8EUV5UwJLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022298, "uuid": "7e7d40ed-0822-4f76-ac1d-293e18b3a189", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022298, "uuid": "dfcd7909-7058-4538-86a2-92f2ed0b7075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022298, "uuid": "9fa61f05-1e6c-48a9-8ae7-6a4921c2a973", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f5e2ee-9131-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785977922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977922, "uuid": "9bbc32aa-3c95-4125-bebe-f3302b002919", "comment": "Malware payload (Mirai)", "value": "f5c5070c5e14a6debb086f9936e4b9a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977922, "uuid": "d76872f9-6e4b-44a1-95d2-407d74a484ae", "comment": "Malware payload (Mirai)", "value": "c842cdf88aa56522af9a7f74736445af07e8b6b1f4b43e9fd8063c8146655fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977922, "uuid": "24e87269-6608-4eb1-ae48-0bd1a470187d", "comment": "Malware payload (Mirai)", "value": "3f612b1ad030104b0486f6409ce1946ab08735ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977922, "uuid": "53c60d52-0dde-41d4-bc00-ecdd80334ae4", "comment": "Malware payload (Mirai)", "value": "56ed99e1806212df43dccbdede9e67d39e7ecf9289e38b7bac966b5ae10617ef41c1c365043606f334bd07d32bc3d90b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977922, "uuid": "1fbb20ba-8721-4487-a07e-1dd4c76aa7fd", "value": "T1F1A30906FB010FF7D8ABCD3745B91B0128DC555A22A66B37B634C918B54B64B1BE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977922, "uuid": "95275fb9-1666-40e2-9dd2-fdab339c8919", "value": "1536:HmNe95/JcP7pARt7xkQWoBIw4UZljONCNZGIBQOjVm7u0vmbvc:Hc8M7pAR8QWF8ljfNRkvgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977922, "uuid": "b72b3740-d799-483b-9856-9067ec862dec", "value": 105776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977922, "uuid": "54ac5003-f391-4453-a154-7bcec7cc573b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977922, "uuid": "1a2dcbca-d6cb-4da4-83cc-a36fd0e50dd4", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7ac713-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "04447d76-3046-41ac-8d61-bb3b0c9a81e4", "comment": "Malware payload (Mirai)", "value": "4187dfc3549a411c82161e0aef4b1ac6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "f5515640-0883-4bb9-9fe6-318bbe8c188c", "comment": "Malware payload (Mirai)", "value": "c8c55439e595378d377fd5a94a79ee82ef8115d375d3ae41cf2eaf187c5cce88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "2c0c707d-1062-43ec-98c6-e0d72669ae2c", "comment": "Malware payload (Mirai)", "value": "928f9d14cff7d718f59e3673cc0f8f26a040b4ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045741, "uuid": "40e815b9-459d-4307-8634-ca87e71da963", "comment": "Malware payload (Mirai)", "value": "af071b69320796a7af3b04a1ab88c970d2d61a7cbd056a1155f32368d5f89531c363a7e1ce14111573330441b49d7be6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "b24e88b4-0839-4d7c-b706-b6f126c81866", "value": "T1E0C33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD4AF123D4AE614D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "8e1ce18d-21ed-4c23-a754-5c3a3a2205b8", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPm/nZ9TzQTRN6FpjygQjc:jrguLRkHQo8SsGT74p1oB4n2pvalCPz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045741, "uuid": "c1800f23-631d-4960-92c5-0f428ada2b4f", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045741, "uuid": "b836636e-f97c-4e5f-886a-b542295d73d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045741, "uuid": "5645d03b-7b9e-4900-bde2-d1d8625ba541", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3faf718-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993350, "uuid": "b073c1cc-675b-42c6-9587-7def2cd7a732", "comment": "Malware payload (Mirai)", "value": "3353e1c32d1940a40e284775260aff6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993350, "uuid": "2ef44630-b7a3-481c-9a26-d8791c92ee3f", "comment": "Malware payload (Mirai)", "value": "c9000838b45067b6ee15cd7849bc969db0b112d65f0aca1e08cc9e1e54b9b0c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993350, "uuid": "050d997c-4003-49d9-8c34-00e5c6f0629e", "comment": "Malware payload (Mirai)", "value": "6ff569977ee31b03e1e8a4cc2e138466cadf8da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993350, "uuid": "6bed0b8f-d26a-4737-a2c7-adc1980d2f73", "comment": "Malware payload (Mirai)", "value": "92ea61344c7220deeea0bff97d2c4bab1acf04aa53da3954cc48e3ccd7c7d09e1fbbfbdd40fa893d7932a844b69d0d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993350, "uuid": "3878b8e7-fd06-4672-bb76-104ad90147d0", "value": "T199043B49BE746AFBC06FCD30052E930622DD945FE2F6B3796278CD4CB99A20859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993350, "uuid": "65cb9d25-8f48-4c85-b959-05af32e99cbf", "value": "3072:EktqLAC0iaWsgk6XugoSzTwQSG3vl99J2XACm7GQ0IdkbugOrr4YOv1DG:JqLAhiaLgk6XNoSzTwQSG3vl99J2XA1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993350, "uuid": "ed0859dc-674a-4ca9-8f85-a5ae2dc2f2f6", "value": 181764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993350, "uuid": "cca44ed7-73fb-48f8-9665-28808707a396", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993350, "uuid": "80630843-f4ed-4b96-862d-f1cd5b50a4db", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa2018-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786008961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008961, "uuid": "f25a6f32-d615-43f0-8bc2-ac55699756c3", "comment": "Malware payload (Mirai)", "value": "5f1fd3591eaef7bc7d1d5465aa9cc7b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008961, "uuid": "9d2bb4c8-a9ae-4345-a0ce-a32374e123d3", "comment": "Malware payload (Mirai)", "value": "c99ece21a55494fdf66fd2a1ae90a4f1d90f218fccc6a0ec94d8a2098244091b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008961, "uuid": "c2cc433f-909e-427d-9dcc-d21050cec1ea", "comment": "Malware payload (Mirai)", "value": "bcd5ada0076027a7fe3f5cb54b3d2fa229780c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008961, "uuid": "1ee47ea9-a18f-41ef-9736-a2baf843c44d", "comment": "Malware payload (Mirai)", "value": "bafafe3327d4d8d0842b4565d2c1c8f940419c0323c7619b6fa5d4b4169a315322e23e83aec445c8b6ed1b869e5b3924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008961, "uuid": "ca51a917-1148-4a06-a54c-7cd3c6168ffb", "value": "T16893125D70F1EF85EDCD8ADF8C2A2945A49A5421C6F8D6A57250C7C8F2BAC03583E4F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008961, "uuid": "544f102c-9804-4e5a-96aa-22581df6d1a6", "value": "1536:VS8jnvBwb0cpkcZ+acfx9RWgoE34Fcz/mV+4RpJlSj3777wfJGjN48:VXjvBaRpH2hUSuV+tL0GZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008961, "uuid": "a9010261-e28f-4344-b170-29a869d588d8", "value": 97348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008961, "uuid": "f3fae8a6-61b9-4c30-82ff-d76fd03460a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008961, "uuid": "4d080ca8-2dd6-4720-925d-05dc17af1d1e", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.32690.29136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f5519c-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022148, "uuid": "b9357169-b3e0-45df-b185-078ca1185c13", "comment": "Malware payload (Mirai)", "value": "72979d5ab1e4878884c5f53c1456f924", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022148, "uuid": "6637cfa0-c79d-4075-9f1d-9c67566ab5eb", "comment": "Malware payload (Mirai)", "value": "c9b93460facc84ad45aabe5cae0ecdde85cb68318f2346762aabebac61cb44a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022148, "uuid": "af912447-e00b-48a1-abb9-fb48d0ca454d", "comment": "Malware payload (Mirai)", "value": "da74baec68ae8b7842a16b03c0f0cda33d8ae942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022148, "uuid": "44bd84f9-ef49-4a16-a58f-6857dbe197d4", "comment": "Malware payload (Mirai)", "value": "6699603afd206bfa325f05b8518dc2e9558f67b6daaf1861714daefd5dba77046087fc56bb5c0a00165c4f25beceb4ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022148, "uuid": "2f9ebd72-5f25-4e24-ae64-b58bc96ac280", "value": "T1F133E749FA419B05D5A231FAFB8E414E33176F68E3F9312199306F9013C6AEB0B76525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022148, "uuid": "8cacde74-0430-4ec7-af63-489a2db4e632", "value": "1536:cynWoX+3CnzsioxpoBmzZ/U9+lVy6rinscfWyZcT:YoXFsioxpYmzlascPZcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022148, "uuid": "1ccbcdaf-d5eb-4ee6-aac1-a86c70c3bffa", "value": 53264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022148, "uuid": "4b38d533-9ed6-4658-920b-8973efb9d3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022148, "uuid": "3aecda1a-f383-4721-9a1e-6082d44e119d", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c66c617-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993579, "uuid": "9d96e1cd-dafd-4339-a79c-8fe232c2fc9c", "comment": "Malware payload (Mirai)", "value": "eab20d13c46f61255b1a1a98eebd6e47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993579, "uuid": "dfcaa525-b4b0-4aeb-8a83-ffe9e4a7fdaf", "comment": "Malware payload (Mirai)", "value": "ca0b3eb79b94791757d57e4773cd9b9a8e864e3ce3c317ff217eb4f8d1df7dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993579, "uuid": "67c62ab5-e241-41a8-bbe2-0d55858291b9", "comment": "Malware payload (Mirai)", "value": "42debeb56df9fe16a1ee92a9d2f99c67edc2b617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993579, "uuid": "85f83d00-aab9-47d0-be13-fa311895ff49", "comment": "Malware payload (Mirai)", "value": "6d6485adce72ddeaa43ddd79ee89407d9171af4340acf647bdefe60429198061eeb8325b6f1cd27a0f72d9af75f5c157", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993579, "uuid": "eef6ca45-77e3-409b-a48f-d6a6ff7a2deb", "value": "T1C6C329A9F890DE52C6C52676FB4D418C33231778D3DA7105CE149E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993579, "uuid": "c69a920b-ec83-4c29-b5f9-01b2c7e0e03e", "value": "3072:MNj6juBHdI4ozVIHLcYEEU5ZjMWwNwhA4oj2P7/NiF3HeuFf1Dl:MlQPVSLcYEEU5ZjMWawZY2Pg3ZF95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993579, "uuid": "36d7da94-a3f7-4d7b-88db-1ef089b2c537", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993579, "uuid": "932cea73-3ff1-471f-94ef-eb6756548892", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993579, "uuid": "cf0974c3-b14e-4fba-9d96-841eea2eff10", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe6cac0-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786008966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008966, "uuid": "f4a9f8ac-8e8f-4a34-bd42-076c7c3d73f4", "comment": "Malware payload (PureLogsStealer)", "value": "44cec351503f80dc302647d713adbd33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008966, "uuid": "2d994c60-a6ed-4f26-99e7-05a191ff8cda", "comment": "Malware payload (PureLogsStealer)", "value": "ca33eeabb9860584f49ff9a881de1fc6a218813d7bfbcbeae842fcb579ea482c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008966, "uuid": "309586ab-999a-4997-a3c2-570d6a3b1067", "comment": "Malware payload (PureLogsStealer)", "value": "4ae58412280a4492b434435e802bdf619576680c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008966, "uuid": "87a21c11-6ec8-4669-ae76-d20790224697", "comment": "Malware payload (PureLogsStealer)", "value": "235daed2cea034952dab104c7a26b09a17068d2549eab5c348fabc352e43083306d9413f72ca1b038a9a294e33c54cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008966, "uuid": "4b49f4a0-cafb-4ff9-86ac-5d489ab0224b", "value": "T1E505BF3A76998F25C1465377C1C7490083EA96473BABFB0F368503D629037EEDA0A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008966, "uuid": "643840af-0702-4bce-936e-337cec1520c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008966, "uuid": "1d58f653-2a1b-4d3b-872a-52527f24294c", "value": "12288:8HwH8P8lRuw06cogW2bpfDO8OzPDMmLr0YXUa5Rw7oA0Z9ZTU15:bffINrY8OrDMUrHUl7MZH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008966, "uuid": "df37a2f7-6b66-425f-b9a6-f1275175901c", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008966, "uuid": "4cf2d72d-f1b7-4615-bc33-956f0a019c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008966, "uuid": "94f8345f-877d-4ff5-b222-91db02319342", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.61881362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f218b73b-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785994663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994663, "uuid": "ef636cb3-c83e-4272-b40f-4e695dededbc", "comment": "Malware payload (PureLogsStealer)", "value": "b1703ab3a7de09ca5527fc210499bb70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994663, "uuid": "d2c2d07f-feef-4fdd-9f38-60e66f00c19e", "comment": "Malware payload (PureLogsStealer)", "value": "ca928e3611a0c99121b7969b1207153bbd86e7273b3b0dc384a1699856718636", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994663, "uuid": "dbc18b86-f99b-40eb-a9f7-cad3c3c901ed", "comment": "Malware payload (PureLogsStealer)", "value": "03e49b41662023fb6dd03925c1b71a985c7e6ffd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994663, "uuid": "b47012a8-985f-4a57-a2c8-853afe32f442", "comment": "Malware payload (PureLogsStealer)", "value": "a1f48e8b93ddfcc474fdb1835e97f03d3fc1c862b8f0b1590831e7cb4eb0047811f031ef17a0ea72cd88903d9da2e50e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994663, "uuid": "0bc41dd5-2fb0-4750-9dae-096a966748a0", "value": "T1F076A5FA73EF7B8B1609339A4A4CA8958F1DD37C0E8393D4A0DB05F8900D85569D4ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994663, "uuid": "b11ba335-9a6e-4dae-a0cf-3182eb0927bc", "value": "24576:wS73knNGYDB54UOrksRp7urGgbhhIvvBhYX/rd1nVHkJ4s8HYAq1M5i/X1VZ0Zy7:wS73kny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994663, "uuid": "f5e167a1-cda5-49d2-b435-0bca30d3f881", "value": 7734778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994663, "uuid": "f7635519-256c-4ef7-922d-5ff20c692681", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994663, "uuid": "a94d891d-b324-4ec1-bd2b-ee98aaf72d22", "value": "PO 3013506551.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c869322f-9166-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786000606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000606, "uuid": "4c153cbb-5c3e-4ddb-ae2c-5ddd33ababe8", "comment": "Malware payload (Mirai)", "value": "d817a1ef178bc9d5b93e66462b62d410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000606, "uuid": "9b6080b7-6542-4469-9dab-5443e01d3a18", "comment": "Malware payload (Mirai)", "value": "cb992226810bafb1dc220e0269e36c1e8e5bf85a3f6247eed3dd543b45f0d307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000606, "uuid": "70912882-b9cc-4788-8e0e-c402b7f857d3", "comment": "Malware payload (Mirai)", "value": "8157b18908ad5a404ade78b7967d1b3183fda632", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786000606, "uuid": "55a993ab-f5a4-4ed0-bb6e-4e7d107b8ff9", "comment": "Malware payload (Mirai)", "value": "2788d4dc543deda9e128d86ef174166c827d717f48dfe4808fd8edd7095e168291c9c9039f83a088e8b4fc902180d0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000606, "uuid": "d11373e0-b4c3-4a75-a059-b70b12088cd6", "value": "T165F3964A3F228F7EF269837447B38E20975977E626E1D681F1ACD5401E202CE641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000606, "uuid": "33c85270-65e3-447c-9416-9f74638a68cb", "value": "3072:Eg18ZaMliOtgTAdod489I7MWMKg4Qnnlw:F18Z1lXtgTAKdooWMUonlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786000606, "uuid": "8403d053-e36b-45f2-9a47-3a3d97ef5c57", "value": 166348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786000606, "uuid": "8a3b8cb9-90f7-4e08-b0c1-36af69a5e5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786000606, "uuid": "d7e1c5bd-451f-49bf-ad17-7a4b97429e11", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fc966e-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045544, "uuid": "09afbca6-405c-4ca4-ac39-c5b06c45d496", "comment": "Malware payload (Mirai)", "value": "57cca22740cc4c060296b6789e9a4068", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045544, "uuid": "c057246b-8903-497a-9bf2-42cd2abeeff2", "comment": "Malware payload (Mirai)", "value": "cbd57d56386878ce6333545f36f75388fcbb983cb0c3ab02d82e4dd530c01674", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045544, "uuid": "39905077-99b0-4284-890a-fa34ad214a33", "comment": "Malware payload (Mirai)", "value": "85162eb72a2199802174c4772ca3def0b949a666", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045544, "uuid": "f6c3ae00-261b-47ba-9c0f-2803b1a4ff95", "comment": "Malware payload (Mirai)", "value": "e3f2d3800f27e334e3f5098d78ad93031cec80f19fee5a58e984fba6765ca25fbb9b15bdcb9530658f3524ca35bdb1ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045544, "uuid": "b42ffdc7-3e30-43a3-93ce-0230850ee504", "value": "T155932A86B8819F21C6C516BBFA1F018D33165BACE2DE73128D185F607BCB81F0D67A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045544, "uuid": "2146c548-954c-4561-9ad6-40f28c3cf54d", "value": "1536:n2nzN4OlYI2KHoHsFClFL0b6913lBr0qddZEaIsh3vaDhXzMIti7gB5pkumi5RYU:oN4OxRoMF8gO3XoqdMaIYvamgB5pkum+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045544, "uuid": "386e80cd-32fb-4755-a8cb-1cbc4c22161f", "value": 96556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045544, "uuid": "9b34687b-1540-49a6-9bed-494a2c439245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045544, "uuid": "9579f02e-91c6-4135-89f0-a69575ede94e", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bd42cd-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "d40ae986-ac5d-4d4d-b08a-03a3b429304c", "comment": "Malware payload", "value": "8c1a079ad27aae3e7198f0a1f094e6d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "fab9658f-c27d-4c57-87a2-57b74ac176bc", "comment": "Malware payload", "value": "cc06cde9c0851069ad5c85845453578094ce178de25bf6b28eebaaca5e842143", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "24c688e2-a466-4f4a-8b75-a35f1d5d52a7", "comment": "Malware payload", "value": "ded453863f08351ae710c1968ad98919c783e18f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "66dbd146-e644-43b8-9137-53d2552ceea1", "comment": "Malware payload", "value": "a42ac66d2fe3a481785693dd47de30851b1673cf276c1f7dc7b0c6d72e5137db7adb11998f92542e2fdd580b4c3b9ed1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "7460ebba-a238-45a0-ac98-c073d7bd7220", "value": "T19EE092E800348BCA534D0AE0617604FE22291190EFEB0DD9D2C26FFE502E4A9BC4F301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "d9f64beb-6e8b-4f2d-898d-55393bf08b91", "value": "12:YO92J9tLmgVHxcxgVHx9HCY9dYLmgVHxgF8xgVHxgFdkKOan:YO92J9tLFrjrUY9dYLFrADrAKSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044995, "uuid": "c19c3bec-d18a-4c78-b9ad-183d7d3be305", "value": 408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044995, "uuid": "43551e03-31e5-4550-a428-b2db84f99f87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "80b39da3-5ada-4cf4-adaa-873b4a8c5405", "value": "auto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68632b8c-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786026214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026214, "uuid": "36fa138a-8733-4d7b-88d8-4af59c7e3b43", "comment": "Malware payload (ConnectWise)", "value": "ac250397bf3f4d207b568c4f40b29f17", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026214, "uuid": "d8c7909a-0412-41b7-80e4-a2b379fb270a", "comment": "Malware payload (ConnectWise)", "value": "cd1966788983c1d70afe0055483e3968b1c2951576c2a3a962e808071792d886", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026214, "uuid": "a9ae493c-bc8d-4f68-8b94-418c903f5f60", "comment": "Malware payload (ConnectWise)", "value": "873fd304f61c5a036ebeff0ccd79cc659a70e10d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026214, "uuid": "853c06da-583e-495a-a772-07bf3168b39a", "comment": "Malware payload (ConnectWise)", "value": "16da5101785f8393d57d34d09e44206e72ee54ceba1c55d6fc3d9cc2a9fdc18e2109870fae1841040f647d44728800b2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026214, "uuid": "1baa52b2-e951-4a95-8399-381b14096549", "value": "T197C61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026214, "uuid": "db596a87-a856-4d02-a834-bab815730684", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026214, "uuid": "d35f43b2-850b-4bc2-b7bf-ba28004a77cf", "value": "196608:g1TfefPqzQyiixtMjGZ1jhlrwUNQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMjb:gUPnjGrrGPnj5PnjgPnjqPnjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026214, "uuid": "6ade6159-0df5-4da4-8870-3a8a2d0a0fef", "value": 11624136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026214, "uuid": "9c89e6b2-d20b-4f73-93df-240ce0cd5a6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026214, "uuid": "6e66e507-546f-4bcd-824a-516d9b10c340", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee614ead-91a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026010, "uuid": "45bd613c-dcc2-46e4-b406-2ad0a3ad81fb", "comment": "Malware payload", "value": "52a80b43e07cc9e06dea5ae299391812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026010, "uuid": "9560920d-f413-492b-834f-4baa2a80f633", "comment": "Malware payload", "value": "cd20c8c58a0b648abb515746556502b19a6fdbaaa790a65ad51570bc9001c19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026010, "uuid": "d1e3c613-949a-4e06-9893-a8dfa044826e", "comment": "Malware payload", "value": "ffe43e58a333b593256b93f4c03ff4eae1ddc2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026010, "uuid": "56b358de-0c41-42e1-8374-b9e470b0b56a", "comment": "Malware payload", "value": "45dc66b3316dd7377d996606993cd96cd2a63d3f3b877461b0ca6017dd4f610b1e5d9f08676ac3e3054dfda1ff111b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026010, "uuid": "c9bb2396-1479-4ce0-870c-fb4a8eedbece", "value": "T189C62257A3A441FCE066C279CA465D4BEB72780A03A0EEDF17D049526FA73E05E3A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026010, "uuid": "648512c6-05f4-43ef-b3b3-d06b69b0bd6c", "value": "c1ef3c1f3bf3d5d3f0e27d9deb9bf881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026010, "uuid": "0ec0df96-875e-4eee-a701-45814559273b", "value": "196608:xJTRAD0yZRbcLDlTaGKLXsmWAHo3k0WaOVbhKEKZ:j4mpTavXLpYkLBbQFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026010, "uuid": "74808afe-d1c4-4188-9cd1-e57d85f57ee7", "value": 11586048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026010, "uuid": "d7cab247-2fac-49ef-93cf-79327cf8b071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026010, "uuid": "008a71c5-b1be-463c-bbfd-38c6982f5bcb", "value": "52a80b43e07cc9e06dea5ae299391812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdf8b9a-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1786026952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026952, "uuid": "1fddf19c-3b9a-4c57-82f4-ebb3e874aa78", "comment": "Malware payload (STRRAT)", "value": "66245aefe3d8fb35964f5414d6226af3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026952, "uuid": "a086ae77-8310-4125-8062-7b7837c27035", "comment": "Malware payload (STRRAT)", "value": "cd95bd16eda71385f1c372910e0da074062ae7db5f9c3de90980f49e3e955f2e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026952, "uuid": "e9ede081-bf75-47fa-85ba-6484d19ecef0", "comment": "Malware payload (STRRAT)", "value": "32b2b2b9f60699f986b485e74ef70fd9dacff323", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026952, "uuid": "907ede06-86c2-4ce4-8847-7a048c7c9171", "comment": "Malware payload (STRRAT)", "value": "8525b67fbab5d262e4a1642fa6d3ec02ed976cc7d05edbdac8e20fb55ab8ee55a7fed4e248989a8694eabecb3575740a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026952, "uuid": "1e7e6e10-b495-436a-86a0-68bdf0a14fc6", "value": "T182051F55B3AA098B1B0BDE34341A1D6277B80B60EFCC49C49657EE998C5EFC70359E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026952, "uuid": "d2d58ccd-b7eb-4843-9404-8804ebc17dfa", "value": "3072:OJE/ChczVx1ql57Xg7LdUFIVKfOgsZ/q05CzTBjk3yd44wDWQv24ZNcFYSfvn3fD:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026952, "uuid": "4e279056-543e-4069-9085-b33a97a80e3b", "value": 849496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026952, "uuid": "ca116990-9a7a-45fd-9bc2-e44013967d87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026952, "uuid": "4d0e9fd7-ca18-468c-aa1c-7ba17887db93", "value": "Proof Of Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833fa147-91da-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786050311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050311, "uuid": "ddcf28b9-b2ce-4d31-8f65-4bc56afb82a4", "comment": "Malware payload (ConnectWise)", "value": "37af0be3dccc41a28468d76454485b4f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050311, "uuid": "b3588e85-fd91-4710-aeff-13541bd226a2", "comment": "Malware payload (ConnectWise)", "value": "cdf1259459502c82ce1bcb0651d6dba80d6f0bb2c7418e6a4ab75d0c4718536c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050311, "uuid": "8d62c951-07bf-447f-93bc-ac7e374db6b3", "comment": "Malware payload (ConnectWise)", "value": "000c5d3519a58d1c7aa14b63b04cea34d1a39ee1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050311, "uuid": "9277a137-bd2a-43c6-a421-143e130ec66d", "comment": "Malware payload (ConnectWise)", "value": "6e393862483385bf7d4c3bbb3e1e7b1992f0241b50416d5fbc7a363fff3105dac3ee67afad982b8902453d083315c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050311, "uuid": "7d1b2ecd-a008-4703-bf87-c0c5fadde15b", "value": "T1E846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050311, "uuid": "0d479b5b-2c31-48a7-9b7f-51f491530b13", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050311, "uuid": "11ecb7d4-dcd8-4349-8cd1-c00fb14225b8", "value": "98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050311, "uuid": "eaabff52-ce57-406c-ad60-b639f75bb46e", "value": 5643000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050311, "uuid": "94344525-b764-4a8b-88b8-ae32edc1fa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050311, "uuid": "452aca1a-7299-4676-a858-d9fc2333d4e5", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a288da5c-914b-11f1-bd95-42010a9c0009", "comment": "Malware payload (WallStealer)", "timestamp": 1785988946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988946, "uuid": "18e70379-1d86-4d82-96e9-17717457842f", "comment": "Malware payload (WallStealer)", "value": "6f2f0693f16f9f25153d5257a8c5348e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988946, "uuid": "b6f5320a-aba4-4b3d-8453-1e55bd23544f", "comment": "Malware payload (WallStealer)", "value": "ce8b182e4390d2a0d157bf71c6e274585f42bdf43598db41af2dab7397416c14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988946, "uuid": "0262d0fb-1929-44e9-9131-fbda16c11633", "comment": "Malware payload (WallStealer)", "value": "7965391b1669bc42261d4790a5a0be906a4a5223", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988946, "uuid": "618ec02e-4708-41ae-bdf3-ef40af4d0dfc", "comment": "Malware payload (WallStealer)", "value": "30c2bbcfae7ddce8ba893b6ab0b5a212cab105ddf3e9bb9a4ed47fbf019bbc51fac8040a3457aaa7065c2bec4b7e8dc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988946, "uuid": "605d6410-3695-4572-bda2-aa21b526b706", "value": "T18A96638FA2748613C8E263B5B2063972BE2AD435479983777CEDE435319F0BE4A718D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988946, "uuid": "05aed618-35ee-44f1-83cc-a3de69ebde06", "value": "9033ed8cddb67801cadf6f0204649a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988946, "uuid": "5ac7ca28-b717-415d-ace8-7e71efcdc56a", "value": "49152:nWJwCXCWi0En4dcY7BUX4r3lJb8Jpm6KKL5G1jFud7WYXVG1tLWVitYl4tTMFBu4:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785988946, "uuid": "5d4e83ed-42cb-45ae-92da-48f8cd9c95ab", "value": 9349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785988946, "uuid": "af887789-1687-43bf-8e84-418fd1af9dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988946, "uuid": "aa6a0029-2d8f-410d-8d6c-61912b931c92", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339d58bc-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057479, "uuid": "fd248ce3-6b01-4361-bc3c-f0ae543fdd55", "comment": "Malware payload (Mirai)", "value": "5d76a7edf7955021acebf24768c1c080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057479, "uuid": "a65f7a3e-25f3-4d1c-a2ae-3bdf5d87409e", "comment": "Malware payload (Mirai)", "value": "ce974705354785948578000ff6a139dffd8bdda4cd24a1b18bc04df2a71733b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057479, "uuid": "531178bb-dc2d-4983-b837-30e8037f9c73", "comment": "Malware payload (Mirai)", "value": "176efc6e98a6dcbd66d1e161865fb934d1f600b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057479, "uuid": "6f748652-fcf4-4a8a-8c5b-75bc328759d1", "comment": "Malware payload (Mirai)", "value": "6fe4ff73ea40b79e5ae290d64c8cad2f4d434b3cbafb54b9ac695d33b49067ff3cabebe315367fa3e9f48262d76746af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057479, "uuid": "8e666d23-504b-4b86-b2c9-7e4f09052eef", "value": "T1CBC32B99F890DE52C6D52675FA5E018C332357B8C3EA7206CD209F34B7E7D5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057479, "uuid": "1d1a816d-fd87-4664-8e58-203d1c80f129", "value": "3072:ZVJW0PobiEUGHtUQ4g8ObC+qE5HqvfDh6dso4f1Dlu:ZXWHJHtUQ4g8O2+qEIDh6N495", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057479, "uuid": "3123d6cd-9a75-4367-a3d4-3b5d4d7e0258", "value": 120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057479, "uuid": "18131e7e-6354-4636-a323-20896fd8eeb0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057479, "uuid": "bd1dfd9d-e46f-4ff4-bb64-2646c805b10c", "value": "02cafc015e53bcb91415ed85b53728b0da6b07a2900339c50f309e26d0ec281b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185f8e33-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994727, "uuid": "bf6a3dc5-f665-460e-8e85-d37a32ae7302", "comment": "Malware payload (Mirai)", "value": "39f8356c5f47648f6d9b20a0b2c2cedb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994727, "uuid": "e7cdad6b-3155-4ec3-8a6d-e5e4d39fe36f", "comment": "Malware payload (Mirai)", "value": "cfad117d5dffc12066ecb1d8b963617e0d4f1cb93ee3f2d29e3dfdf7397ecc6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994727, "uuid": "f13fab56-d3a0-48f1-b1bc-0b0790d60584", "comment": "Malware payload (Mirai)", "value": "1d592a618f7c4df0309d74059724ab16e483bba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994727, "uuid": "20bc512b-ad41-48c1-b95b-7f671cd99ac2", "comment": "Malware payload (Mirai)", "value": "ad69d064ba5db16d0f788a19626c310f507fef86abc15c0365251bbb87a02366cfaaebbfe90116dd21267a0731ddad66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994727, "uuid": "7a81fe4c-b26b-42ec-826f-36446315a5d8", "value": "T13B43016094C62D19C6E12031CADDD541B51137B93B7537242B1DAFC4A68540BBEF464B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994727, "uuid": "07f7bc14-1b0d-4eb2-9ea0-103e2834b336", "value": "1536:Tn47cia83jYUfGzO574bMR1/j7PvVUBLEL4rwbfT:zTx4Mu1rrOZEGwbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994727, "uuid": "d8cbf4d8-5306-4b9e-aff2-b26524861bc0", "value": 56436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994727, "uuid": "2aac88ec-b6f5-4203-bccc-77073788b3cb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994727, "uuid": "453314a8-978e-4bae-ac84-edad68c066ff", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f5a439-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026955, "uuid": "e047fa80-dfaa-44b1-b796-da87c3ccd0ce", "comment": "Malware payload (XWorm)", "value": "431cc4fa5a289b79909a36667ee04411", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026955, "uuid": "be97daf3-c7df-44ff-aeb5-62f79da90646", "comment": "Malware payload (XWorm)", "value": "cfbe43d4ecedf955f8aad7dc2f56969a791adfebebfe464b74d15ac694b32210", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026955, "uuid": "d4121380-681e-4f89-a6fc-0affea6b6dbf", "comment": "Malware payload (XWorm)", "value": "1d9f679e8dbc40af64335318e23a7d878bf6c3a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026955, "uuid": "780b9209-3652-409c-8eae-f3e66b0f3068", "comment": "Malware payload (XWorm)", "value": "7e8d757a6dab43d97b1342e434c4b5302c55942271b6da07d21a3b22ff00831354be3132a50e61d7a19efe3f81afaba6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026955, "uuid": "e7ee5cb6-82cd-4dcd-a3a4-d3f63a85655e", "value": "T17E2500F95789621CF4F5E14E9F6172C5EAE16AC40DC2285F3CADC9A3C811E4EC25A4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026955, "uuid": "cc193c2d-e7ef-4110-9de3-cdbdf5a200a2", "value": "768:PErVrqErmr9rGrprpr7r9rBrmrSr0rSrDEr0rGrSrmr9rBrqErVrqrW0rGrprxrf:r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026955, "uuid": "f41f504f-6f81-4c02-be89-948fef186983", "value": 983420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026955, "uuid": "db1a0f80-071d-4d62-960b-09f52f91b500", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026955, "uuid": "fed6c9e2-a7da-425e-90d9-ac2040f2c5a5", "value": "PO.OB2400224.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf09a3b-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "dba0bad5-9f82-4d6f-acff-b603a209c696", "comment": "Malware payload (Mirai)", "value": "0c4a2b0e95f2b874f2b1b7151c140d79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "694af461-f2ab-4d75-b922-7d06c6980eaf", "comment": "Malware payload (Mirai)", "value": "cfe83d9383da6822dd073a33791a1df10514849e54408954fb4f09f7c09efe22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "3dc2247f-d2c5-4c67-99f2-0cce14675336", "comment": "Malware payload (Mirai)", "value": "908636f2088c43f82c8284cb5a1593fa5640d202", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045739, "uuid": "552360e7-7ba5-4902-91ee-62307b15a9fc", "comment": "Malware payload (Mirai)", "value": "932ada39bbe24750b9ad0a7e6d66f85b5e4a90496bda2fd5a75348015d380d64bbb822d29076838d5f3708ba7db86611", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "ae2ca1d8-4106-4a85-9afd-ddc1d39e5175", "value": "T1AFD35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "1c94feb7-2c61-4dd9-9694-b7d285763996", "value": "3072:oWGIf1/UwfhJdU80rvtbYUaDGMsMA9TKXt:oWxN/UUDGlbYUaiMsMApKXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045739, "uuid": "a98716e1-9b0f-474f-a1a1-67949869ecc9", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045739, "uuid": "a64cd325-a050-403b-b7c6-0b0a796d06f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045739, "uuid": "4daabcd5-ff9b-404a-9726-5387a3c0a846", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2b9032-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005710, "uuid": "6019ab54-c960-4a45-8e0d-ef9e3396b1af", "comment": "Malware payload (RemcosRAT)", "value": "32c37ccc01a28e952142a215a60a7fbf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005710, "uuid": "3c6ed1d9-109b-4652-a81d-e58182087800", "comment": "Malware payload (RemcosRAT)", "value": "d0656967dcdc5f2ca217d5d9caa4a75e17f7ad62d23fdc0a71a95579ad3ab743", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005710, "uuid": "d7071e17-a1f1-4fd9-9577-d2db853523c7", "comment": "Malware payload (RemcosRAT)", "value": "db06fa9b8f1ebdb8f65c968b63bd28d8e2131936", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005710, "uuid": "da2d73fd-efd6-439b-9d78-2e38d56da51a", "comment": "Malware payload (RemcosRAT)", "value": "817b8a0a98f91b2ecb76d601d3f40bbdbfc6c182cde9ea749a6e62716667a4bb1d19583c1a1bbc13f9a3e68614bb10ca", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005710, "uuid": "b4a556d5-8f4d-4729-b336-aafb82ec2081", "value": "T11674EE34ADEA903A7273EE55CAC47596E91FB663371EE819108303C646739C2EDC263D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005710, "uuid": "34dbacf9-5b42-4f52-9c26-0d2ee7a064b4", "value": "6144:sk0TgrXG/acV3zeIYMRp9PyNcsyr0XAi/Yqm07Dwl:sk0TgLCzeIYMRp9PyNcsyYXAi/YE7Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005710, "uuid": "62472468-4c39-4d74-b136-07e32bc54052", "value": 352912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005710, "uuid": "59cbc16f-b152-48c0-8855-6f4719ca5cce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005710, "uuid": "46e9799d-1ab6-4f53-bdd0-e0bc5c44d7a5", "value": "INV1967.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba1e5a8-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022166, "uuid": "28030175-e006-421e-aae7-6501c7cbbaf2", "comment": "Malware payload (Mirai)", "value": "5c1dd0b7ba4be249a361f00f9b102fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022166, "uuid": "00d12ef6-001d-4e9a-bec4-2dd01128b5c7", "comment": "Malware payload (Mirai)", "value": "d0de9a68edb496b195291c034c9b1545dfbed89a66f037f94cf530f3ad7e568a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022166, "uuid": "fb19cbae-dfa1-4021-8914-caa837044290", "comment": "Malware payload (Mirai)", "value": "a97b2a7748d069c47a0f111d7ba6fb4af362d2e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022166, "uuid": "19783fb3-06cd-4fd3-b3e1-7ce340379dd9", "comment": "Malware payload (Mirai)", "value": "755b68161aae249869ae080337c5c827d853b4cb500d1fe59a5d6fe1dbb5ec21b4b2ebaa19b016bfaba132dd86da5d4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022166, "uuid": "c448053d-1b4e-4902-bad1-da0f0c444156", "value": "T1B303E981F287D533C80A693927BACB59379379D71E62D200C855EBDCFBA75C06AB4423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022166, "uuid": "4c7b4686-6d46-415d-9e4e-2aa7248c8200", "value": "768:cW88WdNB50sAQvhE/70Ut2R5pOt1gkuZryDkoHg5f8jsuqJ791r49JWJo+Jta7U:cl8WbOtldjsuM189JIc7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022166, "uuid": "338f46d0-ccd1-473a-815f-8e374c56675b", "value": 40080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022166, "uuid": "23fdc241-c0b5-40ce-a335-0905bc4721da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022166, "uuid": "3fa362d5-56d2-42bf-bdc9-c9bac6ddf5f6", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c18e71e-9170-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004611, "uuid": "2a83d771-abdd-46e3-b1bc-e1c2c2dd36ca", "comment": "Malware payload (Mirai)", "value": "fdb0f9be351535a58c460c018ea85cb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004611, "uuid": "6df34099-a6c4-482a-a157-2663fb131c4c", "comment": "Malware payload (Mirai)", "value": "d10233b84b457e4c1f1cda83a505019545e0cf079de1d14e28feedd59673c435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004611, "uuid": "88b87a6b-c61f-4459-a031-d9ef1d787944", "comment": "Malware payload (Mirai)", "value": "d0e07655565e000782cfda97267e7fed4934782f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004611, "uuid": "b5bfe35a-5acc-44c0-9483-b3bcecf60474", "comment": "Malware payload (Mirai)", "value": "0d841803c11f0d5d3ca222abec209e55ff55fe7d0f5e4c2a1bfb271182e689e928f02318fb7a80e5685c4bbe4b5c921f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004611, "uuid": "28c2b8a8-5850-4e35-a619-b7bbd22eb392", "value": "T178244B4BB7608FA1D378D63006F34AA7AAA9229317D39545D36DDE107F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004611, "uuid": "87570425-c371-4cfb-a737-70db6f6d193f", "value": "6144:zujkgxba/v++SEDfrJ3X/e1oasjxzf40csRR:yRaFjTJesBxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004611, "uuid": "749f4960-aee8-468e-a599-e758ba19e9c7", "value": 224580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004611, "uuid": "5d26d7af-4742-445c-b515-538cab4486c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004611, "uuid": "a38c5f20-caf0-4d00-84ec-0bee2e8dce47", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2a6af9-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998837, "uuid": "f31acf9c-6005-414e-aad7-4ffd0f608383", "comment": "Malware payload", "value": "f0b7662322e441c05390ef8eb885fe98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998837, "uuid": "95427595-2eee-41c2-b039-25f601b5e90f", "comment": "Malware payload", "value": "d14fe1970b9f6fa7d17c6fba96f473c4d5f295082327ae19a3c937110e563475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998837, "uuid": "2f0227ab-d845-48a7-bc91-857deba57272", "comment": "Malware payload", "value": "7e8eef739fae7165eb7292505065c0c7465129f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998837, "uuid": "2b087959-deff-408c-a9b8-73c47592ee09", "comment": "Malware payload", "value": "a25cee4c18f1a7ea906395fdbf273529b8afc15d4a5225dd343609091f45446b88567ff2bdf15fb45838b34736041275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998837, "uuid": "fb347473-f70b-42ba-a4f2-0c38464f7fda", "value": "T102A48D1339760D26F4C5A57551EB03A2FAF693CB20BC4B1AF9900CDABF167A071422F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998837, "uuid": "8c71b456-dfef-426f-bbf3-2ae1f0171b61", "value": "6144:2uvuK06b+63piv8zafMd9CEtORZA/Y72s0saffa0Fsi+bGCg:TvuZ/4pA8zakLQruM2s0sdKCdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998837, "uuid": "25626366-3fa5-4226-b87b-87f110712512", "value": 460412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998837, "uuid": "d6dbb2fc-18e4-462c-96b1-21744fd11f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998837, "uuid": "8d77fb33-0ab4-40f1-9c89-614b76f28684", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2335f33d-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786044996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "90492bdb-4729-425a-89b2-b10c7d8814ca", "comment": "Malware payload (Mirai)", "value": "c8b5df3838a6883431430d363cdb876d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "04b14b87-eaf6-4e3a-92b7-42a1416963b6", "comment": "Malware payload (Mirai)", "value": "d19c5610db0025470b17eaf7181100db32dc8a72294d431b0ca798d58536566e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "f43c18f9-bf6c-4353-9a10-3b861b0e8559", "comment": "Malware payload (Mirai)", "value": "615b2208cd866e5944ef53d356475ea25d38443c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044996, "uuid": "a835eaaf-40d8-496d-a6a4-7e2d3a034289", "comment": "Malware payload (Mirai)", "value": "73a9b9c68851855607df81bd0ecd8e0869718933f62c66bbfc366496a6c44b973d19968582bf6e3d3abf91829a1ee850", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "f9764cc8-15cd-4b88-983a-9e891dfc2c98", "value": "T1D5964B37B6A2859CC08BE1746ADFC5F3F974B4F40221206B27965A327F36E900F6D691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "7a336459-8894-472a-ab17-43eb6a7355eb", "value": "196608:h1vuDVYh66O/SDL8DCpWSjxkqgvzif3n47s:h1vuWs6O/uSvzif3n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044996, "uuid": "9dcc1bda-9961-467c-81a2-afc9b403069d", "value": 9438680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044996, "uuid": "306209d9-296e-4e9a-819f-1a99052d8dc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044996, "uuid": "a1cc2ab0-c915-4420-9611-3bb7c1d753e7", "value": "syst3md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fa33ae-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993354, "uuid": "dc939e25-a95a-4ea4-ba64-9381ed7fe1a7", "comment": "Malware payload (Mirai)", "value": "ae4396b964e0fe8e582cab822fcd40ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993354, "uuid": "bf8071be-9a0d-40f8-a460-1170e21a50f4", "comment": "Malware payload (Mirai)", "value": "d1f8e286af318e5854699b8139f9a0cc587d12871b17f5ebfd07bd5cf175f67b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993354, "uuid": "97b249a0-79bb-4811-8f63-8169bd8c3604", "comment": "Malware payload (Mirai)", "value": "921fcdf56299e31aae5b5bb42d2877daa313c9d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993354, "uuid": "83e9f6fb-4053-46d2-b786-ce8b4f1417b2", "comment": "Malware payload (Mirai)", "value": "b07e23987a2a5561fe881491df1a2f25ed083d2d22e897969900beaba8a8ca9c55d2f7935bd11f069f4fda74793afd64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993354, "uuid": "fa9eb9ba-3333-41bc-85f6-1a045b3a1fd8", "value": "T17A24398ADFA50FEFD46FCE30461E031715EE599B93F16336457CDC48B68A2098AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993354, "uuid": "4b6207f4-8562-44e5-9a68-00bf693ef802", "value": "6144:EBZfFemPqGeWeHorGO37OyI1ydpp6RLO2HCJ2pRd4NoHRi0+tkhEn:ERdj6Ra2IToHcMhEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993354, "uuid": "e93516dc-0f20-48fa-8cc7-1871fbc107c0", "value": 216312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993354, "uuid": "20862246-0cb6-4df9-990f-6260104c60bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993354, "uuid": "ebddd0f0-9665-48ce-bde8-b58e0816bca1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f80852-9193-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1786019976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019976, "uuid": "70c95d27-db23-45ce-8a52-8de75692bc11", "comment": "Malware payload (CobaltStrike)", "value": "0689d044737e10bb9764f0e3d07def1f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019976, "uuid": "bcd93217-6723-48a9-9253-46498f9ad125", "comment": "Malware payload (CobaltStrike)", "value": "d1fdec2d2fb38eb21e69a9c93e55f0a42917f1d3bec19fb1e63d4a12cc0807ea", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019976, "uuid": "11933bba-1ba8-4d8c-a873-4de80e1a4be0", "comment": "Malware payload (CobaltStrike)", "value": "d350f6e5d712c389f863c98e0f2abc4caa5924b7", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786019976, "uuid": "c4a43e2a-25c5-4dc5-9588-f3433e9127c7", "comment": "Malware payload (CobaltStrike)", "value": "7ad7143f0922e1cf18fcc117cd112dc97bd87b54a26b90badc05199998a6955605bbd10980bce1d348cbca3566c6d708", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019976, "uuid": "b17c8696-8e59-449b-8759-713ff015884c", "value": "T113346B5A73A50CB9ED738139C8534E05E77278560771DAAF03A0425AEF2F7E0663BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019976, "uuid": "01ebf58c-9569-4f31-9de4-c202053460e0", "value": "daee8d8d036e662fa740ea3e5ae4388e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019976, "uuid": "c6f3c4cc-720b-496f-8894-13266dff815c", "value": "3072:iUkNcnn+wsnEDSHHND6xXhLEkAGGf214F7tbTblJvian9QqUAjoY46Fx/Bb0Oa:jksBiwwND6/L9AGGf2kD7LohHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786019976, "uuid": "45ef4cce-02fb-42ee-a9cc-7f095153519d", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786019976, "uuid": "7c88c8ba-ac04-4c85-9d19-2964d61d6603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786019976, "uuid": "ce0d8428-b043-4e90-8d62-abe0a2fccc9a", "value": "ServiceInstance.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52281685-9143-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785985375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985375, "uuid": "ac226339-6433-4367-9544-c615efccb130", "comment": "Malware payload (Mirai)", "value": "76bc76350ed078d4de82972a9b01f79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985375, "uuid": "ed1ddbe7-eb06-46a0-a759-09d494dd6e33", "comment": "Malware payload (Mirai)", "value": "d1ffb7ec3dcaec3400d22859583a961ba661a78089a561b9092b455e017788f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985375, "uuid": "54662878-dd05-4684-ac5e-3ab61961ccfe", "comment": "Malware payload (Mirai)", "value": "b243fd604f24249d0061756f4ba5e9122b15120d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785985375, "uuid": "9bee62d8-b731-4114-9be8-fd32e0258583", "comment": "Malware payload (Mirai)", "value": "7ed563b2b990f0fc04b17e2e07399fe786790410b6e76fffc49057abefb1783fc274e1c13d82252a375e601b03efdc50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985375, "uuid": "4c7126a6-70bc-43b3-b5ad-cb5b7db63db4", "value": "T1898312674C4E8685FB876434A489A3143651371D5DAEBB36E3CCF07EA8BC4E9E090C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985375, "uuid": "f4cc4337-4853-4fde-947c-11c225c1bb05", "value": "1536:/jN48MgA98131Jfrkqj6ggF0njQhDuZ5UNXXkRIlDUK+KM9t2r4whZ6iRHMgBq5M:/jNZM18B1JTkCgFgEusXXWSO9it5q5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785985375, "uuid": "e6f57b3a-f7cd-4e70-ba6d-3e92f4c84077", "value": 84112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785985375, "uuid": "0a5b564e-eb07-4dc8-8435-1bad47cd6f69", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785985375, "uuid": "16d91af4-1709-46bc-ad38-c2f76a9efb64", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d838b438-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005786, "uuid": "6e6f0057-6d3c-44db-9ce9-0802b265becf", "comment": "Malware payload (AgentTesla)", "value": "f796b8900312190fb1f4b929feb8e9fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005786, "uuid": "26ad322f-7136-4e9c-83b7-84e2e32492bc", "comment": "Malware payload (AgentTesla)", "value": "d2989c7149d41251cb115b49880da9c819d3823299ffcd187fba5b23a36e7f4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005786, "uuid": "dc53a4c8-ebaf-45a3-a985-aeec12b44114", "comment": "Malware payload (AgentTesla)", "value": "435ecf2a8e10abdc32dee30ea2aed337da2eba79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005786, "uuid": "52cee1d6-6a88-4429-a370-3aff10aa0a34", "comment": "Malware payload (AgentTesla)", "value": "29a32c206c071bba4e69550b1a10ef62e79ee15c3aefe58d2b14ddb67bd970b0f09a23c8994a9d77cd231b19e4279c77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005786, "uuid": "9ec63910-284a-456f-93d1-f8b551e9e3f6", "value": "T18355A8ACE476BF1C2F92F35FC685E46615A1E6860B03FADAD47C54E600530B0ACF54AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005786, "uuid": "4f8e9629-e1b2-46cf-a2b0-fbb0ad971ac7", "value": "12288:va43QE4CtLpFECfhQz3Zvd+4MMPkjcnMRTAE4QvjiuAhxlhTdXQtK48yyCzIThp4:varZM4Pxl5dXQtsCaieqhhEJULZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005786, "uuid": "eb82b0c4-420c-4a80-9405-52492692f8f5", "value": 1326175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005786, "uuid": "09d30355-8117-400c-a9a9-6a39ff7cf40b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005786, "uuid": "e92e6bf0-ebd4-457a-8075-9b873722553a", "value": "Zahlungs-IBAN-Best\u00e4tigung 06-08-2026 pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6df0bd1-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978752, "uuid": "49de4093-1a6c-46e2-aed2-abd8140ed54c", "comment": "Malware payload (Mirai)", "value": "d6719c0006c9386625606121267c9643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978752, "uuid": "c696fc37-6848-4a74-88e8-7486d4492b35", "comment": "Malware payload (Mirai)", "value": "d2ee4c98c10d1d6b51792f0cd7afb69de916dd33db6c635e61e4cdff715aabe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978752, "uuid": "69f1e2a7-fd2a-4b46-9806-314a34cb762e", "comment": "Malware payload (Mirai)", "value": "8d2c7e4bf60b9ecceeac659d40c18d88cbddd2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978752, "uuid": "d9e57b36-35c3-4885-a1d8-fa716cc46da1", "comment": "Malware payload (Mirai)", "value": "1d755859a5d4d99bb002f7627b043018a20c71fcd301b96839a650bc57d4c3f2cd1178188c8d338f2115e4e3acf42a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978752, "uuid": "241dfafb-e7c9-40ee-8221-1ec01579a022", "value": "T11DF2F2FF63E4053FDD231232D31FB1D4A87EADA8CB4A45B366C44186E9E5065263483D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978752, "uuid": "fcc8311e-9def-4b92-9fad-c054c28f079e", "value": "768:AEu0ps+ere5PWBEVOUp2BX1X/6vtgPkt6TEzhG:AElPYEDmZ/KtgcoEhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978752, "uuid": "476c083b-f0a2-4a2e-8a12-b873dc735531", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978752, "uuid": "13b27d5f-f219-49de-8b23-49ff91fd7e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978752, "uuid": "b487dca6-0972-4ca4-90a0-3aa0276e949a", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72af4c23-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "b27ef590-606d-49d2-bca3-afdd34fad79d", "comment": "Malware payload (Mirai)", "value": "2995075d86160acb552dd2819ce5015c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "4539461c-0e54-46fa-bf23-3f31314ff3c2", "comment": "Malware payload (Mirai)", "value": "d3fa2dc23f90c19b36828887b0f70b1e1477a3e5229d7ca8b4ef38c6d609f90d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "28cfb437-7b3f-45e4-a6be-861dce9b42a9", "comment": "Malware payload (Mirai)", "value": "4ac2066f544c3537724b5e8a71c22c7aa515b646", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046847, "uuid": "0c741d2e-4cfc-4b36-8372-504fbe4fe9c1", "comment": "Malware payload (Mirai)", "value": "81ce6c103dd5a13e56274d2da821cf5a77c665b1fcbfa495aeea1c32bbc1ce065e40607cdf8a2a7538fbae81f6d0bf2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "5bc9ccb5-b393-4c7b-9c90-e703b6caf80f", "value": "T18EA34C86FB93E1F0D94605B1111FF77D9634DE225024DE5AEBD4BEB2AD32A02921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "efbbdc6d-cb59-4c44-8802-9a8c3dc15082", "value": "1536:Tw1BTL1BZv/tlZx60V0c3Ra/oPDQJVrJU/310vntiZvnwl7/4qKU7yuEfr:yPJVlZx2c3A/oPD8GClSC7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046847, "uuid": "7092e25d-4182-4942-bcda-db0e84d8bc68", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046847, "uuid": "08bd66c9-0afa-4783-af8d-3d86b5b15605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046847, "uuid": "347a79dd-d242-4cc2-a492-61f0107211c5", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f80299c-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "5783c0e9-52c0-41de-be7a-30eb8c5845a7", "comment": "Malware payload (Mirai)", "value": "5231ed1dbfe0425c5fa579bd60081c2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "e2f2d391-bc26-45d2-9aac-b4094d27fca9", "comment": "Malware payload (Mirai)", "value": "d3fe0331ae9065f925eec0d5af521042f8cf8ea3749bf19519b59ca0630bd8d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "23a9efc9-e2d9-4dea-85bf-a26f10061ad7", "comment": "Malware payload (Mirai)", "value": "1ab5589cf4e2ad3831ffe5826a1cfb4bd1e402cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "7dbbd9c2-ff14-496b-b661-49c61f1c362e", "comment": "Malware payload (Mirai)", "value": "d650b2066af1b77c45623c41a7378208d0ce33eb96d0ade561cf23419af868091849202dffbfa297b26d14b0e5545178", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "e6d797ee-8c7c-4cfc-b676-ac52057519f1", "value": "T151934A25B9392A2BC0E4957B11F78711F2F6634D25B48B1E3DB50F8AFF24A4029473B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "a1e5e938-7da9-4a55-98c6-5d65ea2a2311", "value": "1536:O6CMmLzQI1Vk1Ue6PFl2AVay2IphY3T5EKxntCi08T:JCMmIX+PX2AVay2Ig3NVEt8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045554, "uuid": "204778ef-51da-45e3-8b8f-ded4fb36a943", "value": 89032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045554, "uuid": "b8d5db84-5f6e-4d90-bb9b-2853507435a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "8b270456-8b9d-4e36-b53b-4bdefabc958b", "value": "bot.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1353e1-918f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786018090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018090, "uuid": "05272f00-a5d6-4b12-b771-7279d7376e51", "comment": "Malware payload (RustyStealer)", "value": "7dee819b76bf7a145dc60d279411b721", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018090, "uuid": "0fdf8d4b-2e52-4628-8e3b-635442d74cae", "comment": "Malware payload (RustyStealer)", "value": "d42b84a94d990cb280c33739284c7a2318e466754584d9c99de7fca99d650157", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018090, "uuid": "7d5eac36-27a1-4da8-bba8-e29b20524242", "comment": "Malware payload (RustyStealer)", "value": "19da7a33ccc9c5cf690f7cc9dcca33cd04c95e6f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786018090, "uuid": "2707eeda-f659-4a51-8efe-cee8e4139556", "comment": "Malware payload (RustyStealer)", "value": "946f616e2f9e10317b5ba27053ec518effe248a3d2929bf64f146afe02fd75363363aa71e58094db6cefb194aea3bb27", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018090, "uuid": "9c8c720f-957c-4f0a-9507-3e8240aa3ecc", "value": "T169B35B13765260FDD40AC034832485A6A772B4D91F326BFF13B951382FAA9E66F3C764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018090, "uuid": "d36d3a37-e82c-48d9-991b-f2827537b45c", "value": "ecf84c95f525add7966ad084604f852a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018090, "uuid": "1c9ca54b-a1c9-4894-8b5e-9b8adbf2695a", "value": "1536:sAc2s4wFvjVReYNjK6iV9tmCyLU7nz9qe9kmsp5bvA8RUsEnDGRDb/:sANYvPpjK6iDtiUHcCg5AXKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786018090, "uuid": "8b64b9a0-d7f5-41b3-b7ef-a0614332d98e", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786018090, "uuid": "6a3519e6-e641-4c4a-aa70-70a04067fc48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786018090, "uuid": "a19da4f5-647f-4e5b-9d62-e47c35fc4241", "value": "\u9644\u4ef61\uff1a\u4f53\u68c0\u9884\u7ea6\u53ca\u62a5\u544a\u67e5\u8be2\u5ba2\u6237\u7aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63438b6a-9134-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978961, "uuid": "12511e70-a8e0-4992-a2f7-7aa6d2ea4ca8", "comment": "Malware payload (Mirai)", "value": "56b90a061f0553534f4861de3e6f864e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978961, "uuid": "8827a253-e4c3-4cbf-b333-72ddfe17d443", "comment": "Malware payload (Mirai)", "value": "d44a14c3cf5307a005c7831bee40fdbdffdb78dd9196d3265e032c4f433d3069", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978961, "uuid": "afb3394f-8a2d-4aa0-93ff-fbd4120836c0", "comment": "Malware payload (Mirai)", "value": "c805772f02d7d7b194ab0a313cf0953ef2875fda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978961, "uuid": "d75c10a9-ce31-4db6-ba75-ebaede0f9f18", "comment": "Malware payload (Mirai)", "value": "4f266c2353155d5f3af82c52530105e3d310d358a4507634defd9641e276278c23165826c62dac19383ae380b259505b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978961, "uuid": "ab38c8ac-4220-4c86-8f0e-3300d557f679", "value": "T1C0C36E989A1F9D81E2C3D6BDED694FB331363CB40664C3B24E10526DD8E9DD68CA2533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978961, "uuid": "8fe418ff-3328-4751-bd7a-79af341149ab", "value": "1536:iwEAu5FBEJyXGtUU4Z1VNWVMmqw0LRQ/SysCrbZ3e5vYK/J2C+QPeoVuBKau5Ir:hEAuegXWN4Z7NNmqwnSV45Q22uBKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978961, "uuid": "2d0189ca-3a37-4660-9766-1e2890b28b5d", "value": 120712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978961, "uuid": "851622dc-690c-4fa7-b795-f0abd0803537", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978961, "uuid": "745f3c5a-59ee-4df1-8d89-481353b3e349", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b97a0ea-91ae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786031320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786031320, "uuid": "68c6b716-7076-4d35-80e1-70023e349548", "comment": "Malware payload", "value": "6cdf392aec1501ccc4d5197d798b44d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786031320, "uuid": "2bc184b6-7c64-43d1-9dd6-087d95585526", "comment": "Malware payload", "value": "d463f9f9ed1418dac675115ca0f8ae093a80ea56422f8402b6123570e6a04f1b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786031320, "uuid": "c79fc127-57f0-48d8-84f8-d23b4056c82e", "comment": "Malware payload", "value": "98621517b9ebeb00489cf101c0ce60907055b4aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786031320, "uuid": "ebb6ea82-9e7b-40b7-ad34-e2093bf9a8e4", "comment": "Malware payload", "value": "2ca547c498402fa316c5dad804c6595d61223a7168ef3abc697837957d8b72be000f5c549cfee89480f50c478ae37784", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786031320, "uuid": "f87e5af9-a926-4f56-b6d8-75fa1cb1c616", "value": "T18CF08C07A48BF136808039A8AB66F75AFC24BC876262CE4CB840BA50DFD24247861244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786031320, "uuid": "71e9dee4-7cd3-4fb5-9715-9962cb7bbab0", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXY:lk1gYpTr8i3fOq2bf8IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786031320, "uuid": "5d7fe51b-6216-44ac-bad9-492577181116", "value": 494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786031320, "uuid": "2bf6978d-36c2-4053-8cc2-46d312a4d38a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786031320, "uuid": "60e4fb97-1044-412d-ab03-4dc0d61ee9f6", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b710e4-91c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786041153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041153, "uuid": "fd541226-661a-4957-a521-95b9fef025bf", "comment": "Malware payload", "value": "2065e6b9d7642c49de0a0d5c486978b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041153, "uuid": "ac287ba0-5901-4dfc-b7c7-0f86cf68f4cf", "comment": "Malware payload", "value": "d505e2297629a1cd2d9a85825cb0c7b02f19674a80f43216fd3fb365c22bca80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041153, "uuid": "de4d13dd-91ae-4867-a884-b36612d5c2e9", "comment": "Malware payload", "value": "1c12e22bcd2706368fb542f09c71ecd219154b61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786041153, "uuid": "0c41abdc-7db4-439e-9769-1376fa28defc", "comment": "Malware payload", "value": "8e38a4eee75fd6fc5561547e0980557e656860d69c2463f455732cd98c5e4469554b03ddae6006443796f43580b14f9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041153, "uuid": "5f3b218a-c40d-4190-8de2-94d2f5525610", "value": "T17B734A14B7E8A15CE2FF4EB97DF112A40779F9863901DA5E0CC2118C5E26BC0AD15B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041153, "uuid": "8a0cb931-c63b-49d7-b05f-987dd0a1ed9c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041153, "uuid": "af25f9aa-2266-4a93-b82e-53691d53d798", "value": "1536:muQthGqQstE1mOJZFz05LOJvq3gXb+0aL0S1z6nrc3CK/:Ek+mmOJr05LOp6gXb+0c1z6re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786041153, "uuid": "c919aba5-2f58-458e-b03c-8fa4b4f21bb7", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786041153, "uuid": "50e2029a-dce1-4d83-bef7-a5301f3ab278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786041153, "uuid": "286a210a-ff1f-4be0-b7e8-9cc12f267a0f", "value": "stage2_inner.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5c314f-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "6c40e194-e1b2-4bbd-ad9f-4ad0a8c17052", "comment": "Malware payload (Mirai)", "value": "759d37c6eda3a2edb28afde064ccc98d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "4ca44b43-ced4-48f4-9933-e96d4f3663fd", "comment": "Malware payload (Mirai)", "value": "d508e13b9504a5129f1c6541c382a906e1558b05f03d8ccd1c3a57df30ecc12e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "d3becc4e-6aa8-48e2-888c-b2ed2b98ae51", "comment": "Malware payload (Mirai)", "value": "f6e14033ba2f5a9f548c1d42054f1a649a8c4e10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "65a57738-82ea-4746-9b6b-13089754b8e2", "comment": "Malware payload (Mirai)", "value": "f136af83756d7d5ba5868ebcef7582c2e1bd062c257cf1c0c1df0faed9f3e72bad44502549406594120966550feed812", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "41b5b25e-c199-47f6-818e-3202da303201", "value": "T147734BC4A9C3E8F5EC12093C607F6BB29E77F53E1179EA97D7E86927A801602D50235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "c1173aca-f52b-4940-a55b-7757e8cffa91", "value": "1536:j2KtLEqT0Dmi1JFerNkK+Gm18HQ0zqWtRGvuqD7vrjKUAS1jzz:isLEqT0Dmi1fINkFGmCHQ050vrjWUzPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045553, "uuid": "4a0a9837-b514-464b-a9aa-7ca7a8bdc506", "value": 75632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045553, "uuid": "bcdde3c9-adfa-4c4f-aad2-db683e44da89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "c00702df-241c-4c47-952f-ef4703c016f2", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7713b1db-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "d24705f8-630b-4cf2-ba5d-21194a44189e", "comment": "Malware payload (Mirai)", "value": "345fac6a092b1ef570cd32217d9d955e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "359a2a25-e8aa-485b-86d2-1ce66e47fb7d", "comment": "Malware payload (Mirai)", "value": "d52b45c4c705f1912901bccdf21a64a714ef359eb73dd831e54da1076eabb3f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "236b0bb8-2015-4949-9a84-d57f7fcb193d", "comment": "Malware payload (Mirai)", "value": "1c5789e351081bc5f3f0fb4d8513552ced664d6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "0a45af7b-872d-4f47-87dc-41583c68f446", "comment": "Malware payload (Mirai)", "value": "f3eb21b7e31cf3cf114991c9d67bbff21da0ca98c5b0e2c541719b73cd9db16e5ff06ec4b91dba987616a1e7ca37d5fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "0208e6a0-0342-41fd-97c7-eb78304a376d", "value": "T1BAE4CF63F6719ED1C8020BB414FAE2304B59D1A613927591F3FAC2052C8FA66FDAE774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "de52fac7-f18d-403f-8ce0-0a459d8fc24c", "value": "12288:E9dub7nOPsr6SAlrx6584c+5VMyxgvusTDCUjF8CapKgHdk:MduDbk65Lc+XmZF8h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030963, "uuid": "ec9e11af-99ef-4870-9fa4-59d96ea48e52", "value": 660168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030963, "uuid": "299c9928-0a62-4203-8f28-b985db0ab688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "e675ac51-8895-4cee-a098-5e49f7ca408a", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7622de9e-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786005192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005192, "uuid": "e8fd0a4b-b198-4cbe-8b56-83c93b610df2", "comment": "Malware payload (RemcosRAT)", "value": "aec651e1d4029eabfbfd8ca3dc6c02af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005192, "uuid": "25851daa-ad09-44d4-987a-9ff34b674cf7", "comment": "Malware payload (RemcosRAT)", "value": "d55810c4d73327ddfa13bb3603699cb46a7a8b61d34823ade9c1dc6416e666d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005192, "uuid": "a813a4a3-ffe7-49ab-81f4-d040bb1ba463", "comment": "Malware payload (RemcosRAT)", "value": "18e932f187055925aa28bef76eaedc39a67891b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005192, "uuid": "3ad67258-8c58-4c89-9f7d-ebbb4a2262b0", "comment": "Malware payload (RemcosRAT)", "value": "b073e8988380d6c766bf0d6a28f66c190270455df9538f4fc0dd2498ec621cc31d05fa14350bbd2b5a0a870db96dddbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005192, "uuid": "2414b76e-1a26-4133-98d8-0433f0d48673", "value": "T159250BCF6371091C74893A0FC8386E9E7A96CF830510FCBABDA5594BC51C74293A5B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005192, "uuid": "ebb55790-73a4-4d2e-b418-c39908e631ec", "value": "3072:7FwZ2j1dROFz4XGF/qluI9nSMatoAU1gXc3kjBar2N1ruVTT+M/SCyCg+rZsk+Na:vpgwwGc/GYh6zfwIDmZry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005192, "uuid": "a56d48fb-3a3b-4ee0-a21b-9bbe12446dd6", "value": 1041454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005192, "uuid": "dfc4803f-b3b6-434f-a60e-31067b2be8db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005192, "uuid": "53ce6f64-1b28-45d1-a64c-a5fb8ee2e9da", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3186344-91a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786027709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027709, "uuid": "552e3c8d-9ba9-420a-99af-ed115fa7e78b", "comment": "Malware payload", "value": "ff2b978d9e0f1f82ae81c423b4e5012c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027709, "uuid": "f0480f7d-4f15-4eaf-940f-7f3b6e472827", "comment": "Malware payload", "value": "d5b948179c8cc33e4cbeebe0369c7dca452d968646a588d730341c3879d64880", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027709, "uuid": "47bdecb5-992e-466f-8bef-b307a8779845", "comment": "Malware payload", "value": "c11ac64e929538bf4de9c493cfc76ad0aa395ee4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027709, "uuid": "9899fd44-11e4-4db9-bb9c-62a49894cb93", "comment": "Malware payload", "value": "23f1406545373f09c5f74eef5ab8b525b2456700518b480d527c9e1ef3deaf50e520a5515c2ee2c1f3726605802d2df4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027709, "uuid": "cc3bd016-16e3-4f39-87df-1374382bf86c", "value": "T1D68633B2A3371C28F1E693349CD5350119568C618A57678F78DDB13C1A737888BEEEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027709, "uuid": "a30776ef-9339-40cc-a467-c22071a229b8", "value": "196608:z/azDJaeoZo8QJP5RQV3fc1A/oM7SK3ZozlBFlF7u3fFM:DSkeoZNo50c1A17Cl1FMfFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027709, "uuid": "54716ba8-063f-4f96-bc38-67037d2d4314", "value": 8023361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027709, "uuid": "7f66d8a5-8709-4697-9e68-3ea27e75fc95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027709, "uuid": "d98899d0-0c60-4050-a27a-cf98ba72fa0f", "value": "ClaroRed5G (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cda72a-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048384, "uuid": "e9ccdb79-1f2a-4b80-b00c-c19dfe3cf1f0", "comment": "Malware payload (Mirai)", "value": "8b14c7e328dbc8d09b84579b2c4cfbc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048384, "uuid": "236975f9-67fb-4ede-adf0-1ea4c2d3de2a", "comment": "Malware payload (Mirai)", "value": "d64ac81c3240c53c93180b8da0e823a5b07b4d3620ee5d79000f21ea376d860a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048384, "uuid": "73137d26-6c97-4d18-b6e4-6410e8a1de6f", "comment": "Malware payload (Mirai)", "value": "a8b6efd569f4f8298f5477b2afc34acfad3fd0c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048384, "uuid": "4fc575bf-cd9c-4ff5-8a2c-2fb6a6cd50fc", "comment": "Malware payload (Mirai)", "value": "93f9b079f17f4f1f313549857e7cbcfeec3e51715ff8c805395b5ca2443daad6d1fb138d7ac2b9fba0ffe6738efa8b73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048384, "uuid": "06a62ea6-8b1e-498a-8f92-01f287fa8f44", "value": "T179135D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048384, "uuid": "72a26774-984a-4dc8-bbc2-499ff15d1ca8", "value": "768:s7QLYeiLEKRBTMjONrElzbFjUDK1JvaUIou4M+DoIw7wZhP3I3cPHPbC+g:ZEbMjOU1hzIowIMwhP4Mfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048384, "uuid": "9ee4538e-1f80-417b-90f6-b39e9eaa845f", "value": 43832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048384, "uuid": "d788cd56-1f88-4ac8-8a9c-d14e94ed6db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048384, "uuid": "3f7058bc-a7ba-4ee5-8771-410a1b315306", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fd99fa-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1786040952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040952, "uuid": "8b83eed2-98fa-4fa1-916a-e4c0ee2419e0", "comment": "Malware payload (QuasarRAT)", "value": "3c41ab1ca6e12d9302f35791686293d0", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040952, "uuid": "93bf9bea-4db4-4ce3-926a-927c86292e29", "comment": "Malware payload (QuasarRAT)", "value": "d6639cd7dd18b5094f229a36cadda9aec9aa9cd269e59a0c40f05760107c62cb", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040952, "uuid": "5620ce8a-423c-478a-ab6e-ebc61c15f47d", "comment": "Malware payload (QuasarRAT)", "value": "0d72af6b419b66067dd54e8524e4f05c29248807", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040952, "uuid": "d3801b3a-f719-4381-b36e-f4f4cb7260db", "comment": "Malware payload (QuasarRAT)", "value": "8ca19fa9339096279f57bacd7cf525e09c4e201c231375555f3766dd525ba1703249ded0b6fbfbef5e0a50b4c59f9c97", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040952, "uuid": "eb7b4dbb-a67d-4c30-b7b2-f15f7d4be322", "value": "T1EC01D6D7001EE47FCF23CB25D7198686F127DA7088EE334A6272585A7801A0533D96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040952, "uuid": "3573e118-3a53-4841-b9e9-a855fb92612a", "value": "24:3LD8Y+M4Nzxkj9mS1ATxTS1AhxlS1AlxmAS1AHxm1azAV8APAj8AJ:3LDXwUmSiSCS+SFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040952, "uuid": "7fc28306-94c2-4969-a5f2-bc8a6656edac", "value": 800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040952, "uuid": "c635574e-8151-4852-9417-e64fd29cd089", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040952, "uuid": "9e561a7f-7457-4dd7-b20f-555a9e93b286", "value": "load.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c2d35a-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "efce79bb-e62e-430b-956a-c89772c825d7", "comment": "Malware payload (Mirai)", "value": "aeb05800e737a735f5e722825ca3ef92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "a5a17f52-ed9b-4d91-b759-40064b2a7747", "comment": "Malware payload (Mirai)", "value": "d67aa0999565f6a528f5dc624ff18feeb7c45525ebcf0ee07b491fb2e7586014", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "171d75ec-5ecd-44c2-9af3-4474db86289c", "comment": "Malware payload (Mirai)", "value": "fc48f1cee84e904624ac5120f6f6497ecd316614", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034397, "uuid": "fef75bb5-d4ac-4401-ba0e-10ec04f599a4", "comment": "Malware payload (Mirai)", "value": "c1246dbe3ace0664e84661384a824177ee2cb67283dc605e1e0224b88870febc005cc8de880b86ec9e2e59eb746b85f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "95235661-be4f-4d3f-a964-734675fe5e81", "value": "T181C3AF73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "f48c6e59-0c84-4d39-a1fe-72b7e7b68843", "value": "3072:hfpZykqkt436I+9eIHEmNOkSMPXeC4GnHr:hRZ0F3BcfNOkvZhnHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034397, "uuid": "53afc81e-2ee0-4487-8642-cda186730aef", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034397, "uuid": "2f4d282b-3940-4c7e-a46f-40f2edc17743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034397, "uuid": "911440ba-5630-41bd-b22e-445567fee920", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdb5a5e-91a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786025470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025470, "uuid": "76886809-f39e-452a-b3aa-d4b786394595", "comment": "Malware payload (Mirai)", "value": "46ffc1723363dd6b46c76d346815ee8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025470, "uuid": "b5ba71f7-a3cd-4029-b77a-adbc0ecf9a3d", "comment": "Malware payload (Mirai)", "value": "d68dfaaf3fafdcf4eb14ac5fc595f28d1437da28d7a684ca57af114d3b0b6482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025470, "uuid": "ea8139e0-7a29-415c-809e-d2559c7c684f", "comment": "Malware payload (Mirai)", "value": "c14e70004384cb287e5e5657e20262c24f36ebc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786025470, "uuid": "75918c98-5696-480d-ae49-dc40bb0271b3", "comment": "Malware payload (Mirai)", "value": "0148b3f56a8433459ced2775347fd7b6ee08604e2f9cd20bfce912fc39c255fe8e8a3a145292185aa2f09c6b1c836e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025470, "uuid": "5ee4f65f-088b-4fef-872d-1f4fdb4e65ac", "value": "T14FF31859F880DF62CAC12A7ABB5D428D331317B8D3EA7102CD106F3577EF95A0B2A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025470, "uuid": "c14628a5-68a7-424a-a2d1-c6b90188b278", "value": "3072:ajRJtlqzXahbc1cvSgTaoOmxO4MbB98OGTt7Z4CX1eCf0Qf6drp:ajR8zXah41cvSKaoOmxOpB9eTt7Z4CXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786025470, "uuid": "c0f6ba0a-fce0-4790-9cca-273faaeac90c", "value": 161364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786025470, "uuid": "169c59a2-78bd-4f0e-9d75-219f9df869d2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786025470, "uuid": "9f44a948-e2e7-4db2-96d7-e44048394a8b", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5104a125-918c-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786016726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786016726, "uuid": "2257ce9e-1e8d-4b37-b67b-734a769f29ec", "comment": "Malware payload (ValleyRAT)", "value": "fa17542bb8f2c7851d7efa44e6ac4285", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786016726, "uuid": "a56299d2-2648-4664-9539-94469e378e7f", "comment": "Malware payload (ValleyRAT)", "value": "d69b4a62494417b8c975512ecd3daaf0e5d76a0c687efa18c8dc8d20420d1332", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786016726, "uuid": "48bb5dd3-b87f-4998-9af9-765ee7c4589a", "comment": "Malware payload (ValleyRAT)", "value": "eb701d8356dd3521d862fd5161a3937afa16fa76", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786016726, "uuid": "09555514-d7d2-4947-a04b-03e9a22a1176", "comment": "Malware payload (ValleyRAT)", "value": "e80436c05c4703af4b760f7fb34f762957282ed756fc375cdcd1b7b134a8f3af725a6f94286159c2e088be1f4f2a74e6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786016726, "uuid": "7698234b-12b4-4261-95a7-f9806e80f5e8", "value": "T1FD673333F38A913DF16A593219B29160583BBB617C174D1A8AEC34ACCF395A43D3A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786016726, "uuid": "d3da848c-4fba-4354-9681-f82f305f0520", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786016726, "uuid": "a95a290b-8031-439d-b2e7-8737a5fdbcf1", "value": "786432:R8vnPrtCgn+n+xzhnhAFjzQ2nhQqYC7BLqePSjb+1Qgax66:R8fsf+xzhnhAF3LhQqfLqeqjb+1Kx66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786016726, "uuid": "0657c7d3-d03d-4118-b886-766afb295210", "value": 30966296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786016726, "uuid": "96651180-f634-460a-b69b-7707dac21c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786016726, "uuid": "05caaf69-1c4f-4585-b488-2594936377ae", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ead5ecf-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785983597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983597, "uuid": "31ec874a-99e4-484c-8fb5-bb0326fe279f", "comment": "Malware payload", "value": "03319ce88bb10dc9b695ae57a619463a", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983597, "uuid": "be40e936-1bd4-4c24-bd94-023f9af97dd4", "comment": "Malware payload", "value": "d6d7444a1d99ffa5f99e0ad5d41c69916e67b57fa005a785b338160b15eb90bf", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983597, "uuid": "442bb358-3356-4be9-8434-fc9685dccdb9", "comment": "Malware payload", "value": "47412e5a95ec3d9324c0e3c87662790a7ef79b9f", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983597, "uuid": "394993d1-261d-4f1b-a47a-d3d502da073e", "comment": "Malware payload", "value": "6fca0ae5a2b49b5826dc7c252a2625f4f50e69628e5c875b14fbda23d691cb403753ca890dc3b55672d0c7608a6fe261", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983597, "uuid": "169ff7ea-38a0-4052-9776-3b43e0d4d82d", "value": "T12CD5239EFDB31531E036C3F3819720AEF21A7B8087658D5676C92B206D539286C7737A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983597, "uuid": "c90f6d78-25a4-4035-b7da-9898c0836006", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983597, "uuid": "6c4b5d85-1285-494b-8ff6-11d456b32b66", "value": "49152:VejFwDKGX1i5SWchAujnXonPqauRxB536uxVvTzpL885CS0lsj43BVJWgbS0gr+x:VejFsX2SwcmPqauRJxVrrHcjbSLHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983597, "uuid": "a22ffdf4-85c1-4716-aef5-705327568604", "value": 2960384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983597, "uuid": "8e1d267f-c851-4935-bc3b-b49d278e676e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983597, "uuid": "506024c3-6baf-476d-90df-7077566aa9db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f426eb8a-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040193, "uuid": "b499fb13-cab7-4508-ae09-70283dfeb9bd", "comment": "Malware payload (Mirai)", "value": "c9eaa3f3bfc4800837b63325dc57a480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040193, "uuid": "3d0b39e0-e918-4422-af90-7688dd4ef2a0", "comment": "Malware payload (Mirai)", "value": "d74281d2c78d17f1cec2001aa1cbfe34e0550d5f9ac387c778aa1499f50521e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040193, "uuid": "8274c520-9828-46f5-bc64-35851e14783e", "comment": "Malware payload (Mirai)", "value": "691dc5940351d2a40e520911c9a70b9bd81ce426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040193, "uuid": "596d8092-8199-409b-8b5b-cf9270116e57", "comment": "Malware payload (Mirai)", "value": "3116fe04b8ce2f3c8e9dea9ce326c113c419aa44b7d68af321c3dd3be295452a3436eb4e9be493de8953b1342f4cd4fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040193, "uuid": "6f2e9f09-63e8-4f89-90b7-f063a3e856b9", "value": "T1C1444907E357F4B0D4470175330EDBA6A936A871A820885AF7D27F69F9B1AD0D60632F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040193, "uuid": "45d4a923-4c76-48f9-aedd-67c1f7d0194b", "value": "3072:QOTlgKatMjgRrCXmENnYX3FVJOTOZa2+CckZiyZ43UvVuk+FgPO7O/Juw5zy112:WtTRr2mExoOTO07LryZ4hnkf4wwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040193, "uuid": "1f33529a-0ef0-4328-9f0b-303ff8386730", "value": 272444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040193, "uuid": "6c6210a7-bdc6-44b5-a848-4718b05292f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040193, "uuid": "5e476d9b-0f57-405c-a23d-4f6342ad32dc", "value": "pope.i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f866e14-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "74d1fdd4-c982-4710-ab7b-fbd11fa7a425", "comment": "Malware payload (Mirai)", "value": "f0103f19f38a5e7eeb7123669c88a7a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "63d9d2d5-e751-421c-ad68-6b0da2c026b3", "comment": "Malware payload (Mirai)", "value": "d78f4421f0d376b27ca846db228dc6a94f3af11c9044c6c11435b306974cb3dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "735908dc-3e52-4152-a8c5-a6feaa7452c9", "comment": "Malware payload (Mirai)", "value": "28820a3034fb5dbf32705f74e3a273aa8751b731", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046466, "uuid": "d9bb2f65-1b5b-49ab-9ab0-524089ee6f57", "comment": "Malware payload (Mirai)", "value": "c47478a7a06151c5047d88aeb112a35d95c359f82ce71c097adaeb3ff423575a067a482938969f642f2186a7300c26ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "53112a7d-0718-40b4-bbfd-d29bc36888d3", "value": "T18C941A5463F1D2CBD244E97493227F15ABB2063634B7B28A324EBB6313F327545DAE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "596f3762-1f0a-4ad0-a9c2-a7999c32f050", "value": "6144:iAPIFu/nIdxrrLf8jhA5rPVB/2u5EZBP+ykHxTSCc3DaHx+/:YknIc9U82T42x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046466, "uuid": "608ce243-6c97-462b-ad7f-672f690a4de0", "value": 409608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046466, "uuid": "6e440026-b4c2-45e5-bb88-245a28e5b145", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046466, "uuid": "5632695b-6f32-497c-bbda-d158ce1e1c72", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ad22ea-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785978782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978782, "uuid": "7452f10b-0cd6-4141-8823-fef9ed9788df", "comment": "Malware payload", "value": "d2ef3e4a44441fe4284ba28f7c9f203c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978782, "uuid": "f98e0cf6-905f-4a5f-b33f-15cc2d7de685", "comment": "Malware payload", "value": "d83ef44a44e68fd1bed4e81209c4f62913bca52f60c245f127527ff6757cdffe", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978782, "uuid": "9a140caa-82dd-42b5-b125-d9166d65e905", "comment": "Malware payload", "value": "837db5b38ad691a6c6a6b813bc7cb63a4ea6d378", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978782, "uuid": "8a556c67-c76c-4798-9f69-03444972c067", "comment": "Malware payload", "value": "a0925f7b57430f61689c622587b2be1a5f14c43b4518e492a106ea6f771a97f8616b67882e980fd75e370ff0ff0b1da9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978782, "uuid": "31044702-3bb8-45e2-bbc0-ca9f961caf46", "value": "T17AB66802ABC1E9D6E3141933C4750D733EE54A986D216A3E1B14E1EEBFFE342BA511D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978782, "uuid": "38bef22a-eb98-4b43-8dfe-d299d342a283", "value": "f67e7371d5a4cc2cec9f3d61b9959c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978782, "uuid": "c44a37b8-b5cd-4cf1-9b6a-f3a37fa0e29f", "value": "98304:WdtvSFRs4ejJZ0xUhRGjPV0IQ35qNMgk6D4v7UB+B0nB7RL:WXqA45iGjPrQJYpkEmUBC0B7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978782, "uuid": "86928230-bb99-4fcc-8c94-526fbf0ec553", "value": 10818999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978782, "uuid": "4810ee1c-2e85-4dbe-80a2-8d90abb7d767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978782, "uuid": "fd74334f-fcd4-4e00-b65c-872ef10be285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e5bc01-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004088, "uuid": "e10990ca-a027-4c94-bc32-392992713c2a", "comment": "Malware payload (Mirai)", "value": "c30f55fe7cf7201128ebc32080ffdd05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004088, "uuid": "78ef5e74-8bc4-4e0d-8670-ec88b0908d0a", "comment": "Malware payload (Mirai)", "value": "d86401e1507a61715abb5606199d1a11e01e4b523ecab921b9aa9c94447be18e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004088, "uuid": "5be6fa7d-fb76-4bbe-848d-eb30f095b6ce", "comment": "Malware payload (Mirai)", "value": "3aed704f095466e90dbc6a8edf51f32426022cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004088, "uuid": "677b44e7-90a9-4ee1-9f11-fd5a141f908c", "comment": "Malware payload (Mirai)", "value": "e1af0b67b9b688d476d1be7478b0bbe8646771a3b3058cab12b3f764927abc7aebdd3254cde2052b6b5e3a00b29911f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004088, "uuid": "0cb1b332-8153-482b-8005-de984d8f340e", "value": "T1D553730ABF610FB7EC6BCD3349A9174635DC641B21A93B3A7934D818F20B25B59F3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004088, "uuid": "c8843da9-e7e9-4543-8f82-f676b0c7473f", "value": "768:JT2mDenl3FRfqMyeCNM0dg0eb59AexeYkeZGEQPXiiM7GZfaoc7v:ZNDenlVRom0BEAMdkaGzkGZSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004088, "uuid": "e70a7a5f-dfef-4603-aa97-7851bc777a1f", "value": 65300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004088, "uuid": "e6314ea8-9664-4e1a-9107-f0b0fd792212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004088, "uuid": "bed63591-9eea-4839-b815-2fd7c8b3a739", "value": "126b61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60192eef-914b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785988834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988834, "uuid": "e36674c3-12fb-43cd-95d9-64c3b2857b83", "comment": "Malware payload (Vidar)", "value": "fc08a3a1024262383e7fa1cf53d3075f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988834, "uuid": "a8ee0f5d-df1b-4782-a36b-ed21d5cb4938", "comment": "Malware payload (Vidar)", "value": "d885303cfd814a385066003267b91a1b00e5588db19239752c7b4899afdbd700", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988834, "uuid": "9473b1fc-8cdd-4e9a-ada8-8d0cb9a85dbf", "comment": "Malware payload (Vidar)", "value": "67b769cb6336de0bbee8d83b48621e440a871c38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785988834, "uuid": "e032a44a-b7e1-4175-94ab-ae81612e070b", "comment": "Malware payload (Vidar)", "value": "ddb326feb288c40502c8e1aacbba37ce6fad1d3dd6a862933384cda82fd807d71532128048ee4c5d64c3a15ae2f4f1c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988834, "uuid": "b004cf5c-9a45-49e8-89bf-99899c5df9cc", "value": "T1B2468D43AD5297A4C4A2E334887A4395A774FC8E873833F76C60B9BA5F327D05A79701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988834, "uuid": "048a2c61-e99e-4993-9fe1-cb58fd8c29ee", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988834, "uuid": "b99f3a6d-2f1f-4305-b026-648c4f576bd9", "value": "98304:3IEmRcWVVPKWtDvASfzeowmeqhpIboMerXd:3EcWVVHtDoSfzepqhpIMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785988834, "uuid": "c9d586fd-bcb2-4145-9030-e94529c7f418", "value": 5394504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785988834, "uuid": "7f3e33a5-150f-40c7-9105-b180e9228956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785988834, "uuid": "cddd593e-4abf-4e8a-a799-4ed91bf57dde", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cf4134-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "c8caac79-c37f-4d61-86ff-c55a04c0dd46", "comment": "Malware payload (Mirai)", "value": "c3dfe3f3b318f48e684994d0e83c1b31", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "b3e742ac-265d-42cb-9d37-5d93ad70ca22", "comment": "Malware payload (Mirai)", "value": "d93d9b733dbd17c9b1d60774e2be07aa06ccfec66425cef2c6bad882854155d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "0e537ccc-3acd-49ef-8ff2-543adf1ecebc", "comment": "Malware payload (Mirai)", "value": "f991580071d57fee5eec725beb956d7c444bd19e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050577, "uuid": "d835598f-736a-4eee-95ab-45d9657ef04b", "comment": "Malware payload (Mirai)", "value": "da9fa8099d583b56885a81e84b4434d0ec6238c613934ec8f68bac18973c5113ed9321dd9d85dfa276f62c063226dd34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "3fbe3025-0477-4b3b-a01b-d778458dfbd9", "value": "T1EB24E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "f611045e-8448-45c2-af34-5e61e0dd78cf", "value": "6144:BJGbATqHMcX7qloyeJa3iVf5L56WeFjmhCj6a2:Bkb1McXOlYJa3M8We9mYj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050577, "uuid": "76d6aa19-2563-4ae5-8884-ec73e5534ede", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050577, "uuid": "797ffa3c-cfe3-43df-b28b-2e9998aca42c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050577, "uuid": "8f235a3b-d2b3-4e29-8d01-e24c9d1ed7d0", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95043eba-91d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047764, "uuid": "72847e80-4bc3-47b6-8fbd-a3d4f111098f", "comment": "Malware payload (Mirai)", "value": "1c35a84c33b23261e39eee8356939382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047764, "uuid": "a17e4156-932d-431c-ae9b-3679483a7894", "comment": "Malware payload (Mirai)", "value": "d9e4bd6be54066ccf55cea80a218e69cc687c2a1067af5e24b8a949532853955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047764, "uuid": "a9bbf6bf-0487-4525-b65e-15cc27e852c1", "comment": "Malware payload (Mirai)", "value": "5d9718139d78ea4107480c9576ff10ad5b86b808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047764, "uuid": "508e7cab-c17e-4abc-916a-30446a211e8f", "comment": "Malware payload (Mirai)", "value": "ee1e1f720d93840e50029554742757c3a54cedb7659afec139e631d065f730033e3e4fdbe4c9bde943ff2a70563de536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047764, "uuid": "907ff052-6bae-4bda-b666-8595a4afac55", "value": "T1E4E3AF97B20F2050C82606F81BCB5BAD2A3325114E6FA6E67C6E763F16775DF28063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047764, "uuid": "e24ee3ef-9495-4369-baa5-e40b72949969", "value": "3072:2lgtXI9Zu4EXnwztyKCzHBVQxk5s+5oJpgMCwSe/Guq:2lX9Zty8cKaBV8EeJvCwSeFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047764, "uuid": "77fcf969-0207-4fd3-a642-a7a7815fa2d3", "value": 148952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047764, "uuid": "364346f5-1378-48b8-8dbb-c5839bc96ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047764, "uuid": "dbac104c-cea1-44f7-90a7-f728219c8226", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad2221b-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786026111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026111, "uuid": "a560694f-37c8-4841-bc61-96a17d8fa814", "comment": "Malware payload (RemcosRAT)", "value": "cbe5b6d348f1ee5ee320801bd9b0d055", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026111, "uuid": "720af3b7-27e1-43cf-a7e2-70c139c89566", "comment": "Malware payload (RemcosRAT)", "value": "da195e43d62a6e527e4625b53ec54df68c5209ac8fa6a6acb06a8b99a7f48ea1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026111, "uuid": "32465c66-6c7f-455c-af57-258f0c2098f8", "comment": "Malware payload (RemcosRAT)", "value": "ef5016960565bae75415cfa76da4f2cfefe02c50", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026111, "uuid": "8500da50-9267-4eae-99d7-46a566983dcc", "comment": "Malware payload (RemcosRAT)", "value": "079feeb84b1dc7b87751f145ac889b88d11f10fb15559e22b1550b459267637b1c38b52059ebf81ad0d390d1cd5368b2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026111, "uuid": "6b629dcd-7127-42a5-94dd-ae8d53f5dfa0", "value": "T10A151212FE414937D99297380F93A2D1E60CFC1B9E6A4A0D1B85337D793BAF4D562C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026111, "uuid": "e0a71ea0-dbeb-4447-8313-fe86243ff387", "value": "24576:XKxt1QRT/64rmBu1UiVNV+tNyBuL7wcG:XKxtmB6nu19voNa+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026111, "uuid": "73f5b948-6b40-48c5-8730-2403609291f7", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026111, "uuid": "bdbfe415-5d27-4ba1-9844-cfd0ccdd6307", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026111, "uuid": "0a15d211-c0c6-4acf-b1c1-181047af8283", "value": "PO2166040 _PHARMA_PLANT(RUWAIS)copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e310fffb-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786026850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026850, "uuid": "0a821898-221f-447f-916d-fe3b7f955a24", "comment": "Malware payload (PhantomStealer)", "value": "e6671290b2940b1f9439e29d5a45953f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026850, "uuid": "3a2cde38-0d80-447a-ac05-8dd4c7032c09", "comment": "Malware payload (PhantomStealer)", "value": "da65fb1a2765de3abfab49cafcf660e00737318e88d618d878a6f0b3207e0092", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026850, "uuid": "a7e57979-21d8-4a57-b408-8df8675c2cd2", "comment": "Malware payload (PhantomStealer)", "value": "78113b6f3780f46228cb19f140207b1030ab681b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026850, "uuid": "0c7368a6-31c9-40b4-8cf1-1ced049ea6d8", "comment": "Malware payload (PhantomStealer)", "value": "db091288d54b8759840fe72feecf649e7017262ff2138f889f0f5ea8f5585e5b2f943f24543230dfaee0ee5d1b4dc842", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026850, "uuid": "b05c14c1-6ab7-4e47-96ba-caa959a41921", "value": "T186F5B3D06FFF6281597AB328F04ED84C4B4BC5185C86FA6030EF6A85960F1AB5F9059F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026850, "uuid": "35ca1507-e413-40af-99ef-88f71fcc7cb7", "value": "24576:t6wJs6YOCiXX1L57iG9TbovTAcytexsTDPtisFxMh9QYr3DWZ:t6wG6Ysr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026850, "uuid": "a473cccb-4ed8-42e2-9760-ee7632ebeca3", "value": 3603780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026850, "uuid": "940497b7-3e94-437a-9a59-0185728a0a1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026850, "uuid": "d2d0fa0c-b9f3-4b18-afc4-fb3aa7e1a86f", "value": "Details Of All.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e709c01-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021983, "uuid": "32d6e977-acec-4b52-9874-4d2e17093e2f", "comment": "Malware payload (Mirai)", "value": "fbcffbe5d3c872522ff7b4dcf47b268a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021983, "uuid": "65d3b177-e90d-411e-b217-c03c91505d53", "comment": "Malware payload (Mirai)", "value": "da8c479c595e43bb952b8011a5d15c35e69a45371e887b8ebf1f74aee5804a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021983, "uuid": "0153261e-f436-4ad1-bf8c-4b373e402ab8", "comment": "Malware payload (Mirai)", "value": "5ea768958457c031d1a842c3f6b23de659ed356f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021983, "uuid": "f1d3d42d-dc71-49de-b0f3-31851257fc9c", "comment": "Malware payload (Mirai)", "value": "10d1702dbf642846a080c48b1ae23f16b51e66c35a935c2442f0461523c48106031f6d8d7ec7e6c4bcec21202ea0f675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021983, "uuid": "807ca94c-68a0-4c63-891d-e373503e5be3", "value": "T175437416AB619D77DC1FDD3301E8860124CCB49762A92B2BB570CA6CF75B98F09E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021983, "uuid": "888f05f1-86f2-48e3-8c3c-1db753ccbd36", "value": "1536:TMOfnCaQaGLNhiXPJpGypTJyFn3B4g5UBhJ1:9nCasN3nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021983, "uuid": "9281b0c8-3c38-4baf-9895-a09a52172e0d", "value": 59056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021983, "uuid": "2cf6bbd6-1420-45ec-9387-c08283d7b12f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021983, "uuid": "41872037-e4ee-4b4a-8386-7593a2be2b19", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab99efd-9132-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978276, "uuid": "a9dccc19-ee42-4a2b-91cc-59c726cda461", "comment": "Malware payload (Mirai)", "value": "3d9ea1dd79b437600ca53caf184a186b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978276, "uuid": "8a9d453f-ceaf-469d-ae35-06e40b6dea22", "comment": "Malware payload (Mirai)", "value": "db0b0357054178961f2f9fbf1bec670cb1f84aae49537ed401bea4910c60b7db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978276, "uuid": "9cb063b8-cf31-47d6-a1e2-c6fea8f15642", "comment": "Malware payload (Mirai)", "value": "b502c07510ba5c84d42b17594d0af48b9c7ccef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978276, "uuid": "defbcdf1-39ea-4c4f-a8ed-f64041e453c0", "comment": "Malware payload (Mirai)", "value": "874c21cd39638780947f1c1e2106dfff91e5caac404c03b268616a71e2f8bb8f507094274a003d9a98a2a392737423e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978276, "uuid": "1d2bd956-05f8-4806-9d6f-a779dcad9da8", "value": "T188731995FD429A12C6C115BBFF5E828C771B43A8D2EE3207AF159F20368B95B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978276, "uuid": "3c365437-6c35-45cf-98d2-30f86f841b81", "value": "1536:iSnVZE+XyaLKNwWaWQTHbCFOxtCJAopKfx9Jaju7EpvScqR8:5nVZEfaLkfaWebPVoENES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978276, "uuid": "5a1e8f51-be71-4b22-9f94-101f91aa6ad9", "value": 75268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978276, "uuid": "847d00e7-51bc-4794-9d82-474cf624efe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978276, "uuid": "accd6256-0ce6-4eaa-b9a8-1bdc4bf11b24", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41776c5c-9137-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785980193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980193, "uuid": "8a8d9fcb-6804-4e2b-bf54-c1df58c9be22", "comment": "Malware payload (Mirai)", "value": "66ad681cfea3a4adc9824ebd1e237cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980193, "uuid": "2c6b3d99-c959-4f64-8887-3a1454ea2cd4", "comment": "Malware payload (Mirai)", "value": "db444503cda9f6734797db51f8b159802634cdace744431867741475203c8755", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980193, "uuid": "ac062fcc-9baa-49e6-8b5c-245d350ead96", "comment": "Malware payload (Mirai)", "value": "907b5ba7c639099a3b45bacd738879a3a8ad6370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785980193, "uuid": "1a3633a3-77a0-4df8-a055-228465c1ddf9", "comment": "Malware payload (Mirai)", "value": "338bf03d99d4fc7c694839d5de9556a56fb9b7844a034a20b6a9be42cefb241feaec411d922412679ceb9d28fd4f476a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980193, "uuid": "a68169dc-d599-4b2e-85b2-c4baaa7ce5f1", "value": "T10CD31205BD30E5F1EDBD38EECA662D288C60E0D5B6B20FD857E07D1996A3E18378546C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980193, "uuid": "ce2154d7-fd95-4c34-a3df-05bd62f3dec9", "value": "3072:HGIwE0mwxqRnx/0KNxq7YWNf6s4x2fNmWQdyWgX+PF+BH3v:mfE0mwERnBhm7J8shNtwra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785980193, "uuid": "8720f540-14a2-4b76-83a8-0d0d93ff83fb", "value": 139012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785980193, "uuid": "8f153ec1-6020-4a3e-9cb5-30ef9566d617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785980193, "uuid": "06dbe56c-a56d-418e-b628-2857407e1051", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566e4ced-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996119, "uuid": "5d128ffd-a4b3-44cc-b8b2-2e5832d5c0d5", "comment": "Malware payload (Mirai)", "value": "23c4a83edb1e1f5a21d584669cd0a97c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996119, "uuid": "abba60dd-f2f8-4613-a7d3-885eff768f39", "comment": "Malware payload (Mirai)", "value": "db767ac958aeeb3a2ed0ce577083484bc22dac69fa1c9563757b84744aca9633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996119, "uuid": "08df75bc-0d15-43a9-a56c-5f98e9e12e47", "comment": "Malware payload (Mirai)", "value": "b8a61c2185e59f2f115a5bb79748269f5e234ca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996119, "uuid": "113de5cf-134d-41ce-a5c6-818ae10cfcb5", "comment": "Malware payload (Mirai)", "value": "b1fe0858da9af7b7a896c0e9916f86bf84fc31b332b4ce4018d994581eb83f1ddca6eccf97c298953d3675dcfdd65ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996119, "uuid": "ac7bc6c1-2a70-4509-a567-ae59410dd910", "value": "T15EE37F99AA1FAD42D7C7F7BC9D694FB230373CB40165C1B30A00625DD8EEDD68CA2562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996119, "uuid": "05be349a-8283-44b9-8f50-e2b817d309ea", "value": "3072:P+KfPYFpnDoCt4MrrcjIun+u9Lt475J2cvKE:WKM1t4ercUuL9h4D2CKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996119, "uuid": "196edf64-71a8-44a6-b5fd-a60e85442e9f", "value": 149384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996119, "uuid": "bd62f97b-fd83-43c5-bb69-79d2f22be86b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996119, "uuid": "88f297e7-784e-4705-b4d2-fd4305d9e743", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec2d592-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786005287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005287, "uuid": "df5d32d6-4a04-4472-add0-166183338073", "comment": "Malware payload (PhantomStealer)", "value": "41bd5e2d5541f706767cd981ef00e12c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005287, "uuid": "72a44781-9bf9-45a2-9851-d13d5ec4268a", "comment": "Malware payload (PhantomStealer)", "value": "dbb9231ff1fb45b101eeb44d6d2157863035dbc364ce8f726560ef0f833fbfdd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005287, "uuid": "12764170-4b93-4a66-8eae-222331ddc9db", "comment": "Malware payload (PhantomStealer)", "value": "09833ffa84ba4f1f504a095213792a367960aabc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005287, "uuid": "6f3d7bef-9c60-4daa-b50f-405adce9356b", "comment": "Malware payload (PhantomStealer)", "value": "24f76d0c7ba8219dd3d738e96422bcf45f596f2c9122a877cb4a08c336a739b46662fc2ffee0c10c1364b5772b5f480d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005287, "uuid": "c9895db1-c961-4322-83d6-74e39511165e", "value": "T1FF730F55099678806337A7BFA32BA8E5F7764A6701802817B87C7450DFF2D09CEE0EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005287, "uuid": "cbdb5eb4-96e3-4927-b3fd-d15395574cc0", "value": "768:gposePX5kDay2YnWyVzuin/NvR86ZWvguEJon/D0Cyjam8k5yCIIAw49kw0gp8qA:WUs4LtDmxw9YVeJJN+cFMsXd7sx1TqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005287, "uuid": "8dfd4dea-8c56-48f2-b047-6e21a1d507c3", "value": 78461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005287, "uuid": "19e3391f-e0cb-4b64-be3b-01cce23e0b91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005287, "uuid": "30b6be11-800b-4084-a148-94c7505018b7", "value": "Payment-receipt-ref8062547pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2c5a69-916f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004211, "uuid": "4d9cc068-915d-42fe-a99a-ff53ff8b3889", "comment": "Malware payload (Mirai)", "value": "b162873b819857862c16281b52b6bbf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004211, "uuid": "6c7ef43e-9866-4660-8711-6d29f1f633ed", "comment": "Malware payload (Mirai)", "value": "dc18eb6dddde0cb5da9440db58c6f2f3621eee0c5b6d8b9e33f3fa8594887824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004211, "uuid": "bb56c9a4-d685-407c-98f9-b3b97bc296e7", "comment": "Malware payload (Mirai)", "value": "0fc36f6a5aa3783c86dcc144f4dfdf8db6979afc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004211, "uuid": "8cb82538-b215-467d-94f8-dc47e4a60d54", "comment": "Malware payload (Mirai)", "value": "3e0a7134624f663c52847415015a0a619099ba9d7298d153fdd35d09d6ef98c865570e5353f925a7c209020b01ae8d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004211, "uuid": "74106720-c174-442e-8981-2d0dbbc711cb", "value": "T1EC232B42322C0A5BC2B65AF0353F56E0D3BFEAE020F4B588655E9B4A8575E371186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004211, "uuid": "ce2b9560-1d20-46c1-8cd4-e8fbf5ebbccf", "value": "768:oPhpy89vJX7EW1BN7nXNRbRT0Fv7dIcWaR/mBwMi9o8bE:UNLEW1Bhn99A7dpWYEwMC1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004211, "uuid": "cb52a321-6c66-47f4-890f-fc3c5f777d64", "value": 46772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004211, "uuid": "fc83082a-1696-4f9b-b3e9-926cdfa3b8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004211, "uuid": "e2188339-7a31-474b-bcb7-d625a432f4b2", "value": "b5a50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31f3294-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786004086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004086, "uuid": "56830997-30fb-4cd1-adc6-75510ef588f0", "comment": "Malware payload (Mirai)", "value": "626ac6a8b3818bc07371bac501a88c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004086, "uuid": "e854f708-a0ed-46c0-9993-9ff9d203fa08", "comment": "Malware payload (Mirai)", "value": "dc1cb0114c4f1aba299eeaa25ad6a771db6cc559bd128051aea000d4163fc825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004086, "uuid": "e8b94f65-662b-453f-8803-675ee1dd1a0a", "comment": "Malware payload (Mirai)", "value": "c99d80db9a995a782b4828a75e1896a9cfde18e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004086, "uuid": "469b46ed-d370-432e-9d5c-58e93d4a1f24", "comment": "Malware payload (Mirai)", "value": "386a7c80480be6373c3b166f71e65d06dd3fbf7faa40453f96ed50b0f3b8fc0b3c425598ae3b1bf7a96c9d4c0c04325d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004086, "uuid": "7def2748-41f0-434d-ba9f-27d3514b73ef", "value": "T16A13F882BC929A66C6E4237ABA6F518D336577A8C2DB3213CC211F0077C951F0D7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004086, "uuid": "84a5223c-d5f3-44ab-919e-03b0a3b0f9de", "value": "768:GpvjX5bMmp7ocky0hkwSqBbihWkBPWRVox0XuENwuptV4GTo9P9PN:qX5AhfyEkBPKCCtV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004086, "uuid": "90d7680b-907f-47fe-b4b6-899f4fe51a4c", "value": 42212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004086, "uuid": "96d4f500-369f-4735-b939-1dc6254dd9a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004086, "uuid": "cbcc2e60-e4cb-4a7f-878f-c2e95cc1d260", "value": "bb4476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f538aa-91a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786029272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029272, "uuid": "40acefeb-a5f4-4e16-a52c-39b8633384b8", "comment": "Malware payload (Mirai)", "value": "51e2fb01495535cc39c34023ff70baa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029272, "uuid": "9c905cf8-bb15-42a0-a8a2-36d677eb8aae", "comment": "Malware payload (Mirai)", "value": "dcb4c8c6b34b946056cece4ae827d0e872c82a9303300a35e77990b7096b90d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029272, "uuid": "71ef9ede-05bd-412c-990e-d26bf1de5b89", "comment": "Malware payload (Mirai)", "value": "ed6605242c1ddf937c5564200bbf66067f9a4f66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029272, "uuid": "0c7c6925-8da5-453e-8241-855851f76e83", "comment": "Malware payload (Mirai)", "value": "9ea0941e04f5428f3844c70d428afb42f969df194fe72bf861e78becdb205d21f9409c674884cb235c3bae5ffbdd189e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029272, "uuid": "2f519acf-1f1d-42df-8330-96037020ad93", "value": "T18BB43A51FC419B96C6D12ABFFF5E828C732317B8E2DE71129D195B2072DB85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029272, "uuid": "83cab7cd-fc76-45f4-8e1c-ba2638710242", "value": "12288:QjqlHXoCzNtwXeDeIBvlmID5hiMsaWI9M4TySuZI5eq:XXgtI3XBt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786029272, "uuid": "5fcd574f-6e12-4744-b0c8-1896748db903", "value": 509984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786029272, "uuid": "619a83cf-08de-411b-a390-467226697dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029272, "uuid": "fb181d3e-b9ed-44df-8c52-4dc43ba4af74", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d57559a-91c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786042866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042866, "uuid": "965d9e38-4e84-4030-8e8f-8fd5931236de", "comment": "Malware payload (SalatStealer)", "value": "266f2cfe9aecf638c06b3efcbdd07756", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042866, "uuid": "fdbbb32d-c230-45a6-8676-b2f0b5326afc", "comment": "Malware payload (SalatStealer)", "value": "dd17e871204619a3de34126e366221b64e684ec13e24dfc871698abe343acbff", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042866, "uuid": "c8b55085-c482-4041-b771-5de247d003c7", "comment": "Malware payload (SalatStealer)", "value": "2dab1463c97284de02f3abb10812c45eed5fe6b8", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786042866, "uuid": "bfcd0d41-0b4a-4da9-901e-4f21fa7f7fab", "comment": "Malware payload (SalatStealer)", "value": "0650d4903226add01d58f72def21acd43756f0e8a96fb12d4bde990e96e75a138b40d7b0c6f92eda7866548ab113c08e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042866, "uuid": "5b1d594d-d24f-4308-8bca-2616882c0aa4", "value": "T11CA57D1AFA6404FDD167D178C9624906FB727C8E03606ACF23A059A75F376E49E3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042866, "uuid": "19490bb7-ad8d-4683-ba56-87e61072d7fc", "value": "fa36d7b9c6f9b5769cd72fcad04fc5f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042866, "uuid": "5d92ff4d-cbf2-4e29-a993-ac1104c0b3a4", "value": "6144:r/OnI0EB2bE0Rtth+X5lHdyxXVgajyEomhEZTVAUy3snOu:ia2bvM5l4gaijjAUyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786042866, "uuid": "d63717fb-7451-4e30-b9d8-fa490626e765", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786042866, "uuid": "5adbb43e-5aea-49d5-91d7-45cb7d210764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786042866, "uuid": "92cd8201-9cf2-4b23-8535-b1237e1780b3", "value": "Fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04323b5-91ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058977, "uuid": "64a93c37-827b-4281-8a86-263f983fa2fb", "comment": "Malware payload (Mirai)", "value": "56610f03670af192bdc3014d5407ea71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058977, "uuid": "0931d0f6-04f8-4036-a481-269d7bbb0b68", "comment": "Malware payload (Mirai)", "value": "dd2f2a49b031dab67adaf17071779965ca4d79eb3e1f81be633716493a54d95b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058977, "uuid": "cc4ec581-78a1-41df-88c4-c2bea82e6471", "comment": "Malware payload (Mirai)", "value": "b9e070caf435b3686b6ab69e513d4a0d74f97e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058977, "uuid": "c127c421-29ac-4fa9-b02f-0ffa95836fbc", "comment": "Malware payload (Mirai)", "value": "95b389c2ee529d599949d9a15732787a0532168cad4120c369e671c20ab15afcef758b47443cb9be5d68978df4a6941b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058977, "uuid": "aa163540-85c4-415b-9664-35c6eb715218", "value": "T12CC329A9F890DE52C6C52676F74E418C33231778D3DA7106CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058977, "uuid": "deb36891-c6ee-4fcf-b63d-ff1fa675bf3d", "value": "3072:8E/eDOpvJF41gFIXbcYEEU5ajMWxNwhUhGw2P7KNyF3j+uyf1Dl:8wEuFCbcYEEU5ajMW3wst2PnT5y95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058977, "uuid": "849cbe57-fde4-4e46-ae9e-d188802a8890", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058977, "uuid": "a8cecb7b-c2ba-4465-8c3a-5b86ece224a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058977, "uuid": "a302e4e8-6c68-4de2-badf-e91f51c07e66", "value": "c0e6f1d6af634fab562853ba2cd3e20c4b75e5a5a424f9a39bb464fb8ee695e8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258ff779-9159-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785994749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994749, "uuid": "710440f3-8311-4561-ab63-26c835195c42", "comment": "Malware payload (PureLogsStealer)", "value": "bf33a9d8c54d1a3532388dfe43d1add6", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994749, "uuid": "00926643-7a3e-4b8c-a50e-c17d4c64c84c", "comment": "Malware payload (PureLogsStealer)", "value": "dd490f5e80460d13b9424541da5fbd3aaf0a2c458e98bedeea03c6d99d036780", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994749, "uuid": "9f10a290-6316-4d35-a6ef-2bbcdcbc728b", "comment": "Malware payload (PureLogsStealer)", "value": "f04fb602220995b2cd58842f65861e752ecbd06f", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994749, "uuid": "25a8ca72-8305-4e1b-a8b9-464e50d24d4b", "comment": "Malware payload (PureLogsStealer)", "value": "6dddd938225a1a3d18bc7e9772ffd15aaa0cec547b513ead44e36032e10cb6826359700c9a1524ecdf929021c8198a97", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994749, "uuid": "93aafbc1-3d88-4876-875c-685c815ff74a", "value": "T1CCD5939EF125BA451FBAA30FEB80D4A90575BD168BDBF78B6C6DA1D30203A306CF1415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994749, "uuid": "2aeab610-f743-4e84-aa0f-53fcf9850811", "value": "24576:pQT2M8zY45BmWOE5o3L04xzG26OK3JWhAX6gA7c4pJ6hjVLG876O2Wk3WMP3X+Un:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994749, "uuid": "575d7393-fc99-4079-b9cd-66c91edc8e90", "value": 2910977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994749, "uuid": "1797f5ea-1c21-4523-b409-7659a0f1d9b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994749, "uuid": "ba0e136c-ad5c-4d90-981b-475d1addf59c", "value": "DOC BL, CI& PL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f76656-913b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982165, "uuid": "82725fe3-facb-4e82-a299-1d11738f28a7", "comment": "Malware payload (Mirai)", "value": "97878209df43fa41623069d297468192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982165, "uuid": "9d1f5290-a681-43a6-856d-026076bb9aff", "comment": "Malware payload (Mirai)", "value": "dd60f1a53de66a16846e426f6972a17ce668eb7b6586c846dccdfa04e01e313e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982165, "uuid": "9fb6b954-97df-41a6-b098-f83d587e55c5", "comment": "Malware payload (Mirai)", "value": "e4e191c74a17a8c00f42290af868cab630524faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982165, "uuid": "8e5c2361-0e88-4628-aaaa-db8ea1309cc0", "comment": "Malware payload (Mirai)", "value": "7bab826866b2c002abe6361cd876a1ee49fcf690e2ddd70e0877bd798a6d77d0640a9cd033d17250fbe20632753573a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982165, "uuid": "938d0adb-e985-497b-adf3-6f38dca91a9a", "value": "T1EF732C02B70C0E47D3A71EF03A3F27E6939ED58122E4AE88394EAE459171D3255C6ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982165, "uuid": "1d9fe2eb-13e7-4a12-b35a-a727a09dc5cf", "value": "1536:HNZWZCQwQwQwf+6246yktuGRNtopGVaaPRyIi4Xh/XYrBycqvNX:H/Or9VaaliHKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982165, "uuid": "de0571e4-75ed-4d9d-b669-ec41b9eb2636", "value": 76160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982165, "uuid": "98f6f4e9-6083-46c0-ab57-e436827c2532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982165, "uuid": "69b9b0b5-65d8-4bdd-ae49-f28c11899a6d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daab585a-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045733, "uuid": "6ccd7a10-5124-4637-b349-04e6d846ce85", "comment": "Malware payload (Mirai)", "value": "74923703fbd36d83ebeb6123e2a77246", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045733, "uuid": "f381ab67-fbf0-4537-88e0-2e38294fd160", "comment": "Malware payload (Mirai)", "value": "dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045733, "uuid": "eb610902-017f-41f3-a8c6-e34321903fd3", "comment": "Malware payload (Mirai)", "value": "0d0aa021f523d5d2431a2d4a8d62ced18caed68e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045733, "uuid": "415f9af0-25d8-4c3a-ad9c-2e6f84e2b4f2", "comment": "Malware payload (Mirai)", "value": "c4766312c09fec96771dbc3fa3596f09802337ae1ae3bbd6110c29a95c1be30529afd327b57d78a35ace1325edbad944", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045733, "uuid": "9717d51b-f33c-40b1-87e4-f35f517a9890", "value": "T1B03182F4B3615D71394D8F2CBA6421E1C6873DD5A4EB34B4D4439CC82A6D21CBA1AB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045733, "uuid": "9a526cd5-1d39-4eaf-bdc8-84161ed90915", "value": "24:TX+GBYAz0FMpMdkmgpTy5LgSbq8f8qm94P:6WdYFMpMd3gpTy5cfhx9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045733, "uuid": "3f123c80-2ea2-416f-8566-4ab795c97e0a", "value": 1793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045733, "uuid": "ed62d781-4c99-4ba5-abb1-b54057cb7c3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045733, "uuid": "623cd6fa-df62-463d-bac3-97ada6dd3a61", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fca3edb-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "81fb614d-5367-441a-a4d8-69742ef2bc9f", "comment": "Malware payload (Mirai)", "value": "37dfbec2ba9f9a8c2b429ba4feb0dab6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "803b3023-2c25-48c2-a309-99cd389d6b44", "comment": "Malware payload (Mirai)", "value": "dde5411d955c44f681783d58c927cd7367aa36635906573f25ba67fa59bf61c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "e342adcb-daaf-43e6-aaa7-775d16bea5e8", "comment": "Malware payload (Mirai)", "value": "c90791b1a9a8cc018eb64c3feacd874c230455d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "0be600b8-7e43-4ad0-8c2f-a13c7afa8514", "comment": "Malware payload (Mirai)", "value": "59a3397573ea683e66353e363a2c2ad118eba23dc281ac25789e5733e4c97438b14028a6d2b75020f2026a015335ca13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "11958428-4610-44df-a93d-1e658a1958a9", "value": "T1D4F30755F880DF12CAD12A7ABB8E428D33231778D3EA7102DD106F3577EF95A4A3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "591924c6-2cb0-483a-a46c-475c29200788", "value": "3072:ui0ovHPhni9L7YP+whCUQxzKaX9Ew8vlzwUn5Sr24/ncaF1WCB6QofElrP:/0ov1i9L7YP+wIUQcaX9v8vuUnK24/nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047997, "uuid": "3fac09c3-4ec9-4590-a014-101a91fdb90c", "value": 169568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047997, "uuid": "81d2b084-0749-4b1a-b3ee-a117a431003d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "4dc5cf9d-086f-4758-8c1f-d1085d935416", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058e344a-91de-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786051818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786051818, "uuid": "e098c507-58c8-48d4-9a93-8fdfdd8d9ea2", "comment": "Malware payload (Mirai)", "value": "47f2cd037bb9439174574900ee32c421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786051818, "uuid": "25f0bab1-0ca6-4ffa-9a91-e71f94419255", "comment": "Malware payload (Mirai)", "value": "dede2a29a045c3d12dce4b04347a3a4aeb95936f0117a399eaa15eb7d295881f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786051818, "uuid": "0e581746-82de-48db-b0c8-88a6e7681ed8", "comment": "Malware payload (Mirai)", "value": "168865ebfed9dc3a009815107122107fce6d9b55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786051818, "uuid": "e3b6dd25-3d0b-4bdc-8488-d6274c4b1965", "comment": "Malware payload (Mirai)", "value": "a0167d63182deb986a25ce06739e37a4c56dd6c7d29318f3949db8a98394be5ff9b21351b95d74ee46acc7b16b312ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786051818, "uuid": "a7c04039-22a5-4c35-a291-729820e721f3", "value": "T1A4F3F84AFD919F2686D116BBFB4E428D772A5398D2EE3103DD152F24378B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786051818, "uuid": "3958d23f-d26b-4e14-aefc-8cd2af350684", "value": "3072:kJ3PN65WmjekuyLAo8hgVbquQiTGFV3b5ZMLfKlv3ftKYjx:Wc5rGysjGuu5TCV3b5OLWfftKYjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786051818, "uuid": "56b83f71-4454-478b-8535-a3805ef56723", "value": 157935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786051818, "uuid": "8772d136-ca87-4aa9-9739-c606e0122571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786051818, "uuid": "ca398efc-92ab-410e-a931-dd98e43353ad", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6218c7-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786049013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049013, "uuid": "955cef97-1132-434b-bd9c-bff6179b5497", "comment": "Malware payload (Mirai)", "value": "ed476ef9181071c6688b6b7c0f83f839", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049013, "uuid": "93b48e74-d53c-4604-a501-687f076f995b", "comment": "Malware payload (Mirai)", "value": "df9fc12451968b58a2c3eae0344b761963bdc8b70c6adfcec222193ee7d4634f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049013, "uuid": "4c0e06a1-7137-4457-8dea-a05474267051", "comment": "Malware payload (Mirai)", "value": "41f0352588d3e0eebe2aa36c6e9673ebe847a5af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049013, "uuid": "19fe112f-fe4e-4a0b-9fb5-c8cc3f072694", "comment": "Malware payload (Mirai)", "value": "3b361e831294fbe6f3978dae81c226101421bccddcd191a6b44d3336f15c744a7dd516e45505c77ccb7fd0899b8bbc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049013, "uuid": "d5c344d7-082d-44cb-90fe-224971ea2209", "value": "T187D35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049013, "uuid": "1b224dcb-b881-491f-bb8b-5f94f26d919f", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQx:yIRfe3xvvSrlvZZ7Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049013, "uuid": "2e8dbc6d-4187-4349-806d-631e5f53cd33", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049013, "uuid": "96a61b1b-6651-4a32-99c6-c941aa0a4fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049013, "uuid": "d724a252-7471-44a2-ac16-6a405945d722", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f81611-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "6015b924-0933-4ba3-b902-ef1b0864fc18", "comment": "Malware payload (Mirai)", "value": "c36062f54a8d15231e9222265752c9fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "7d75a420-1c0e-4ad8-a08f-b05c37fef116", "comment": "Malware payload (Mirai)", "value": "e0a1adc708da1bb9718b698d137fe065ba54ad47da72f30eaf3839fa5ebee372", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "b4a31bf1-66e6-4511-865e-f0db806cc60c", "comment": "Malware payload (Mirai)", "value": "c2573f9163714b0b99676df39e14e0442365dfd9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050584, "uuid": "71d2ce64-58f9-4259-80ac-8ba4c53f204c", "comment": "Malware payload (Mirai)", "value": "b234f546bad2a246f14d5f652e773e8a2a89d5f19d258f127f07ab5d00321a0330be273f95177e01f3f630430c4f3c2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "49259bcb-9ec2-4544-8961-09539cea062b", "value": "T15654D60A7B518FB7D46FCD3306F98B0128CCB45335652B7A3670E65CB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "bde1c0f4-c894-4538-9221-b54e45de8c75", "value": "3072:tr8nUqqlQzmhMfC9oS/Zmt7Miq03ZTC7QKpUoCGtte6jiRnGcLA3J:eHt7MspyQ4jt9jkLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050584, "uuid": "8813c731-902f-4144-9ff0-81749d168872", "value": 305584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050584, "uuid": "bdea848a-420b-4f78-b21c-bc984bf5f7bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050584, "uuid": "7f2a527f-0db3-4faf-baca-8f76d6735205", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef92ae2-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "9d036fda-4bec-4945-9dd5-4177f27c35ee", "comment": "Malware payload (Mirai)", "value": "346c7b313ef955b3c905de729b7f6a1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "08d40e94-993d-4d66-8f42-81f5445a2915", "comment": "Malware payload (Mirai)", "value": "e12870d8afb07d462fee42587381ee88d3f952fbd318a83aaa309f8dbaff582c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "5365eb57-e3ed-4838-ad3f-f26e3b91e945", "comment": "Malware payload (Mirai)", "value": "a649d200c60f968ba4ea3f121267338621017f7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "62c00423-548a-47d4-905c-cfbf81e01477", "comment": "Malware payload (Mirai)", "value": "a5a0c96996cb67785e2a9c9a7d5c9f98ac1afb688e8ef80309f6140669a6e735881dfcecaff893c80fb1523f5f3b8790", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "d65f14a1-6980-4ed6-a76c-6a5d86ad0f47", "value": "T1A873BE32C5386D68D2450B7075688EBA5373F40862932FF2DA9AC3691417EECF514BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "09648d82-7e34-4561-9bd0-527fa136766c", "value": "1536:pua3Ipq9denIJkESuEdVUOjx1VKwLbGooqrC+eKI/m:Dsq9w2STzndaw/oqrtIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045553, "uuid": "d9356e5e-9717-4abc-a90c-f2eae59e79d8", "value": 77100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045553, "uuid": "e23df3a7-9c0d-4de1-88db-9e43ad7bf144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "c609f06b-238d-44ad-a638-8367c1aac9f3", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e69e62b-91cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044612, "uuid": "a1764000-7ede-4ef3-aaf4-eceaddce9c58", "comment": "Malware payload", "value": "f51222b5023d59ef0c57cffc32dbea2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044612, "uuid": "b8f2945a-1f2b-42de-aec7-4d8cb2136e52", "comment": "Malware payload", "value": "e150fc20ddf1f2169ab6011ee4af4103d94f80046e64c2c99b2e60f80055724b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044612, "uuid": "babea20c-e349-42fe-ac30-467fbe331cb2", "comment": "Malware payload", "value": "a465fe4c305c4f22648f43b91020cca7d710d2d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044612, "uuid": "ef770bfc-ae40-4ab1-8dfd-c1b3679b3441", "comment": "Malware payload", "value": "4b20daf57983a00dac6cde3cf33b296ff85b1b889457d80d456cef22d2a647b5181c7a84180ab5784c10323523f7da55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044612, "uuid": "f702724a-74a1-44df-bee5-c0a73efc5b53", "value": "T176D68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044612, "uuid": "888de694-c1c8-42e4-9406-ab5aff39b244", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044612, "uuid": "ef103718-e4b5-4273-a9dc-e526c3b702fd", "value": 13271040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044612, "uuid": "096b6908-a899-435b-aad1-625b9c88f181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044612, "uuid": "9b0d35e2-0b4f-40f6-b9c5-e895f9883e9e", "value": "e150fc20ddf1f2169ab6011ee4af4103d94f80046e64c2c99b2e60f80055724b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afa06ff-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786009012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009012, "uuid": "30343af3-cb1b-49d5-99c2-51e19603b9fa", "comment": "Malware payload (Mirai)", "value": "41a1542b2486cca14442224621a4e2e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009012, "uuid": "f7797dc4-26d3-4f0a-88b4-52689d7f9c4a", "comment": "Malware payload (Mirai)", "value": "e178d34417d1c130c933ed8cfaa1bcc991529cb1d76d8529ad09349cd4564cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009012, "uuid": "4fc9e737-1bd0-419d-9a8d-47557fb25aba", "comment": "Malware payload (Mirai)", "value": "6b8bacddf50c8af19ad80ded42bd08f575a214cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786009012, "uuid": "71afc50a-f50d-4ce1-aca7-575255e98e1c", "comment": "Malware payload (Mirai)", "value": "6a260e8747c279bc94de7f44b529cc6e1b4c2ce8cadafa51cdd7f0c01f468f2e16812f61c898782f4160521272738a5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009012, "uuid": "18336e8b-74bf-4b71-9adc-eac303da00a0", "value": "T156E35D13A54080FDD09AD270879FD137EB32F89A12347B0F6B906E711E3AF616B5A6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009012, "uuid": "64c9b920-c729-46e4-98b8-d12dcd4dfcb1", "value": "3072:3B7ejpOFiwWq8om+7UY0WD0bIDSrVCT+KRFa0W4b1Q:kpZqnmO309NrV9WVb1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786009012, "uuid": "1bde60f9-97fd-402e-a950-acb0b8961f4f", "value": 149632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786009012, "uuid": "1538f85d-e678-4643-82b4-13425304b9ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786009012, "uuid": "e7d1a640-9622-46a3-9eb3-ee942592454d", "value": "SecuriteInfo.com.Linux.BackDoor.Fgt.6204.25210.27426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fd722d-91a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786029274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029274, "uuid": "115a728e-20fb-40a4-9f70-f88b40463e72", "comment": "Malware payload (Mirai)", "value": "09adb664dfd01819bc8bcc3b509122d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029274, "uuid": "5a27cfb3-ea21-437b-9fc7-9194e1630a9f", "comment": "Malware payload (Mirai)", "value": "e1fcc9857c704df92a3068a9d97f625ec8933e788408dc3b32598e54d35c4343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029274, "uuid": "bb1403f1-19af-4ea9-89b0-e2162e44ae21", "comment": "Malware payload (Mirai)", "value": "689f0a642495740d46930959cdbe4fe38c832486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786029274, "uuid": "66aa597d-5824-48db-9dbe-04ca9153ebdc", "comment": "Malware payload (Mirai)", "value": "59f9306251e9327d585dee6b6c8d064e1592aca7a5822a4de2b627934cd792e47269c01c9346757b57474e5576befdf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029274, "uuid": "9d3b2a1d-2a3c-4c22-8850-f10229c70b69", "value": "T111935D89F783E0F4D94705B0116BF77E4734DE225124DE5ADB94BE76AC32B12A11A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029274, "uuid": "88954406-06af-4acb-9f55-b87b479241a0", "value": "1536:BzpIrpOKoHBkQEXHxHXXZv+7IG1pnoyy6lFuUm31EO2Tnc+gbr:BzpoOKwEX5nZv+7IDHXCbFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786029274, "uuid": "f790e903-ece4-43e4-8847-d430406187b8", "value": 90880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786029274, "uuid": "3e4e60e5-0270-45a6-9e11-5cfc2dffc328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786029274, "uuid": "bd88f863-fde7-40bd-ba55-05493f1b8057", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3968b9ce-9133-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978461, "uuid": "0645276c-5e29-493f-a9e0-ae4f69760476", "comment": "Malware payload (Mirai)", "value": "12d46d381a697241ff6f5937b268b9e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978461, "uuid": "8332a208-5913-409d-812c-730107c96e48", "comment": "Malware payload (Mirai)", "value": "e2aef39546ce27325e44a7e386a875133484251a8b115074038103ac6235e2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978461, "uuid": "540ea1b8-35c7-45b4-a72d-4f0397774709", "comment": "Malware payload (Mirai)", "value": "df933f77857b7fab248075fcbb74c28bb1d08838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978461, "uuid": "10b26e0c-a289-4aef-b1e1-268679a09f2f", "comment": "Malware payload (Mirai)", "value": "5caec9409025782d6ddea4f459ba0c7131a6af958d10c7d63e49d03267e7bf561fe1589c76d6e33846bf61d3379ce146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978461, "uuid": "26d0af06-3cb9-4485-8355-0df6cda988ba", "value": "T188A34C02A49180FEC49BD174879FD137EB72F94912307B1F3B907E712E36E626B1A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978461, "uuid": "aff82bb9-0d73-4b1c-ae99-d1f1cd2ab284", "value": "3072:RwRZog981c2H+ZpIrF3oo6STqB2wqbhR:aPokbCrpoo70ybhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978461, "uuid": "b5cdb56d-6a9d-43fa-996c-5e3b33186e7f", "value": 104568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978461, "uuid": "8f08fb64-17cb-4fc6-8e41-022c7418d7ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978461, "uuid": "12e3bed7-326e-411a-852e-7dc71fdf9160", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fb866a-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786057748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057748, "uuid": "da9d7806-7cb3-4dd7-82cb-66ed8e7e5902", "comment": "Malware payload (RemusStealer)", "value": "05c80e5463a628b7c823595f3b1f4bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057748, "uuid": "0d8fc7c8-7d41-4081-87ea-00bb34f5ba51", "comment": "Malware payload (RemusStealer)", "value": "e2affa0d6d98ca6cd8dbb05f8db955a71127b37c631a9cea4c967bdc992c93e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057748, "uuid": "dd65c806-8ee8-4930-9db2-dd0bedf8a8b1", "comment": "Malware payload (RemusStealer)", "value": "cbe184ae6fff5254b172b160e127de27dee3409e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057748, "uuid": "03bcc26a-d075-4b7d-83df-960f0cd2fd63", "comment": "Malware payload (RemusStealer)", "value": "4db2dcf2d48f2f92e2dba81bc2c97f2d41995f42f22ab2af305c29ded499999b2bb0391fcc17b2d7eb259475dbf4b4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057748, "uuid": "71feae29-c07a-4482-a786-64c07b210a5e", "value": "T112F4CD04A25924E8D46645F388D1771DA63AFE0432C05EDA7ECEB6716E327D0EDEBE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057748, "uuid": "99433d80-981c-429d-a557-c82c3353468e", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057748, "uuid": "73b38ab3-36fe-4e49-bd24-5102f1f2b5ab", "value": "12288:sVrlAVcbE1nhpWGA8S1DlJdJs2uzjemyXybS9b0KqRYw7OoFHF0eCc:PVcY1nS11ZLC2aimzwb0OoFHieCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057748, "uuid": "ae47c822-92a1-41da-99e8-9c43068be03d", "value": 783088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057748, "uuid": "e92b636e-4edc-4095-b7e1-d82faa14fc59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057748, "uuid": "e48c5a3a-0aae-4e87-8d66-836d1a536536", "value": "e2affa0d6d98ca6cd8dbb05f8db955a71127b37c631a9cea4c967bdc992c93e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23825e35-91db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786050580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "c8e5fa64-c491-4c16-a41e-46108cced640", "comment": "Malware payload (Mirai)", "value": "86efef3f38397bfe5158d47ac54332e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "596b1b3a-810c-4ebe-b73f-06d14874dd54", "comment": "Malware payload (Mirai)", "value": "e2d12341dfc7c12aefa0bad0610e44723628d84459e3412d745e2dd59f3965e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "e1b40b0e-58ac-4e49-abf2-4c6dd8f0c3d4", "comment": "Malware payload (Mirai)", "value": "6b71b2fa08ac01b062b6ae213019f571d47eeb06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786050580, "uuid": "d6f01a2e-1a29-4462-8b80-5999e3ea6826", "comment": "Malware payload (Mirai)", "value": "99e647d5d509f15a0d610f7951431830da3d4cf3cb299d6669fcd101ffa4e76cb09d239bd00828fab8273909b9243af4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "e465ac40-7fba-4107-a4f2-bef498ff94af", "value": "T1E404F856EA43DFB3E51341F202B787310E71ED7A6C26D542E3BCACB49A619C1A60637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "66bf375a-f6ee-4f00-8c3b-1b137cced22d", "value": "3072:ZfiM6+zlDCR5e+CpUFUy+4sOmnLHtXgnhbyEPOx23yi9VO67Fn6fRDlpGe:ZtdCR5e+ULLlgnmc3yibHpYRbGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786050580, "uuid": "40d1ecd0-e1a2-449f-9f52-ee8151650622", "value": 185700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786050580, "uuid": "d7641789-cbee-485f-8786-dd076cc60be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786050580, "uuid": "6ed18a62-c0e7-4df2-8190-80b26662e05b", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103095df-9134-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785978822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978822, "uuid": "7646d265-1386-4cd8-b01b-b3974cf03ca1", "comment": "Malware payload (Mirai)", "value": "279048c84aefc51f41e13685aa89eba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978822, "uuid": "66b7e6b0-d562-42b1-a438-413fbd0ce5ec", "comment": "Malware payload (Mirai)", "value": "e312d125a54f6b144a024d7440d5f403cf75209a730de2646513e888dc713abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978822, "uuid": "33a31784-5a47-4ab1-a8de-a5d7067083cb", "comment": "Malware payload (Mirai)", "value": "fd61ba14ab4dc013bc65ffd267ffa035eef60d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785978822, "uuid": "8d2d52ca-a6de-430a-93e7-a88d98a2a78e", "comment": "Malware payload (Mirai)", "value": "037784c3012efdfc174a4b66c374746299d40d8299c4051c75c5eacbc2c780ed134b73be1f97f83616789b1f0bb8ee7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978822, "uuid": "c02945e8-f1a7-45cb-8a85-f1a3b911c066", "value": "T16404294F7720CF61C759C93005B3C79666E926626BD38849F36CDE08BE64349A82FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978822, "uuid": "bb0ed767-a42c-4d4a-9557-adffb8eeb2a1", "value": "3072:386gjmardOSEmvYPKiIpoqY9+5/ljfVhVXw1Dej+m:MNjma5OSE+YPKrp/v/1dHXWA+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785978822, "uuid": "3386ecb7-46e9-4190-a181-d49d4ba03bcc", "value": 180872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785978822, "uuid": "24af4228-040c-4ac0-bd91-b28055b624ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785978822, "uuid": "05e2c2e9-32b5-4df4-b622-5d20cbd7a2ab", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac592b6-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786026540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026540, "uuid": "5854928f-be01-4926-b4e8-c6e082c4d8b3", "comment": "Malware payload (Mirai)", "value": "bd58ad4ed03ddd4679e19c5ce4c8d1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026540, "uuid": "00dc6882-42c9-4cbe-9b59-113ba8da451b", "comment": "Malware payload (Mirai)", "value": "e347dbb40322c24e1789a5450f22d0907f3ee22671d8a33ec84b5fcce29b63e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026540, "uuid": "2eb00ef8-c36d-4b21-85cd-5cd446714c34", "comment": "Malware payload (Mirai)", "value": "3e77f55ac49963b4126336e646f37e4d0f9bf4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026540, "uuid": "00cd09d7-3176-4dab-9216-7bc06310c190", "comment": "Malware payload (Mirai)", "value": "ee66aaa5fd229bd7f19029979bf419f25e71a1f548d13ed124b451a6d9d51b42daebf7f86adc98cc8e829cc90d9d4a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026540, "uuid": "4bc2151f-e513-407d-ae9a-2b3b55fb091c", "value": "T17CD32A55FD449F13C6C265BBFF4E428D7B2A1768D3EE720399266F20378B85A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026540, "uuid": "53810e15-b62f-4e9c-83c0-9fa287713057", "value": "3072:IRBCtxATbd/BBPsPwQ4lFcgLQ9zpvj0Mh3:IBvxnPsPwLlFXLizZj0Mh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026540, "uuid": "6735b5f0-0455-4e66-bf9b-1e61a098c537", "value": 138008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026540, "uuid": "121ab5f6-0dea-4845-9891-01eb4c1ca802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026540, "uuid": "77226ad2-74fa-41d4-a2df-c95ca4e4c90e", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ddbfe0-9139-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785981034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981034, "uuid": "dd6eb5e5-d7b9-484f-aae7-6765c1478721", "comment": "Malware payload (Mirai)", "value": "8f31f4c472ebf5156fc9274f328f64e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981034, "uuid": "ab06e597-f8d3-4d32-afd5-91ef0067cf57", "comment": "Malware payload (Mirai)", "value": "e47771be0dfb7637a11ab8fdce4bb71593ac3fe4e753e14522450c9cf52839b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981034, "uuid": "53cf31b3-c255-4f30-ba20-8f1b05c350cc", "comment": "Malware payload (Mirai)", "value": "53c30d553634b470d2c8d4db67a2e5e24c9ef547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785981034, "uuid": "b634127f-21e2-4c88-80e3-35deb6026fd7", "comment": "Malware payload (Mirai)", "value": "0df42523a0438bdd706380bc8fd74048cefbe381bcb286b9c6841a0ea8c810a102dcd67b7a5fb20c0f74c272a59e32b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981034, "uuid": "935a8ce8-5448-4894-87b7-1eee8d2fadbd", "value": "T13AB34A40FA83D1F1E9530670002BA75A9B34ED358064DB4AEB983E75EC71B428D6F7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981034, "uuid": "fe4ffebf-d00d-43ca-8f2d-15e6ded2bac1", "value": "3072:gzTwAkI/25sjj5WaZmRzypFga6EUT3uHq:gHwE/2tRzw6EwuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785981034, "uuid": "72fa4c47-ee7d-4f72-8187-ecba142dd4ac", "value": 107896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785981034, "uuid": "ca4f1cc2-5260-4796-8370-66bd690964a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785981034, "uuid": "b7cd5dfc-31c1-4ce2-95f4-8d874b55392a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090726ac-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026913, "uuid": "d892ccfd-bafc-4316-ae91-5187b73525ae", "comment": "Malware payload (Formbook)", "value": "816dbfa4a8386478e6bfc61e91b82ed1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026913, "uuid": "e219da35-7cfe-43a8-86d1-d455f3c009fd", "comment": "Malware payload (Formbook)", "value": "e4a1cba61b06c78f22678e2a23da5876ffe86ddfbc1106c056512d4889a207c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026913, "uuid": "0a459614-6252-43c6-9411-ea65513816b9", "comment": "Malware payload (Formbook)", "value": "4deffc070f8232408f1bf2274d08a2c190377e3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026913, "uuid": "8b408738-6df7-47d2-ac9e-d2636df00f43", "comment": "Malware payload (Formbook)", "value": "00f7204b33a7f2ad2079b31bea24c4f37a282f21532f3efcf22498de112701e3728e041d5ab7fd5ed1f9d00e264c659d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026913, "uuid": "e283bf00-dad5-4691-8501-f8ec3ff8621f", "value": "T13FE5D6E13BEE73835A043309844F6C198B97E1354703E2D4B5DF06D25FA75AAAC9CA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026913, "uuid": "9f50018c-ef83-4b1e-bfc0-2c432b3365a8", "value": "12288:oicGpOAyO1x89QRbPgTTCqjkBWnyNJ+4Ln/DnfRAIk/6NNuxCrv8BD9Vx+WLHS7V:o9FO1x89QRbPgCcy/OIZ6wPAad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026913, "uuid": "29077eae-be9d-4ccb-90e7-c5df84d89355", "value": 3172530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026913, "uuid": "0b6b9f73-4ece-4b08-ba97-e7f9c501bc4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026913, "uuid": "c58df3d3-318e-41e6-a59e-202024f47f2d", "value": "HSBC PAYMENT COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f605be0c-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040196, "uuid": "321f053c-5982-4031-8e28-129cae520839", "comment": "Malware payload (Mirai)", "value": "d81b3c1e531656ad0a1ea6e19d15672d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040196, "uuid": "e77349ec-cdd2-4f1c-8186-845479e2e4c9", "comment": "Malware payload (Mirai)", "value": "e4e4d4b899dc7c1b2435510a30ea4065b1d75cb9a3bc2e854dd9439cd628d663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040196, "uuid": "c4f97a23-3fa6-45cd-9d03-ddfd1603d038", "comment": "Malware payload (Mirai)", "value": "8a79a7d1b8198945d21c5db8e3c01939165f696e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040196, "uuid": "ce1572bb-7596-4cef-9f8f-5430080b52e6", "comment": "Malware payload (Mirai)", "value": "175a6a8ef720d6bdabadda7dab4d3243ba7e8df774439f73c832b349358fd4af51e4abe21483dcafa54065965ee9571c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040196, "uuid": "0bbf349c-6d80-459c-b8fb-a758b4e4839d", "value": "T10D345B03B743FAB2D45300B5375EAB616831B83464268886F7A22FF8FDB56C4964572F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040196, "uuid": "a8366749-8c1b-4916-b53c-1d163ac0367c", "value": "6144:VlexsHCfJMg7DVFSBI7vyUix+MUHSboSqiMfvaPG:hHCfJNfVFScaUikMK+PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040196, "uuid": "bc5bde7d-bbe4-4f96-b44e-605a614dc815", "value": 248536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040196, "uuid": "3030971b-0f9e-4ec7-8f73-cafce0d92a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040196, "uuid": "b898096e-268b-4265-873b-d1503c74add7", "value": "pope.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d28483f-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786005231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005231, "uuid": "33ab7600-b9f9-4719-8905-1201b93151f2", "comment": "Malware payload (VIPKeylogger)", "value": "f31cfeadac653eca44b0a3e5bc66d416", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005231, "uuid": "cf802b53-c996-47ae-9b1f-543378e08238", "comment": "Malware payload (VIPKeylogger)", "value": "e4ee0266f9d995033f95f1f5b0120a5cbd14bf65e89b6ad61c42753eaa046f07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005231, "uuid": "6f53bcdd-4d79-42a6-a5e2-7a858f05c66d", "comment": "Malware payload (VIPKeylogger)", "value": "48cc385b2168e06e71ffb9e317e42e88aeeeb8e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005231, "uuid": "9cde374f-89cd-436e-9d89-35916f6e8ec1", "comment": "Malware payload (VIPKeylogger)", "value": "5918bd0182a8047e2052c9c52d5a7fb9d42a8bc67988408547259d2f905076f623bd8b4ef8ca334a8855bc8052f7a20a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005231, "uuid": "eeb840c9-a680-43d7-bcc1-24a05a02f7ba", "value": "T13705BFD29B74DA0A2B469D6CBE4D25C25B45BB7DC28E4B2B6A05E371F34D424CDA0F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005231, "uuid": "215630db-7bd5-49a9-8757-125294c638d6", "value": "24576:v3mOAluyt5vlUCp4KBHXIloHjrwsQNSyr79:SFltyAHXWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005231, "uuid": "95286479-e230-4dee-9cbe-376a2d3f1b64", "value": 808935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005231, "uuid": "26e2c22f-6f63-44dc-ac78-4ce0bacd7d68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005231, "uuid": "dfd24d2f-c852-4d3d-b504-d1d5ba5f205d", "value": "\u0110\u1eb6T H\u00c0NG _GI\u00c1 M\u1edaI_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555b5b9d-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005566, "uuid": "f75c723f-c2ce-4f28-9197-b700e87bf0ec", "comment": "Malware payload", "value": "548abe6d92a9c9984be10e853ff2eb7d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005566, "uuid": "2845606e-f4e3-42ac-b1b5-15d2cbc7e590", "comment": "Malware payload", "value": "e4fc0deafd517c8591c4ed3166cc31aa9bfb99bd29ba64d7def6c82ce79f37a7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005566, "uuid": "b6b8c02d-0fe9-479a-a0c4-b3727bafa623", "comment": "Malware payload", "value": "5d2c2c962191f277c2b14fd7a54b9c9c286fc6ee", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005566, "uuid": "8ea377f4-7593-4d3d-8ef0-8753f0c810fe", "comment": "Malware payload", "value": "a4b9043c2da9f84b88cef1377a52453e4dd67253b051bb4c9a9ba90765c2f4b443d87ba3ad54787fb6455f4f20fefa37", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005566, "uuid": "1e46e97b-5219-446f-9e9c-385994f2812d", "value": "T10A15A8D0847C0ECAC298FEA75A74C9619F7A74D22B036F16769459984C3D84C3EA43FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005566, "uuid": "daa5a205-c802-49dc-ae4b-7608af8144df", "value": "768:pol+k+zd9x6T2oytAXUsJ8UX+txiGBACU5Zj+3BGd5bSM3ciGbqDQ283sS9Xpm/R:54jR2eR/9W6OxTWU+ARBRNRAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005566, "uuid": "e5418ec1-b097-4da6-a376-4971c974433b", "value": 894998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005566, "uuid": "f6ae939a-e3bf-4692-b320-59f6cb46ba04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005566, "uuid": "313f0513-7d3f-4330-a714-aaab84dea449", "value": "IMG-20260805-WA00032- PO_V37316.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045ddb92-91c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786040649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040649, "uuid": "cdf9c401-d6af-4f6a-95d8-171065cb3d98", "comment": "Malware payload", "value": "86ba7392e0b625ea89543c4ca46c4173", "object_relation": "md5", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040649, "uuid": "0d6bcc9b-3909-477d-838c-5e53aa20a123", "comment": "Malware payload", "value": "e5bd74cbe638bad1bf249e7192d0bf7149538469edeafc07cd5f90c60782e108", "object_relation": "sha256", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040649, "uuid": "7d48db0f-ad7f-484b-a77a-28cc4d0af1fb", "comment": "Malware payload", "value": "27fbacd1b631fc4ef784bbb2e0dc9f7466bfd8c0", "object_relation": "sha1", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040649, "uuid": "33f7d2e3-81bb-45ff-bfba-ff8a409b3fd3", "comment": "Malware payload", "value": "74d6c40550525d01255b8f30cf272c774066185ac7753c78f7d2eeecad276714573317a899247eee5a850aaea698981a", "object_relation": "sha3-384", "Tag": [ { "name": "apex", "colour": "#6B1BBA", "exportable": true, "hide_tag": false }, { "name": "bot", "colour": "#CAE355", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040649, "uuid": "2e4832fb-8777-4b2e-8e3e-9dd0c9959e10", "value": "T182431807F692D4F9D096D5708A8F5127EA73B4A862723D063FD86F352C6A9284A3CF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040649, "uuid": "c115291b-a959-44dd-b65c-38b5def38c45", "value": "1536:+b9i40/LF81sGyLpc5tfo04ePTitD2Jm+WH2TMM22l0Vx:+bw4kLisNpc5tfo0BitDmm+WHoMM2LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040649, "uuid": "762ac600-e995-48b2-963a-41e0071f6c8b", "value": 60624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040649, "uuid": "08c6e8d4-3446-49ac-b61c-ce8f4db43a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040649, "uuid": "f92dd4d1-0544-4ae6-bafc-9457dc22a21f", "value": "e5bd74cbe638bad1bf249e7192d0bf7149538469edeafc07cd5f90c60782e108_from_104.156.150.223_redis_set.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5113d6f6-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048938, "uuid": "83a5bb72-8259-4e9c-b1c3-8456fa7242cf", "comment": "Malware payload (Mirai)", "value": "4fa63ff9bd18af404f887b371dcecf92", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048938, "uuid": "12380d40-1031-47e5-b5cd-87b962814b4c", "comment": "Malware payload (Mirai)", "value": "e5bfde06f7874edaf9486fd2eb40089290da4fe7d735e9a4f3139a7a00e9a79d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048938, "uuid": "86dec6eb-26ef-4b73-a216-668b3d67d8d3", "comment": "Malware payload (Mirai)", "value": "41779547b0388cb6c2db034c6441ded376499939", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048938, "uuid": "b030d94e-990b-47f0-8a85-0a0a714e6c6b", "comment": "Malware payload (Mirai)", "value": "9116e127bc6c56463ffee2a54b64ff85b5929c2d0d0bdd76f47e5ff2ff57ed73ada797bfd3f53cb172e33057e150ad9c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048938, "uuid": "5ed486f9-c616-41d8-a025-bb8d949004f1", "value": "T17FD3B021E4006DD1EC2129F578BA96B80350EE700BDE5582EFFDF95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048938, "uuid": "75e013c7-f421-4a95-90db-b9ce994ef670", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xO:PiySSGp+PMmT7zMplQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048938, "uuid": "ea53bf17-a361-4b55-a273-2acb56517413", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048938, "uuid": "bc15e9b0-8b31-483d-bed9-229571e97ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048938, "uuid": "603943a3-dec5-4f61-92a9-f2660e54e96b", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6fc59a-916e-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786003755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003755, "uuid": "2fc0731a-7bf1-42c1-982e-b188635e8ae2", "comment": "Malware payload (PureLogsStealer)", "value": "688e8d39d217aa9e204fdf26051fd3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003755, "uuid": "e97d7d4b-2db7-40b8-a275-b14e25b66d88", "comment": "Malware payload (PureLogsStealer)", "value": "e799024a27c1f6be7cc01701f95b509cebc661e5302a5ea498c52798689d3931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003755, "uuid": "6cc3c5ac-7da0-4ba9-9828-37e278254cf3", "comment": "Malware payload (PureLogsStealer)", "value": "ad2ef37661b0a9ded292c7c1652172a40320e987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786003755, "uuid": "eafb9100-88ca-4e84-8375-1e5f4eeac974", "comment": "Malware payload (PureLogsStealer)", "value": "e406ef439cf96096bc4ed00cc1be75769bbceb4c473738d69d8d1bd1f01f47f4aecb930dd6427904d2de2b1a66d6eaa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003755, "uuid": "3a65bad3-2608-447e-bad9-266c3e9ae25a", "value": "T181751214A66DCD19DCA94BB0C876D3F10361BD5AE862F2539AE1BFFB3178E171808742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003755, "uuid": "2b3631e7-8123-4fc4-80ff-f26070a07779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003755, "uuid": "1cb45fc6-9540-4342-ae5b-630428918fa5", "value": "49152:1m3kNGeRcBc87WoYpaVcdWAMz7NTkTlk13:FrFMcQF/NTkhk13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786003755, "uuid": "37eaf6fe-b5f9-455e-96c6-f72a02fa1f12", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786003755, "uuid": "68cdd825-0c00-450b-a194-deaa3f72f910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786003755, "uuid": "f4470777-7f74-47c1-acad-02d2cf77eaa7", "value": "01075347801C26MVK76870700507067_05082026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890b5a6d-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994486, "uuid": "a9e3f253-5f88-4362-9a50-04d064d1e36c", "comment": "Malware payload (Mirai)", "value": "337d764a62e8b9ae3c1d0ab58432161e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994486, "uuid": "ad3fd297-e0c0-4042-a3ab-39b9997907b2", "comment": "Malware payload (Mirai)", "value": "e7a04b15aaf8b43f5bfd55fc8befac199b0b43db1befdd420f732eaff6f5923a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994486, "uuid": "dbeaab9e-4791-4bd1-b842-1b28a81fb9fc", "comment": "Malware payload (Mirai)", "value": "ac21157f017f78c2aae771feb680b3a7ac917883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994486, "uuid": "e87c956c-b72d-4bc1-aa96-8cd10798c3e8", "comment": "Malware payload (Mirai)", "value": "7f81277d0a2d16c84f0fee9d126574d73fd833e5035f42e3e0e17f48d3ccfc9b700d5e1d9c7e71702de41b7151ea8202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994486, "uuid": "26d5dda8-21e2-476b-9c43-031ab771a476", "value": "T119832A5AB8829B15C5C5527EFE0E518E33231BBCE3DE72129E145B2177CB56B0E3B806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994486, "uuid": "825844c1-fc49-4aad-bdf5-b234cd2fc573", "value": "1536:udnzn1yCF1h1CMUAMgaUoi2YlxsKEt5vDK2oaamDtNOMQiDR9VWUi/hm57EM5MYn:un1yCbhkqaUoi2YlxsrTloaRR9VWUi/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994486, "uuid": "5b36aab9-4811-4e05-9fa9-c59682bf8226", "value": 87140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994486, "uuid": "34104fc0-bdb7-4996-815d-a4e6305240a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994486, "uuid": "b8ca80da-c877-46d5-b912-d4e8b79afcd1", "value": "lul.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7571ef5b-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "0c691bac-9c00-426b-90fb-ec0cf90cead0", "comment": "Malware payload (Mirai)", "value": "9189fc6ef2bd1ecd5f68929927ed891e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "b22dbf94-cd4c-4ade-b3b5-7399358376cf", "comment": "Malware payload (Mirai)", "value": "e96b8af332b199cedb7894c2f70e6320b244e6c6bf174cd8212cbab8ecc330b4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "88f7f860-4906-404e-81ac-d07426dcfff5", "comment": "Malware payload (Mirai)", "value": "fbfc493662d96916457e958210dd2cf410a614b0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030961, "uuid": "424dc606-8084-4d17-8a60-790f21e59756", "comment": "Malware payload (Mirai)", "value": "731b1f6c23ae29bfbc7e4cd50bb4532df533343cd6c8f4b9bd3b64d90827240028f5dd43aedfbb1acf65c79bae9aca1e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "128e2481-c0ae-42c5-bcd2-472f1dd4d2ab", "value": "T118D4BE19F91AEF07C4F2E536D4BBC2A07236DC4F6B9283052609A97D385727A8F19385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "2cb30c9a-c5eb-4fea-9057-3e2c6313b62f", "value": "12288:+KG0RHVSLsRmRkce3meXn006KLxOeYyHfozU06pKSd4aEernVKMdMfA+:+KG0RwLYmRux3DtYNU16ZernVfdMfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030961, "uuid": "41df7413-4721-4689-801f-227d3f684015", "value": 655308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030961, "uuid": "c906e043-7a58-4cfb-baee-5ae669b304a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030961, "uuid": "dfab7ec2-53c6-4ace-a01b-51a590c4eb3f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91aff62-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998835, "uuid": "8b642afe-951b-46a7-ba15-667434627e7d", "comment": "Malware payload (Mirai)", "value": "88f1f0d8f502d0d784541514375f96f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998835, "uuid": "5cc8441b-6815-4905-8ac2-1bd303b2b440", "comment": "Malware payload (Mirai)", "value": "e9c867f3f025fb465947a7ca4aa207d3b13396d73fde33c674d5dfde4c14fd71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998835, "uuid": "1022bc48-fcb5-4b29-a0bf-c1ef5880fced", "comment": "Malware payload (Mirai)", "value": "54c675dce966c2a1623bea9a06f93f7981eb7583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998835, "uuid": "95064904-d3d9-4f53-bc66-5341a78aa0c8", "comment": "Malware payload (Mirai)", "value": "74531e0f98f0fb7dfaf42591b0b8c8883a40869ea5ac5a306091b33d6f79697e9467f7d3ae5eeb5160d796f7000cfce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998835, "uuid": "4dad93b1-70a1-4a4c-b44b-a2861c829a3c", "value": "T1B374BF79F5477A2CF0FD99BB833B3A1671A7E0510E42FCEE1182F737DA2A1660610694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998835, "uuid": "56f229dc-9b96-4d95-b30c-56cf4f0b1791", "value": "3072:b4Sw/z9KwZcFFjNW7iaxolBXdxhov//asb7bCE9mo4Y5R5o5nkVgWp/ccTtFjCpo:kSw5KHgiaxABN4Tb3J/bqcTfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998835, "uuid": "6295347b-cc39-4d95-b41e-bd3effd2857d", "value": 346528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998835, "uuid": "97d28ea8-1176-4a7d-a7bb-489e56dfc4eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998835, "uuid": "e7f72290-9a49-4cac-b47e-1b9e39e2b1c0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c8a8b1-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "d4702dc5-6496-4c32-90c7-e8d43ce4e3c6", "comment": "Malware payload", "value": "9ee6f7758c5e684ce42625b09141f9c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "7952d391-14eb-41a7-90c9-734a0e81f1f6", "comment": "Malware payload", "value": "ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "4afa830b-c61a-4c4b-98d4-0ed1aaf8f554", "comment": "Malware payload", "value": "c6d2eac67d1323854d9252445003608de9368c2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044995, "uuid": "67ad0d5f-3dff-4c1c-ae7c-e134b61e8ef9", "comment": "Malware payload", "value": "410bb1c9ce868abbbe41e0ed8cd5693b6a07ad42c35221cd80a9c6f8587e9d7a538f1b414401528fe86c78e16d2c077b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "4ffd8a0a-7511-49bd-913c-1dc842757c65", "value": "T105E07DC8C070AD750F0ECB083524C5F5E503229A98934DCC94860F11149FF09FD4EE24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "27b78708-66a4-41ff-a810-a4d810ee5f0f", "value": "6:OtL/vmmy3pFq/kxiA2+mSYvD8ez1IvD8NIaKVvfxA8JOEVKSUH04cn:O9K2kkA2IEAcxKVvW88EVKSkRcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044995, "uuid": "d04c138e-c6c8-47b5-ab3b-f9b184f3bcb3", "value": 318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044995, "uuid": "a88cba4a-994d-4751-ab45-8adfd7f8d01a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044995, "uuid": "e08f0f59-288b-48e4-8b51-d15abf7ea3d0", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7346aa-913f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785983916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983916, "uuid": "4f41fd26-68c3-4ff3-96ed-139d60d60473", "comment": "Malware payload (Mirai)", "value": "8f81faaead39c1398e084a44b27e269e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983916, "uuid": "f883cf93-e5a1-40ea-885e-842f0f3aa627", "comment": "Malware payload (Mirai)", "value": "ea7244d77c73627733522c2658ccd158cd91d6505aaefbd83ed12259811324c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983916, "uuid": "eeb63486-cbf8-4722-8bda-8ddd7111b1db", "comment": "Malware payload (Mirai)", "value": "e98e418386f0906ad128a1ca4126437b48fbf20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785983916, "uuid": "c420312c-b138-496f-a63f-86f4e2d3341f", "comment": "Malware payload (Mirai)", "value": "084d2b4e4b34de25c2e3bf45f84d5afc03c0057adaa03c68666f238ccd25fe6ad079655f34c815a73e1ab77256061fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983916, "uuid": "337d842f-edae-4b76-bce6-8e05f0ee7d15", "value": "T15933F162574BDABCC47C957A0C9D0A8DFC638A25752BEE2BDC1027E20C674170FB2B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983916, "uuid": "2d91fc08-7e1b-441d-a424-c01c90cf7926", "value": "1536:VCFEnQDpN2OiBLgVn3bkrqCrfTpbOCx5Dl:VCFEQ1PiyVnLkmCzTVOCnDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785983916, "uuid": "d525967d-5694-46ff-a024-3f017689154d", "value": 52400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785983916, "uuid": "63ab594d-765f-4d40-9bb8-761c8661e6ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785983916, "uuid": "0c5122a6-15d4-4d4a-9e65-1ef2376815eb", "value": "killbotx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec82e99-9180-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786011649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786011649, "uuid": "fa33f39a-f7e6-47ee-988a-7d4c07ccd488", "comment": "Malware payload (Mirai)", "value": "133cbfce6bb1905620e97af75dddda72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786011649, "uuid": "eb96d00a-e317-4b29-a240-c98c41c3f185", "comment": "Malware payload (Mirai)", "value": "eaac155db9d225589eb118add6b531bbf52ec21d1233a2ef468083696dedaf61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786011649, "uuid": "c61d17b0-9221-4ff2-9d5a-98a3d12f194f", "comment": "Malware payload (Mirai)", "value": "9f1a8124f6ba5ece591de574efc3c30f7d8bb743", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786011649, "uuid": "b5605fda-e24c-4eb1-a4cc-e47600780630", "comment": "Malware payload (Mirai)", "value": "9f1f2ad691fe2dc9c47b501b1ce5411c0c11f18c2d7cd9190ba69ca2edba86a1a016ed0acb15a9a37bd0c13282a47692", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786011649, "uuid": "a4ba32de-c48a-47c9-89c5-638067de6bc1", "value": "T1FAC080CF07117000C0C5AD18B3550D6E8287490438B00F0D7CB707D34A4D98CF120B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786011649, "uuid": "72ebf151-365c-4f5e-a06d-7c996cb90339", "value": "3:O22exARmMFjXZA3FOdJ2GL9rSeMFjXAuBFS/TWUKT6VVI9LJdvvvF:O25KFrB2GLNSFFrAsTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786011649, "uuid": "c955a171-968d-411e-aea6-20a5f1b8babe", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786011649, "uuid": "c73eb96e-bee3-439e-90ac-a3e9d4b64ba0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786011649, "uuid": "54494993-55fa-4349-aa7b-dcde87db2a7f", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33986e6-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786040191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040191, "uuid": "95b078c6-0561-4f3e-8bb3-dbe9edf89c9d", "comment": "Malware payload (Gafgyt)", "value": "72731f08c5cf12f2f91537596848d955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040191, "uuid": "c03abfe8-c968-46dc-be5c-6b81cc914f26", "comment": "Malware payload (Gafgyt)", "value": "eb0455d34ee60f63194c5d542ab14acaa762799d19fb05c25b9f5adc44a1bd00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040191, "uuid": "7012752a-fe86-40f4-b84d-9734b30b63be", "comment": "Malware payload (Gafgyt)", "value": "9c6601b37f2e78f2823320ab4d9c4c460486d724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040191, "uuid": "588818a8-5eaf-4805-a385-44c55bcf9901", "comment": "Malware payload (Gafgyt)", "value": "a70e9eccd5541b55f12e9ad49dc98b7d8e003dc9c8f623b3a10bf46ded21925dd8699635470736c99f521fcb5b7e8d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040191, "uuid": "b84c7c11-d4f7-4a87-85a3-2362f28d1ae8", "value": "T166542B55FD41AB05C7C162BAFADE0A8C73136FB8D1AB7203DD247FB5368A45B0E29142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040191, "uuid": "c5a10df5-7b91-4a43-8add-2624ac56a31c", "value": "6144:LKdDlHXEfglMIiCt3sqgmMwQ23MU9ZF8WEqiUSvs0UFy5U5XhNvew5RArX:Le5EojLt3owQi993EqiUT0cAUZr15RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040191, "uuid": "1957f076-dd46-48cd-b000-a7df96a54c63", "value": 285472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040191, "uuid": "3bbbf9f0-98c1-4f9e-9fc8-8b7e1b79f658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040191, "uuid": "aaf93f6d-648b-4ced-9805-4a42198fa96d", "value": "pope.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c06e0b-916a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786002349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002349, "uuid": "c016a737-f236-43cd-b366-ce3c8d10d2e1", "comment": "Malware payload (Mirai)", "value": "ddd4852f48e91c4b18ea304df84648a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002349, "uuid": "31db0521-84a4-4393-9326-b925010086f4", "comment": "Malware payload (Mirai)", "value": "eb203b9ed8ccb03b69770ed03c6efd00201f6cef3d17490254ad772103ffdcfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002349, "uuid": "72b8bb33-dbc2-4df7-8e1b-78a5f196f0f5", "comment": "Malware payload (Mirai)", "value": "bdbf77c6c0d4da546bfc88fbe8a7f4061443ed71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786002349, "uuid": "275b8015-05c9-492c-b045-e5fabfe5fe5d", "comment": "Malware payload (Mirai)", "value": "317bf7cdf095acaee40cd00d206cf5f834053b704880ccadcedeee5f2f82cc32d11e78d8ab85452f2f2e17b1f46a0a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002349, "uuid": "0efb30a6-b905-4242-a6ff-f95daaaa0c91", "value": "T19624298ADE650FDFD46FCE30462E031715ED599B93F1673A867CCC48B68E2094AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002349, "uuid": "10b38bc8-8340-4401-a5c4-c0ba0f043b51", "value": "6144:K78tHOQtk1x+/nMT7FEZettQHPFPcq9wyNnDRQ+0:KwOYkr+UT7yPWY/q+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786002349, "uuid": "275a96ef-94a5-42ca-a396-59b84cd90220", "value": 224580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786002349, "uuid": "a328c0b5-8b5b-4979-a854-ebacb8b04c88", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786002349, "uuid": "e52510f7-7ef4-4cdd-9aa1-9c4b226abd11", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2d4e89-91ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058648, "uuid": "9841d7b0-d36e-4bd2-97e0-a90322022fe0", "comment": "Malware payload (Mirai)", "value": "5afbe6bab9993c484b0480f66e053b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058648, "uuid": "e2c0bea8-559f-4a64-a3ac-fd3026a4c2ee", "comment": "Malware payload (Mirai)", "value": "eb2ee7f82fbb97e22c940a837e3544f9d0ebee6ca4e875cd45eb36f546154635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058648, "uuid": "545a2cf0-50eb-437e-997d-e65b215e8050", "comment": "Malware payload (Mirai)", "value": "3df6a908813542fa52a8d1bde9eeeb30ffc8973a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058648, "uuid": "6e60996a-153d-45ba-9d11-d3716a8e5060", "comment": "Malware payload (Mirai)", "value": "3606cb0d62df2e13ad6e666aa559f42dbe02928923aa8d53d79846b7474fd154c5f2f280801fd0da6cd36a2a67390b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058648, "uuid": "7f60cf1d-1b1d-4e72-8161-e86513f39d80", "value": "T1B043026E4D27E532E96F1C3EE73B47001922EF11D0AAB33B69084144DA961CED4FC5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058648, "uuid": "d1993f7a-dae6-420c-b51b-b922f836c1a6", "value": "768:bTckj2H6CqS8jo9M3sVj3bUzl7L3YXMtVaQsGfNsf3uSHY/rhPssZ3U03wfSY:bwM2aCv19M3k3Uz1iMDaQsGfC3uSLfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058648, "uuid": "46434832-ee18-40d0-a744-2f2ba99ccc21", "value": 56484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058648, "uuid": "bd9ce3fd-589a-4c97-9bd4-0a555127575b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058648, "uuid": "14244339-32b2-40b3-99cb-5d073f338c71", "value": "eb2ee7f82fbb97e22c940a837e3544f9d0ebee6ca4e875cd45eb36f546154635.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d84e266-91d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786046463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046463, "uuid": "a55e8976-777f-4126-aacd-e9894e13be35", "comment": "Malware payload (Mirai)", "value": "f6960497bd5a05851c63085ea060fdc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046463, "uuid": "4fb85d61-98bb-4d8f-b2fc-c8c3ac5fb1b3", "comment": "Malware payload (Mirai)", "value": "ec12d1a08d7121bb0d54db4632e09940d1af0f6cfc64116d55238ffb9b0dc0fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046463, "uuid": "95506488-f857-4901-aef5-727f027991a4", "comment": "Malware payload (Mirai)", "value": "fdf2e1a4e3842af2f06c0ccb8c108c95556f7777", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786046463, "uuid": "911be6b9-a9c8-462c-95b2-e8184b5bb6f4", "comment": "Malware payload (Mirai)", "value": "cf2aa20ec3704e98a845846e8af9979d81a5a07ae315316a18e345357658f099903d9552f9393ed0b15d1ed3345ef997", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046463, "uuid": "80ba1056-448a-4467-93b3-514531f9da1c", "value": "T1ED742B8862F5FBDEE25AFD3993017C0B6C298B327483758560AEF96313771850AF9D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046463, "uuid": "2b83fd76-2d12-4709-98c4-611781d31301", "value": "6144:YkUqrPOpX7RQejhGHH/6z5dvRbQilGiBDPVRpwAvRIiQ:nD6pLjE+5rHlH+qRIiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786046463, "uuid": "d6711cc2-2984-478b-b69f-5537aa32745a", "value": 367272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786046463, "uuid": "87701096-4761-4d2b-b290-59696aa164ca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786046463, "uuid": "00250276-c56a-4f35-9b2a-876722378df2", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34a5e87-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785994611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994611, "uuid": "de8effab-c703-46e6-92c0-3020e9530e12", "comment": "Malware payload", "value": "0f3ae6c35738a65e54ba19b6af1d4c45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994611, "uuid": "e6aa555d-5f22-4573-9b51-eebf6967ae77", "comment": "Malware payload", "value": "ec13090ee2ca4de93df8d1700cbd8ef29f46b7722f2e281f5fc213cd22cd1801", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994611, "uuid": "b264d8b6-1678-4dce-8c36-e61e01da51dc", "comment": "Malware payload", "value": "a1cc8f7ae3fed07275624632d832bbae1a277dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994611, "uuid": "5f2b3a58-36dc-4a04-8482-2f75ed4df800", "comment": "Malware payload", "value": "80bd07054bca8bbfb38fd4f8c34bdc12fe268924c3071072e7393f8c41598a3fe27a0ffbddd047cc99e9d28498b1ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994611, "uuid": "14fa8cfe-55e7-4353-a5cd-eca806f7ef24", "value": "T139C54B57BC914A46C4D52B37ACBE81C433629EB99B8667176D04FE3C3ABE1D90E35308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994611, "uuid": "26790e7b-bc18-46a5-811b-a96a16ae3865", "value": "24576:XZ5HguTnv6GGJEfEPsX/ipWiQmZAhRUU8qNbL4LoRN7eBWscpvceQ47uxKkivDg0:7Bf9uckiHuAXckUfYbVmGdsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994611, "uuid": "5af40356-0fb3-489d-9a0a-43ff14538ee8", "value": 2658632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994611, "uuid": "79ba5f18-fe20-4996-85e6-21aef78b61ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994611, "uuid": "a4541a34-48da-4f2b-b870-9e062a0e38c0", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1cec9a-9131-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785977553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977553, "uuid": "7603be54-4f53-415f-a5fc-a5581a989009", "comment": "Malware payload", "value": "2a2e59336a50e3192dafe4773e7008f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977553, "uuid": "823d8971-2357-4f24-96e0-6ddd641bdf64", "comment": "Malware payload", "value": "ec4ae4bf894da8529697d86f2956d49116192c7ab2eef8035c5196999d21cd71", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977553, "uuid": "150db72e-1414-4147-b13c-41b0916e7cf5", "comment": "Malware payload", "value": "a4782f3a8417674f28ef9c3dbc4a1e48c4ccdbdf", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785977553, "uuid": "0d63a017-654e-4b2b-b079-67ebb10b71cc", "comment": "Malware payload", "value": "91f159ff872bad9873d5335f47de7c749141a7a42230afae02147321387e123ab0d555f85b625cd180d6160c43949751", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977553, "uuid": "2127540b-2b69-486d-8360-801f56d3b8d5", "value": "T17FE6330C27D123FEF533917D9AD20669F979B8352BB0C68F1B6C89645D231E04E3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977553, "uuid": "c60f702d-e9c2-4d85-9645-2910b09e6356", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977553, "uuid": "b42eade3-7131-4c5d-8872-8a42820bc93d", "value": "393216:QSGmmbiEtomUzVvCl23MXMCHWUjhYcuI3/PGTAI:QSGRCeXMb8htH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785977553, "uuid": "c66d8586-4482-49e8-9fe4-a0a56c691f3f", "value": 14302074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785977553, "uuid": "0dda01ba-4c7f-4310-80d2-330111cd2b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785977553, "uuid": "803fef0a-b3eb-4af1-814d-3be7939be3a5", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a5cd5b-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786026617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026617, "uuid": "c75113a5-526f-49e5-b83b-1beeccc4d1d5", "comment": "Malware payload (XWorm)", "value": "3a7e78b5f76143d72824e01db6940e3c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026617, "uuid": "530d306b-11fc-4d70-9d51-52a2e35bd26f", "comment": "Malware payload (XWorm)", "value": "ecf36a1837197b217b8efbf43a20b30145ab60eefc3cd4577bae9057aa46f4c7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026617, "uuid": "9771425f-71a2-486e-b13f-5cd973ebce7d", "comment": "Malware payload (XWorm)", "value": "d139f398b0378dcedf8f57490aa7eb4dc31d9810", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026617, "uuid": "6ef423f9-be51-46f1-b0d1-627efef2aecb", "comment": "Malware payload (XWorm)", "value": "39d376fe28f89aa2f06c039b745b31b6e220c967c0672d4bcb62186c3c4c86556015b56e88dcbc725ae94bb5e7d71c4e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026617, "uuid": "d38bd7a6-6e1a-4260-b06e-d4fa7b1894cd", "value": "T159154957E4EDA93D638A12762D32F3D3B6BD304154045AB7639EEC203877A03647AEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026617, "uuid": "c8f7b7ba-cb3b-40d8-a93a-089b417a9b40", "value": "768:T8gt0wOb54mxYSYYPG1E27zpiXIUd6lZinMEwzggnIJzmEgvjn7S/FKhufMn28Jw:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026617, "uuid": "878e4e71-23eb-41ce-8dd8-0397dd6c21bf", "value": 944405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026617, "uuid": "a840887b-5c02-435e-a7d4-9e63a8b1152a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026617, "uuid": "2a53907b-7029-4f82-9bd3-1130b21e1076", "value": "Orden de Compra [POF0000095].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439239f8-91a7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786028300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028300, "uuid": "9754d295-29b2-40c4-a2bb-a8983f3383bc", "comment": "Malware payload", "value": "0bf9c0b1d4a43f5986fa08f087b04cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "UxCryptor", "colour": "#713C6E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028300, "uuid": "32729b49-f3fa-40a1-b926-284bcfeb2fe5", "comment": "Malware payload", "value": "ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "UxCryptor", "colour": "#713C6E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028300, "uuid": "c3dd09c6-1986-4ced-8012-b917fed0cdab", "comment": "Malware payload", "value": "328b8542e3faeed47a959ab94ac2e4f1d39d2951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "UxCryptor", "colour": "#713C6E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786028300, "uuid": "c99eeeb0-5545-42c8-82b8-606a960cda13", "comment": "Malware payload", "value": "e3071be32273561f078c5ba66a0d66170f64a245d2b4336eae67578c1e7d5347943276e8e93b23f63d615c9087c97ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "UxCryptor", "colour": "#713C6E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028300, "uuid": "1df7c170-b231-4f94-9b49-1c0837e89677", "value": "T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028300, "uuid": "8a732e98-39b3-486b-80c4-e35a7370cfa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028300, "uuid": "c76d9b4f-ccdf-4f3a-a6c9-d0227e78aa0c", "value": "6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786028300, "uuid": "42a33929-5430-40f3-b465-487ac7227cef", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786028300, "uuid": "535224e3-aac3-4b9c-9ed7-e9e14784302d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786028300, "uuid": "6d3fa854-46e6-41f8-90ec-fea5d6ed706e", "value": "156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b200da-91a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786027386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027386, "uuid": "f9dd72ee-376c-4867-b11a-302164530ada", "comment": "Malware payload", "value": "e8b4b763fe3b421537b46b3d423ec9c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027386, "uuid": "5282d2db-ce73-45e3-b7f2-787ecc64468e", "comment": "Malware payload", "value": "ed23a8c75dc4f04acd8b68c51a0ebdb4d5cce6c06eed2451ebd0428a32d9df99", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027386, "uuid": "93e8b7b0-d9df-49dd-9526-98450bcfeab8", "comment": "Malware payload", "value": "1c511ceec0f05d44622672637253555682bedab8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027386, "uuid": "2d0fe4f1-f410-4ac4-b106-2cccec986f2a", "comment": "Malware payload", "value": "670ecdb425dda6ee4f25ffea5c95aca3e16ecd855672a37bd8f9211071be123cc3a97026cfe09d6b84cf335f6bce53c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027386, "uuid": "1d7416c0-528b-4f9d-a38a-d0aeb5862bbe", "value": "T14141D1BAB4A18E303359C4B9B4866948B7579A6F442A6E74B047743C26BC324B1742A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027386, "uuid": "65e0018c-aeac-4f7d-9e2c-1ca546e2196f", "value": "48:vkwvpihneZZn1oBydXSt21j/EmfthmmzEvJGU6+gtIIqNTMTCki:vkwYheZZK8CujnFhmmzIl6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027386, "uuid": "4a71a48a-0380-4658-91a9-3eb9dead2a65", "value": 2316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027386, "uuid": "9637ea40-0727-4c6c-af32-658989291963", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027386, "uuid": "64e83aad-62ea-4168-82fe-1c17baff7337", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbc5c7b-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "cf1d72a1-25ee-4896-9163-7b7d0a7d9cb8", "comment": "Malware payload (Mirai)", "value": "63a7a3a7cc6d6668e2168a7ddd31e943", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "54f2cfc1-c1a0-4336-a8dc-9833eeaabdec", "comment": "Malware payload (Mirai)", "value": "ed82c283b9914061aa394666f9fb12045796bae54ca71e577dc8ac34eb42838f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "92cc5b7c-c2f0-4cc2-a099-4af460396c38", "comment": "Malware payload (Mirai)", "value": "95ce23d519879306176855d1ca63a1c0790c0a1a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045738, "uuid": "b211e20c-7db5-4ab8-9e97-09b2d686f699", "comment": "Malware payload (Mirai)", "value": "4b4f2cb81e1068d44ad35f00a681af5bd85bb4887190389597131676bf6f1a8716ca92cdc44c1c977986461fe4f55518", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "8d59cc78-726b-4c9e-8839-e79828942282", "value": "T11EE35E8AF4019E7DFD4FE5BE44670E09E931A39131830B2A53DBFDA3A9311994D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "9f559107-78ce-4707-bdf9-2ce7fd658c3b", "value": "3072:7oDlIyA+oy+ZGiTSr3aiIHH5lgLOoe97dlJ8jNS:1Dy+ZGhIXxoe918jNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045738, "uuid": "f6d79204-e96f-45a2-86b6-08f662c89f6a", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045738, "uuid": "c71208a7-438f-4d41-9247-d2f165f55d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045738, "uuid": "24f7e8ae-2d7a-469f-b453-88537bb90f7e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35111b75-91bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786038584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038584, "uuid": "28364d63-fc4a-4553-aa24-94be0c6b8ef8", "comment": "Malware payload", "value": "7e75a1526ffca4fcbae0c9bc42cc433d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038584, "uuid": "1fc49405-1e29-4e89-811c-a5eaa6a37578", "comment": "Malware payload", "value": "edb656c5f2db96b7ed833883de062ba2580c45bc37ad048f6a1e14c11ea60a53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038584, "uuid": "9fbd7bf4-ba35-4d05-92cf-8959bfc5e348", "comment": "Malware payload", "value": "e2c7f6c94fa5ce33b7fde075986a602610ccc407", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038584, "uuid": "ff2f530b-ccd7-4c8f-8e08-4492c418964d", "comment": "Malware payload", "value": "eddbfdde43cd77fdfdccdd36b8fd4acfaea88518b6ba1fad09320c68eb1e8e605df32335e5e372ad01448bcbe51f63da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038584, "uuid": "4e1f9110-1d0f-4458-9e0e-afdca7e7af56", "value": "T1CD563903EC9155E9C0ADE6308A669253BA717C495B3023D72FA0F7382F77BD0AA79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038584, "uuid": "73716670-53e4-416b-8ae4-4911fe3e4d53", "value": "49152:wgp2+dphdzWEiPVpth1JPHbNlvhOar0oBn7/7JUMagH7+EoT7PVPlLHK2KDKnkq2:wkhJG1oarNzAgy79ZBBxEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786038584, "uuid": "752c93f1-f31b-4579-a706-3ed67b69c5be", "value": 6430905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786038584, "uuid": "5013a8d0-f276-4c99-903f-5c56ab797e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038584, "uuid": "3c2a3af1-03c2-4034-800d-8ce1c3e87c30", "value": "agent.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9672b58a-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021997, "uuid": "cada99f4-ec82-4602-9096-1be7b0654420", "comment": "Malware payload (Mirai)", "value": "6584b9dc352a8d3b903d25d990edc01c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021997, "uuid": "ebf76c23-1e88-4313-885f-a351a97ec073", "comment": "Malware payload (Mirai)", "value": "efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021997, "uuid": "309d967f-97db-465a-9b53-f99c405dd5b8", "comment": "Malware payload (Mirai)", "value": "c613b2c0044d88d84d6f1deea824848840bf4dd6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021997, "uuid": "9bccbc40-d424-43d6-b4b8-4230842f3b5a", "comment": "Malware payload (Mirai)", "value": "afca3e98372f9dea6731c3093d4efcc788fb17741b167d82875cb91d29fb148cea0f130454bbcaf79bea30d742f6b2ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021997, "uuid": "f5ba0617-132a-41cc-848f-a468b3f6555d", "value": "T188412E8E10705A3DA46FDD5C39F74700685486E276B23F295EA808739CC6B34736AF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021997, "uuid": "259c6f7a-bf8e-462a-84cf-3588215200c2", "value": "48:7CU0bWAxqr/NocieyzF5XsYXgvvQjfxMPfRFSX0zEAUbSy1ExVj68f8Kh:7CU0jx6/NociegvRgvoCJFSX0zEAUWy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021997, "uuid": "6fb5e113-0e80-4966-8aab-0f5326f0d272", "value": 2434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021997, "uuid": "0ba36fae-c55f-4233-90ee-d800dea1eb97", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021997, "uuid": "e9a79202-0037-4724-b28f-14a4a938a9c9", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640270f7-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786048970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048970, "uuid": "9c7629f4-648a-410d-9e40-1f18a87adc29", "comment": "Malware payload (Formbook)", "value": "930114eafd4d5b3b863c795bb99e9ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048970, "uuid": "1bf01d02-bfd0-4c78-807e-68602fcd02b5", "comment": "Malware payload (Formbook)", "value": "f0e29d11e1800cf4ef616458f74cd3cfccd0e39559423344e92574fc78023259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048970, "uuid": "e47aa135-ea55-4841-b696-3d86086bf756", "comment": "Malware payload (Formbook)", "value": "7ef9a8e90e0f3dc0f51d87eec0fc00716e572e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048970, "uuid": "9e43f011-0b11-4e03-8861-df9d1de8dbc6", "comment": "Malware payload (Formbook)", "value": "b282857a57c7a4b465b6e76215161b1438205085cfd8c6b57c7a4f05e4d08964f8ba3ef5133cb9ac112cf1c200e23fff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048970, "uuid": "919ae93f-e6bf-4289-a52e-d5f2c0178e09", "value": "T18F5423D411DD5A2BE943FB7457118ED59B5A746C32E10F3C4783E03A0FB286A2AD8147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048970, "uuid": "48bc5db7-6d8a-4c1b-ba67-38753ed343b1", "value": "6144:QaemkVtQGYTHEKWzDLLWzCx09xmgmm7kNMMdHjd4pYmbx2:eVtQGSkhfLiC+9ggmmkMMlOplx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048970, "uuid": "4c2bb0a0-24c9-42a7-bad8-56f78e81977f", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048970, "uuid": "bef9229b-292d-4e66-a525-e6bb4066b703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048970, "uuid": "9d211bff-48e5-438e-99bb-fef4ed1c1ad3", "value": "SecuriteInfo.com.Win64.Malware-gen.56431661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cca17f-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026608, "uuid": "2487bf81-f129-4015-b20a-a08e6038cfad", "comment": "Malware payload", "value": "b32f54357dbd89a28ce11986e50fc363", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026608, "uuid": "c9ff62c5-51bd-4046-bb6a-c8936de86ed6", "comment": "Malware payload", "value": "f143099892f89b7889b698829e0ff5c2c50b2bb642dcf896536f9f83bba36065", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026608, "uuid": "54cf2eed-7e4d-4f44-a4a3-402cea1d6b38", "comment": "Malware payload", "value": "b88d2af3d0ea8adfbaa3dd22c01fa1b460c9e7f9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026608, "uuid": "908dc0ef-d2db-4a82-998d-193a4089b88e", "comment": "Malware payload", "value": "57f3f30c45e0f80b0441c45bf5cb7f3a49cc5650bdfbff598bee0d766aefd2b41e881e2c99cff197e9a4756e4eb6c4a4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026608, "uuid": "bd80f56f-2aa4-497f-a9b5-2b1ec261c11f", "value": "T145575EFAB875B804103D4652A1E25217799FC9295ECF3AB1C3962F83907B20BED5387D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026608, "uuid": "3b5e7f5c-cb2e-417b-a217-a54e48cdc78b", "value": "384:VplQJhElWJh3VeHlj3JhXCmvm4xo8PNKbuZNJD9S3+2O3g+qyzCpCcdAY/YckY11:fdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026608, "uuid": "221afe66-9cf3-4019-bb41-a7c13f6fc687", "value": 29045990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026608, "uuid": "afb4a8ba-13d6-4d52-b833-112a4d90091c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026608, "uuid": "5e7359c2-4b96-4847-b6ac-62dfbdf7cfc8", "value": "Order FQ56930.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f372808-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021984, "uuid": "c8a8b05f-a986-4936-845d-9a04aa494838", "comment": "Malware payload (Mirai)", "value": "cc735d005e621852a7a212aef29a4d51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021984, "uuid": "8dc1648c-c833-448b-a2c4-ab6761899855", "comment": "Malware payload (Mirai)", "value": "f1b6c216445db6d4bbbea78817b5bfeb9a3c670b0cfe5331e75e6b951525e958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021984, "uuid": "4a5723eb-fd14-4dd9-83ef-a6aaded124c7", "comment": "Malware payload (Mirai)", "value": "d30c9b4c511a4669cffe9761da3c06319ba6c66b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021984, "uuid": "fb078c9b-7284-431b-9fd8-03d66d8880fa", "comment": "Malware payload (Mirai)", "value": "21f65693823e8853f63bac4bf5a244310e5e036e19ace1a1bfd308250ab67ae4a78142d565809f328d4eac2a4028d53f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021984, "uuid": "ac8b0bd3-885e-457d-87dc-818ef2a60f8e", "value": "T1B023077727230D23C0D55175A2E34336B6FAEB4A28B88A577960AFD91F485E032533F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021984, "uuid": "8ab9760d-bec3-4c10-97cd-fa61d8b76925", "value": "768:GFP1ELtFhMDHLgjuLnO+N7afS/dt4K/7N:GxLgjuHoK/dt4O7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021984, "uuid": "e57b8cad-f4e9-4183-b507-5c0a7de12f3f", "value": 48312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021984, "uuid": "34228a92-66de-4740-b16b-e4b086e6d490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021984, "uuid": "85ee654d-779c-4dd4-bc8b-e60d9de661e9", "value": "main.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41290510-917a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786008969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008969, "uuid": "24586c13-e957-40bc-87dd-73e8d79d3b51", "comment": "Malware payload (RemcosRAT)", "value": "8d287602603bdcc941ed7f3cea0b2864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008969, "uuid": "27e0928a-a687-4f8d-af5c-069e061fe605", "comment": "Malware payload (RemcosRAT)", "value": "f1fb1fa634403484979f21b36ee4c3e1449a95a4800088454472608f24add367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008969, "uuid": "13ee3d43-782e-4c2b-b47d-75d3de452bff", "comment": "Malware payload (RemcosRAT)", "value": "4c615c32b43225fbc6b72a7c32e6119fcef82fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786008969, "uuid": "89bc9f75-6a96-4e01-bee5-e0f6a7e1722f", "comment": "Malware payload (RemcosRAT)", "value": "b07c31321a450e6196557cce97793e1004103433dde4253dc7edc2d3a9ec874e9afb0ae379924d810424603e6d142cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008969, "uuid": "7e23a357-f1b7-4e94-b741-0456025a0c0c", "value": "T1B7D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008969, "uuid": "9c3ab405-9b78-420c-83f7-bb7e182f4284", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008969, "uuid": "1383e3df-910a-4a5c-9e7d-9e9729b23290", "value": "12288:4ZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:+QKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786008969, "uuid": "4fb85168-f312-4b89-bafb-b0e66cc9315b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786008969, "uuid": "356affa9-66cc-47a4-84cf-9e8ecbf4cd4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786008969, "uuid": "5747a284-44fa-484b-b68a-24dfe0e79f13", "value": "SecuriteInfo.com.BackDoor.Remcos.716.3449.17856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbd9c7b-9161-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785998336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998336, "uuid": "ad33fb33-4672-4190-880a-504c510893c1", "comment": "Malware payload", "value": "f27274defc4b1471cc7b07c95f322527", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998336, "uuid": "cd6bc910-7245-4599-915d-c0c605eec5a4", "comment": "Malware payload", "value": "f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998336, "uuid": "0a8d842c-ff0f-4be0-be23-9c2703395ffd", "comment": "Malware payload", "value": "bd633c8a3f00fb0c52c39d81df30c452198a145d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998336, "uuid": "53fb5c60-372e-4a15-807d-4d0fc98da145", "comment": "Malware payload", "value": "aabf6bfb42bdba9ba161430877d8ecaebd51fe4f1350aea2c353ae9b2ec3cdf47a98727927dc5bdee764966bdd65da9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998336, "uuid": "8ee46292-0a62-46d7-bad1-903700940869", "value": "T197F012DC40612A31CC41CEE97693CE795458E8C836A14A58AECC507094849D1FD11F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998336, "uuid": "314024c5-1aef-4ea1-812f-abee21efed20", "value": "6:kHkjjoEUDLjxEUDLvNvEUDLvnXmEUDLv7EUDLvNI3vEUDL:QEeREe5vEebmEevEeRI3vEeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998336, "uuid": "736043a3-92e8-486b-b7b5-e21bc8a57bb2", "value": 557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998336, "uuid": "d7acde7e-f737-4c30-b8f6-9cf273ba496e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998336, "uuid": "fb132829-2808-490f-be8e-464d1a51ab91", "value": "twget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5675c9da-9172-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786005568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005568, "uuid": "66e42ce5-8ed0-4ae5-b273-a4d3d0e82e4d", "comment": "Malware payload (MassLogger)", "value": "3a048ebfa796c7c20d8d375af50f5b32", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005568, "uuid": "c537cb77-9fe2-4629-93b5-2e702f99d03c", "comment": "Malware payload (MassLogger)", "value": "f256fe2b3364a559d3233e4b7c288391f4a2bc6dc1c54818fca9e5938f222f64", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005568, "uuid": "287f74a4-b90f-4b8d-b2f0-11fa379f8e5f", "comment": "Malware payload (MassLogger)", "value": "c1115c58f38603297caec938e4d9c63e3ce26c9a", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005568, "uuid": "f937dd81-a1cc-45a5-9079-eeed2fc38f4d", "comment": "Malware payload (MassLogger)", "value": "e389a90b24bbbe501f50fc382975b1ecd0391f254eb44455134b81c2cdd25aec8ee85f74bc17903eea64c0fe65ee34b2", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005568, "uuid": "e1502996-4fc2-4670-87f2-b8d0e3b790cd", "value": "T17B5370A21E28C0E32D5DF05460C1DFEE867A7127A9B94E0717649BA2CFBD1C73E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005568, "uuid": "779ba7d4-a391-4430-888e-4983b59f29a7", "value": "768:BSTVGtidMf8x3F3gGj5F5mwcWhVFfaS1qe+hBiQY/jxiJBPAJxl3NHT1QtmsmgOe:YTD7LRADHW0RczLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005568, "uuid": "7620cdf0-0f36-4650-9b6d-832e99ee47fd", "value": 61967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005568, "uuid": "74698613-2b36-4ceb-aec5-7d4994abd5e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005568, "uuid": "c3e6292e-5822-4623-bad8-70f471f27ea0", "value": "tmac6675443.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25256838-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "04eadf3a-5e97-40af-a06f-35c424b282c9", "comment": "Malware payload", "value": "39c3c6838c560326835b4755011c4207", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "367a9fcd-5913-42b9-a539-1c977bee76f0", "comment": "Malware payload", "value": "f27981ff8face9083b071dd3bdd77d2e23e919a26b0e2f4cfc6e79e24e533f86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "6ae647b6-3e60-45f8-bd79-926114d9bb2b", "comment": "Malware payload", "value": "d5c76b7dbbd968a109c5afffcb0b78ae45a8d5e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "8a6acdac-4830-45fc-a38b-edf47414f480", "comment": "Malware payload", "value": "1d4bc4c2dc51bb7d147113bab02c9230ca11c8d4fd96dd3ee2c108eed3ad18445d3ccc0f76a9560e48a333c89ff6cd37", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "a177edb8-7514-4ddd-82ca-04fb1ff6b71f", "value": "T1B6F0249307277F7C388335E0E06A4091A2A5E34951FB6A706584AFFAB44A044D7BEE71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "9cb7b2da-baa2-4711-ac10-4a87dd803729", "value": "12:geKc6VSCom0vUikRoy1v0QOnrMziaXuaqRHwntawSD/rgVHxJNxhIJlztHKw:g260mRD+nl72tg8rrIJLHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044999, "uuid": "8604d542-4156-4e0e-bb55-8e7f9c998083", "value": 641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044999, "uuid": "be34ddc1-39b9-41d3-8fab-d515200385b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "d3c658c2-9123-414b-80b1-43b1626e22d7", "value": "loli", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46057b75-9169-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786001675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001675, "uuid": "c4dec81b-0f10-4471-a3e6-87547994ee92", "comment": "Malware payload", "value": "387e87009aa95237e1a366e9ac796f0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001675, "uuid": "5aee961a-1342-4cbe-8aae-d50b0c87adc9", "comment": "Malware payload", "value": "f2c1ca6696ce4a0f5a07df7b9d9d7ef9cbf6a2fef2a7139a3923ba03d628c870", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001675, "uuid": "d004aac3-3167-4753-a360-18b1f2fd0bbe", "comment": "Malware payload", "value": "9eaaae20c7ca0e8444adab9f965ab43b7876dee4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786001675, "uuid": "07f16363-9586-4ec2-a131-970b72caeeef", "comment": "Malware payload", "value": "1ce827c4ee3538ed198e23d2eb640a354a6bbf220ed029f0fd08271047b0a3beaf37489b371bf4d2c636d3af44551968", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001675, "uuid": "6a097e34-3571-4d7d-85c2-82611caaec5a", "value": "T193235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001675, "uuid": "ae52de39-2ad9-4962-a455-39e6e968248f", "value": "768:sQFWzZx5d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:XkzQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786001675, "uuid": "386551d0-c1f1-46ce-b80b-28e325ddd811", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786001675, "uuid": "f7e21d2d-c9e5-4aaf-912d-5d762d5c0750", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786001675, "uuid": "52b8a522-e827-4e3b-8099-53aca09bb3e8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efffa3d-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "b64ba2fb-882f-4a4b-9041-8128eed5d4f8", "comment": "Malware payload (Mirai)", "value": "b83f1ee8bf4d40d298e4bc53b523f1e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "2d9cc6e1-af60-4994-86f5-df8bac523e7b", "comment": "Malware payload (Mirai)", "value": "f2f845e2dcd8708d150478c2aa5cc88fc0065645d1bbf376dd59614f4bbe22f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "3bb56226-15f8-4a0c-9b1d-7603e7d762c7", "comment": "Malware payload (Mirai)", "value": "2b92ff60c8c12188c1042fd78a0c098b5c163364", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045553, "uuid": "cfab200a-aadb-476e-bd32-9b8475a8a387", "comment": "Malware payload (Mirai)", "value": "a7fba4b198cd4fd84be6a7c7294d0c1d246285a508b99db642cb05a1482e986309cba04538c02fe300e0bb28482c39b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "a08bce99-c6d6-44bd-a9e3-29f513a8a358", "value": "T1EE735B01B3580D4BE9971EF0253F17E593AEED4122E0F685690FEB4A8231E73464AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "5474676b-bc84-434e-8d70-f33265164d9d", "value": "1536:yJRzQrhJGSgaMrr2piaajFiJymqixkiviyO:yJ9eP8xzsqqkY7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045553, "uuid": "c96d301c-022d-4ba0-8992-e8c6b62bc1fd", "value": 80148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045553, "uuid": "f3cba020-2595-4df1-a326-0f0fda04cef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045553, "uuid": "23dd2c58-9285-4733-bb32-87eb74e941c8", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80af9e28-915c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785996190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996190, "uuid": "1517a8c5-39f8-4cf8-9c8c-a17b9b2ecb12", "comment": "Malware payload (Mirai)", "value": "86138c5b78aca0234aa5e5c09d25c069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996190, "uuid": "e6f36b5d-4c1c-4f24-8d00-48eca0385545", "comment": "Malware payload (Mirai)", "value": "f30366f463b77057e0bebf0016ca7048d309879c7324e2847a4089338a8f4a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996190, "uuid": "a2d11c76-e1f2-4db3-802c-e3708a0ea55f", "comment": "Malware payload (Mirai)", "value": "610b99f9473204a49d51227463e8fe904bdcc242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785996190, "uuid": "be372b62-86b7-482c-9eec-439de562d7a1", "comment": "Malware payload (Mirai)", "value": "491a2df8d13e3808d89bba134248c48a40f5e73ee79597448af2789a57420b9000ae9521149e66db0d35294f2b3bbd4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996190, "uuid": "27978a51-7c7e-4637-85e7-1e32425cc923", "value": "T1B2E3E755F880DE52C6C4267AFA8E428D332317B8D3DA7102CD245E3577EF99A4B3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996190, "uuid": "ead5bb5d-e6d7-40bd-95c0-816ff1f870f8", "value": "3072:dSip8FqKVEW+B9DgqHP+k9SlWCpEqOKrB8UgWgY4wsy:ItqzW+B9Dg0+kxCpEqOKrB8Egrwsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785996190, "uuid": "bc421958-9529-4c26-86a1-e7e1842f44bc", "value": 144956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785996190, "uuid": "d14c1d1e-c5a2-4b3a-b417-79c7ce3642c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785996190, "uuid": "7093fda4-9098-4f07-8e9b-7364efb01c8c", "value": "disconnectraw.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa68d8b-919d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786024052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024052, "uuid": "182b9995-a1d8-4b24-8358-bba8a56dece0", "comment": "Malware payload", "value": "034a16eaeb79fa985f09d0e2eabdd759", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024052, "uuid": "194e8689-c518-4b69-8950-b467a97da45b", "comment": "Malware payload", "value": "f30e03097ae62592bb401cd68745c6b9bfa66a7bb06458adbabe499a9af635af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024052, "uuid": "5c4b824b-5354-48d6-97b3-239793c4bfc6", "comment": "Malware payload", "value": "e8534b86c44e04e9acfaa1d6a2bcfb1fd1268aa0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786024052, "uuid": "377d84bc-68b8-44b1-b5d7-9e82d87382bc", "comment": "Malware payload", "value": "a0b13fdbe20f68450e9a2e7a3496f74c8b7ad9f69f9c3a88dddc21e8c325930620a2036a4f33536e8187f8d9b440445d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024052, "uuid": "7fb115e2-5f32-4c6a-b294-b205df84ef6e", "value": "T1EA01D6DE03225551F094AF15B3A14DAA83CFAE8C21A82F8D7C770AD3044DCB8B101B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024052, "uuid": "901cd9e0-c751-4004-81a4-6727ec541fae", "value": "6:B2FrB2GLp0TFrAAz4ARFFFrI0eFK0K70TFrlfzCWkSn+uB0FrB2GLviLFrAAzNFv:BynZoF5ewEOWNn+08nviKkewtgZt+JGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786024052, "uuid": "514c7242-d264-4e8f-8bee-a801c76ccb09", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786024052, "uuid": "fd1c2559-5e99-445d-920e-58c4a0b513a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786024052, "uuid": "8d1b69e0-f846-4c84-8e41-16515eebfaf0", "value": "tbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744c1b36-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "2db011bc-f76d-449b-b2d8-c6fc376e49d1", "comment": "Malware payload (Mirai)", "value": "1bad6ac744639ba0ef0219fe176d5094", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "026c539e-1c2b-4d71-974a-76f14612f20e", "comment": "Malware payload (Mirai)", "value": "f341cd66b1412d4bda93df52a2cbfeb557cc2b2ea7918f5c0863e5391d5cee7d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "2daf8fc8-e507-41a9-a635-0eaeaca73a33", "comment": "Malware payload (Mirai)", "value": "f8e1c384787737eedc3e12eea79373576a81b95f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030959, "uuid": "262c8270-8d65-4915-920a-89ea2db7a5c5", "comment": "Malware payload (Mirai)", "value": "0d47ebb2fe3e856f1e43f8c2b44d225e9c4b5cfe5345353ef6999b66f37ed452f250e2a05c421e53a97bbfe17a21fdc5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "ceb07585-9b7e-4613-b57c-9eb3261ed62b", "value": "T19CF43A55F880DFA2C6C125B6F65D46AC33174779C2E772068A258B343BEB86B0F3A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "c3bc06c6-7246-405a-b0ae-a07a5bda3ac4", "value": "12288:1NLhllrbxgxm3FYvTu68dU5oCUNaj5XmfCMC7cld06pKT7g8f:zhFySOL+NS5Xmf6Aluc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030959, "uuid": "dab89298-e4bb-4e63-b619-2b58c7d45cc2", "value": 726416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030959, "uuid": "e22ea3a1-30f4-45e7-9bdb-a224a7b90b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030959, "uuid": "37cfe1cb-a771-49bd-b233-cdaa66d32501", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31bb83b-9162-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785998825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998825, "uuid": "3efe8c37-348e-4a9e-b656-d3b70839f5c9", "comment": "Malware payload (Mirai)", "value": "8e31b09a5ee431af8ace46cca8d3b7f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998825, "uuid": "3b1e4eb5-e11c-47de-bff0-29dc15bd79d9", "comment": "Malware payload (Mirai)", "value": "f3791ba8b5a0cf588325e3cc0acd97b14e7ef735d4ba837db4ff68462094a435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998825, "uuid": "be1b8c16-a06f-479d-b768-2da94492b051", "comment": "Malware payload (Mirai)", "value": "b44c58df8881fd2e943fd330ed9ccb9c84fbdbdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785998825, "uuid": "706e6d91-b9ab-4ca7-894f-34a1c16b1349", "comment": "Malware payload (Mirai)", "value": "fc2ab6faa3786de495924bfa0869c52b6f70fc69735e5b7c9a701b8c85200978154bb10b4a5ff6e314a657231617a386", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998825, "uuid": "8e5e93c4-639d-46ae-91a9-de38b23350f1", "value": "T1C7C312FB1674905192D495B3E739CC50C46733EAE1FC20734B19523ABA738AF5E9184B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998825, "uuid": "120cc3f2-df3f-4097-a8b0-a741368554f6", "value": "3072:4/60xbpXXp2OeTHufRTBgCgken/4/Sd3tPG40BS:G641XpkTyRTBgCuYS7Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785998825, "uuid": "98027820-f432-4eb2-8432-2b7a13f625a8", "value": 120384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785998825, "uuid": "76cead81-367b-4fef-bf26-a996c10138a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785998825, "uuid": "8a26823c-b0b8-461d-810e-2ac6615f19b5", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0259114a-91d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "9888bf84-426d-4558-826f-3535da4b6984", "comment": "Malware payload (Mirai)", "value": "c8d55a5377a684b216049ffafb9a2d7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "2de54f87-f7ec-41b6-8ff8-5615aa69af36", "comment": "Malware payload (Mirai)", "value": "f3a8146a7d063e8895246c1f16c82ab51809cb7d513fc1093ffb12e039666808", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "4a8a51d3-f68d-4dce-a169-a0a0f6ac4300", "comment": "Malware payload (Mirai)", "value": "df695b806a3cd6ef3c57c78bbb1f312eb9ff1caf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048377, "uuid": "3df5ee49-e271-4ca2-85ae-ea1709ae4c55", "comment": "Malware payload (Mirai)", "value": "d96407c631e7f9218c8b05602078419bf56ab053119398bc379d108e4acadb99993aebffb3f4193d863e2147e1cedf14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "8007ed6f-eafe-44d7-9fcd-82a16ac09b65", "value": "T1F9E3F749ED42AF00D5D636FAFE4E428973935B6CE3FE71129E245B2127CA91B0F7A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "eaec3d5f-45d1-4730-95f1-0fd3fc0beda8", "value": "3072:qXZpD+/4jc0P752JvM/rPu/LYQQQM1apoWaPA80r+clEWKm+kLXpm8DggU:qXZpD+/4jc0PFcvM6zYJf1apRaPA80r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048377, "uuid": "41d9c7df-9226-4807-8729-e07a09699e2d", "value": 146248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048377, "uuid": "560e32bb-ff8b-4524-bd38-dc4c7b2db282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048377, "uuid": "b2ae0a1f-c692-4b26-84a5-07470b95f732", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7649d92c-91a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786027956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027956, "uuid": "6b3358b4-126d-449e-9920-bb02355f850a", "comment": "Malware payload (RemusStealer)", "value": "ec4577b2e1c7bcc6f903cfb0bdc02f64", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027956, "uuid": "54f212f6-d8ea-4daf-ad59-0f3fd01f2d23", "comment": "Malware payload (RemusStealer)", "value": "f3ef2636d9b60715c2ea7c032cfd20492b7701bfa72ed3652b2bc540760988a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027956, "uuid": "4c773f31-b02a-472e-a9b8-31cf206843cb", "comment": "Malware payload (RemusStealer)", "value": "32181b725f0ebada1c09c1de78c97d8a2fef74c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786027956, "uuid": "ad493bf6-158a-4aea-a16a-8c7b903a0e0b", "comment": "Malware payload (RemusStealer)", "value": "7a6d0d0b11f0c86d9808b206ef1150fb0026c2ea0c7dcd7fff013a6aa42880331c5ac792b44765cf3134932e17b3b682", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027956, "uuid": "794d2b85-a14d-4a19-b27b-c402b1b0a294", "value": "T1EEF55A03ACA149F5C099B73188B79296B771BC086B3527D72EA16FB82F723D05E36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027956, "uuid": "1089c2e2-4162-45d1-aa76-511b799b7a9c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027956, "uuid": "45db9a47-6c2d-471e-8f49-e9f1c3e2d157", "value": "24576:pNIq93QRmSfalsYvbbO2evIa2fZdm9hvc8YC9v/oBele5I92wijjKJs9cqna:pNIgKmXl73bevInC7tzLecd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786027956, "uuid": "02f85dca-7046-4149-b759-588221fe0948", "value": 3433328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786027956, "uuid": "5fa68beb-4609-406d-9d90-a263510ce09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786027956, "uuid": "8c618572-aa5c-46c4-9802-d548ad046dcb", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d401d59-91a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026625, "uuid": "a4a03c37-f445-4ada-bbdc-26282320f0c5", "comment": "Malware payload", "value": "11eaa431bb17e2bd5a672cea2b09cf55", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026625, "uuid": "19ae43ea-92d5-4e96-a6bf-aede0b79d08b", "comment": "Malware payload", "value": "f4301deb4c41559ba98a66fc681020382104deb0bde53cc608cbd275bbe6da93", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026625, "uuid": "104c3e90-e874-4b91-a7b2-2962c2e8da76", "comment": "Malware payload", "value": "ed062d0268af7c46f22562966d9e39ab4ec48c92", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026625, "uuid": "50446a41-0ffb-42ab-8c68-fb7505349397", "comment": "Malware payload", "value": "fcdc8eca1bbfc9ae7849d921525b5286e9e69246eb60b1e5de3f5b719f8a92d9607ee3a70a30b66804363a7557e72fae", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026625, "uuid": "a0be4a60-e859-49ff-aab8-f8d716ec5648", "value": "T15011DC0207EF3712D527DF7383E99E24DFBD20152E0A9B6C27499B192A20D04E972F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026625, "uuid": "664fd6c7-16a6-41f0-a19b-1f2bbac6509d", "value": "24:8cs0kBnDl7ycP2JdKAyNKnGb2Jd09P2Jdx4I0WeFm:8cs7Dl7yc2b5ju920IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026625, "uuid": "b6151ee0-0b00-4228-b0d5-e1027b852607", "value": 883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026625, "uuid": "274c6af0-033d-413e-814a-2b1058efa8aa", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026625, "uuid": "66ac2fd4-07a6-4167-a352-628a4343881e", "value": "Shipping Docs.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751914d8-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "23e357c8-d7c3-40d2-8c56-c674bf91c7b9", "comment": "Malware payload (Mirai)", "value": "5805c23941a8ecd06ad698f352e899b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "6662fc98-a986-46ea-85c3-cb7aacaea804", "comment": "Malware payload (Mirai)", "value": "f4936e80bd509be07c091ec5dcf1433d29366badc93715467dd40b5cd3cc40d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "23b85985-bf17-4f12-a326-20bd43f7af42", "comment": "Malware payload (Mirai)", "value": "4cfe85335c28893f7a9e6c9a2512d18587ff2262", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "93cd6d63-f604-40a5-92df-c0d550e996d0", "comment": "Malware payload (Mirai)", "value": "67999dcbb1f45fc676bbe0e702824d6be8513691fa1e8215447642f54a0cadcc8fbe386eaad22741ea822cfe27d49c79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "ea2bef35-869f-4438-8699-0130b24c11a4", "value": "T10D04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "ea1dd746-a624-4316-bf47-afca55d4c42f", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2s:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034396, "uuid": "17622287-bb24-4d16-924c-8d43c9198ecc", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034396, "uuid": "2c00a1b6-3662-4331-8140-92026aa1c077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "8e2ce10a-becf-47f1-80af-53d81516c7f1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54014564-91f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786060540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786060540, "uuid": "025249e6-b828-47bd-9e54-6764d644e8bb", "comment": "Malware payload", "value": "1e2b116f12129f0c5a384ae24d34f061", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786060540, "uuid": "5574cf3e-d5a4-463c-82db-9b73f89dfd10", "comment": "Malware payload", "value": "f4dc07d863c39fac212ae9c43b6eb84286a44306e2d26372617bcef641bbc693", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786060540, "uuid": "2506a247-d001-4018-bc7a-f514554a8dc8", "comment": "Malware payload", "value": "77679188e742cc7f89dcc58de189d3c40b824aa0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786060540, "uuid": "f9a3d304-282d-4d6a-8546-8de2ae1ed973", "comment": "Malware payload", "value": "ff705de9704c52a9dae43685fb0b80130930fd33a87c867d6d0d6320e1ee58f21a2863bb5ce923f88dc06039d7da79c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786060540, "uuid": "b5f65cc0-71ab-4782-871c-5df5258833ac", "value": "T172F142A53C6594712ACC853C5BDC5A1828EA017F79062D2C340F7D3D2F79664B7FC2AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786060540, "uuid": "c5df6997-c12a-4bbf-b405-5673da8ad6e2", "value": "192:JmtAk1Lr8XgoH9r1PKZihEo8jYtIuCyDA:JmeUSHzPKYhEoeyDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786060540, "uuid": "11e6ec39-a8aa-451c-8e27-7df3f4d56c2c", "value": 7977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786060540, "uuid": "0597ee7e-46df-41e4-a09a-eb1696b613dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786060540, "uuid": "9f52b48e-d76f-438a-8c02-9ba82128bc53", "value": "f4dc07d863c39fac212ae9c43b6eb84286a44306e2d26372617bcef641bbc693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee55d1f9-91ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058651, "uuid": "a676ebfd-c0fa-4e72-9e06-bda3f2c4b5f5", "comment": "Malware payload (Mirai)", "value": "b7eba7e1c4fb80786d3c400dd6c8ac5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058651, "uuid": "97d71465-4156-451f-bf55-c2315f0595d8", "comment": "Malware payload (Mirai)", "value": "f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058651, "uuid": "27522787-43d8-401e-bb2a-9a58cafcd1bf", "comment": "Malware payload (Mirai)", "value": "457a1d49a2a1e968db3e1cc9d054b9ff6f27b601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058651, "uuid": "b033d321-2f71-489c-a2e2-f2057c52e032", "comment": "Malware payload (Mirai)", "value": "ebf269b5709ca44960b39bb5eb283fc81d9753cb980d3b816bae7f5a2111bd4950db6b19160f8cdf17983e9f33875c6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058651, "uuid": "027d01cd-d394-4cc5-b7d6-98edd67e7788", "value": "T10743F259892BF576EDBF0836E63A47011432AE21C075B33B3D084244EE962DDD9FD968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058651, "uuid": "50260e74-a983-485b-a7c9-87075a537b8a", "value": "768:bTckj2H6CqS8jo9M3sVj3bUzl7L3YXMtVaQsGfNsf3uSHY/rhP0BWUJScfa43U0u:bwM2aCv19M3k3Uz1iMDaQsGfC3uSc5fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058651, "uuid": "06d6e9b2-44bf-486d-bb2b-35a3a13e7be5", "value": 56484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058651, "uuid": "222c34fc-fbc4-4722-8070-df04d8a54b63", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058651, "uuid": "4ad9a666-5444-480a-ba73-46870ceef2f4", "value": "f52824d120c097cbca20a105bfef128d103b9ee54c9ba9cafe38c8d79a95bfea.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb9c280-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "99e447eb-2403-4be7-a1be-fdda6de1440d", "comment": "Malware payload (Mirai)", "value": "db15af8e25bec80b01e84977a06b8b54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "07a8905f-c51a-4c7a-87ca-1b0c930b7e0f", "comment": "Malware payload (Mirai)", "value": "f57558a3a4c8cec30b25d08c22484f9884333526789635039fd53e4c400e6d71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "b115a78f-7a24-43ab-9579-d4ba89b33966", "comment": "Malware payload (Mirai)", "value": "fe107b66e50208da6b11056205b036dd06387074", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047997, "uuid": "38f01cde-d64a-4b95-acf3-fa6a0ec46daa", "comment": "Malware payload (Mirai)", "value": "26f42486c63c7d486070d8485444c0dcff28d56f3ef9741112bf977b95fd2d2b6777f24f9ac89689d5a6a54e23eb6026", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "5c29227e-15c6-46dd-9e93-78914d53d628", "value": "T1B5F30955F880DE52C6C1267ABB8E428D336317B8D3EAB102CD245F3577EE95A0B3E941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "4a68b31b-4e4b-46fc-913a-68658bf0c21e", "value": "3072:R3KEJWS/z2mC+8HKzVwNfPcGgbFtSn+9b7PStdQ60/iXOGHu8cJEaYCgkl9Xf:R3KET/z2mC+8HKzVwNfPcGgpMnaPPSTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047997, "uuid": "6e487fa3-f2f3-4957-a4fa-6327a85a0a6e", "value": 165476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047997, "uuid": "f10ee2a2-be95-4f29-8f65-1cd708c5b7c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047997, "uuid": "7b94c852-24e5-412f-a312-aeaa1cf6ad09", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd5536-91cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786045554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "dc4d7037-bfff-4cbe-9326-bec4b1978fb2", "comment": "Malware payload (Mirai)", "value": "659099f0838f768760440e16eec8134c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "53b87915-a55e-4fc6-bb39-f0e8fb0b793a", "comment": "Malware payload (Mirai)", "value": "f5d25618e8d9ec09779a04c0c5843e869a5e07a8904784fde50d3b8b93c718e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "479ef070-4c33-4526-9763-7a66f4b12edc", "comment": "Malware payload (Mirai)", "value": "66c249387e65fb49d6b6ffca2e4cbd22bdc529a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786045554, "uuid": "9878645f-d6ef-45e4-abed-0d7ec17c661a", "comment": "Malware payload (Mirai)", "value": "414494b755eb5fd29cea0ab4b987000f268dbe9ac77b82febc12d513ba17199123cf08f8cdbbe3925a3c8a0d78fe6533", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "4a4666d6-b0ff-49de-afc9-dcda58f24469", "value": "T137835B87A58180FCC0D9E17806BF7535D423F07D1276B2A62BC4BF0A7D58EA01F6E95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "217e92b6-de17-400b-bdbf-c5a109516882", "value": "1536:atrSRD3gno3eyJ0e8JyuNMNUvTswwXsaaY2v9Ds0sXBkWI:qKgnouyZ8YNUvQPXsS2v9TsXBkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786045554, "uuid": "75382e05-6988-4839-b7dd-b127eba0989b", "value": 82048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786045554, "uuid": "6f78ea2a-be18-4f4e-90dc-d1a33ac90c25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786045554, "uuid": "40724143-30a3-467e-b06e-a6e9aed6bdab", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4108838-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786005403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005403, "uuid": "3b796f4e-2281-4a10-b55a-f7c3fee22655", "comment": "Malware payload (AgentTesla)", "value": "1f527a59f746bc8aa76c90bc96368d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005403, "uuid": "6e21e2b4-287e-4985-b179-0961207cbe0a", "comment": "Malware payload (AgentTesla)", "value": "f5f8b6b6eac410d41c6025a526b7189dd78cfac233f25b74280e1a22e0bb102c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005403, "uuid": "fd1d54f0-eca2-47d9-b889-bc26850b4b3f", "comment": "Malware payload (AgentTesla)", "value": "cf9415928109f162b2130066858e4ae652299758", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005403, "uuid": "01de5a06-1f2c-4c8e-a39d-226a93b51e05", "comment": "Malware payload (AgentTesla)", "value": "b758415eb81e57bbe961c68cc9bdc857c4c3dc065de88fd926823f1c17f146595c8db38c71a43e3070f54517ba7f3f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005403, "uuid": "8298c599-9ac6-455e-855f-131d8e1f8afd", "value": "T160D54A842564F3C1E86C2A71AD0E0F9A8F3EE153EB50EC47772D6A965B4DFCD3294908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005403, "uuid": "c2eeeb48-ac6a-4aa6-9b44-f8c7b06d2fad", "value": "49152:/VuWRDnFfaXzAiD7wRMZKNFmS6bfJpOO/g0yzxuvLo89gHgi5JSUuYOdgFh8fbjz:/VuWRDnFfaXEigRkKNFmS6bfPO4qzxuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005403, "uuid": "fbf058c3-9d36-40ca-81eb-91e1674f81d7", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005403, "uuid": "2fc1a63a-e9b0-4309-b6ac-fee55e328fc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005403, "uuid": "6c90c4ae-2169-4e1f-bc7c-63dbd2630cc8", "value": "RFQ AUG6 2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa55c7c1-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040203, "uuid": "6415587d-426e-480a-b37e-298a56c0267a", "comment": "Malware payload (Mirai)", "value": "ef20c84fe39c2ce7d5e5a71ff5ce32bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040203, "uuid": "58033f90-9cfb-4b98-8378-6ff524241f5e", "comment": "Malware payload (Mirai)", "value": "f6045a0ac48a49d18b7e8e2335254cab950cde35e3954beb5de0aaf100b795cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040203, "uuid": "9b31f40f-7356-42a3-bed6-5dbbc05d3953", "comment": "Malware payload (Mirai)", "value": "ad99cc6cfc61a364f1755e64587a42d7069f87f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040203, "uuid": "93e1547d-66d0-4a6a-9258-a4d3ef44fa46", "comment": "Malware payload (Mirai)", "value": "d39c821140f679370e22bab054cb77212ce82ed0113007dc3c001a255226dbda3ca9089d0820690482cbcfd542dca422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040203, "uuid": "3abbec3b-01d9-42b3-8cda-2926009a36e4", "value": "T1096439226BB54B07D4D4AA7E66F70321B5716B592878C70B7EA02CCD6F6CAC0341F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040203, "uuid": "b385cfc2-9249-46fb-b277-e9e2132a825a", "value": "6144:q6Exn3feKeOXwmezXYGVqrLvubbiWxSH5BS3ol1:GteoezXYGa+i7ZBS3on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040203, "uuid": "75f618a0-7c21-4438-9f94-794ef5201ac5", "value": 307824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040203, "uuid": "3f7c8246-b6d1-4804-917c-2e4aee5f9c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040203, "uuid": "4eb83eaf-ff80-4dde-851b-c11ed8d6a709", "value": "pope.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd3f8e3-9171-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786005393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005393, "uuid": "9538067c-390d-4703-86b4-e99ce7c6132e", "comment": "Malware payload", "value": "7261ee3fbca364f5b09a01aed3a30331", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005393, "uuid": "b2b9d5b0-922c-48b0-b613-a096cf94a74c", "comment": "Malware payload", "value": "f62cb6f02c41602ef307fdfa945fdbbdf23d872b95823b9a2365e1ccdcfb9cea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005393, "uuid": "a74b8cf6-5d85-499e-b9cd-2a6a98cc2f20", "comment": "Malware payload", "value": "384935fbb35518af915f17d4fe3611dc1f3dbddb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786005393, "uuid": "47598e33-977e-45e1-968a-693184ea27ba", "comment": "Malware payload", "value": "1cff957b7bef08ed9e2e6b245c66e2e292539f298789dc1a4e826d4bc42cee827c96c2eb44ddee0af3d724308dbb4506", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005393, "uuid": "99512c41-9e0d-4c13-a04f-b5fc6f5035dd", "value": "T1B945327E736E3934C127E3949C0BB7959F7C862F60AF878A7D2C55A390E2CA04429D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005393, "uuid": "617be514-f86e-4d35-9a51-a5e423a3be66", "value": "768:+Vussgz9TTZq1ucG1IZgTj5gzhzhzzjDTZE1Ww1WazTNDz1aVuss0ZcwzjTfWaDH:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786005393, "uuid": "22178dad-2e12-4d73-8680-4a8adfc47303", "value": 1189723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786005393, "uuid": "ab5ff1d6-6b50-4596-a5c7-4648c665361d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786005393, "uuid": "dcc09cda-be4f-447f-9cb8-84f497f4f8ba", "value": "Payment Slip-02.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a6736a-9142-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785984819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984819, "uuid": "788696bd-dcad-4af5-840f-db1158ddaf77", "comment": "Malware payload", "value": "b8b3bac5ba9bd44c818160be7ddcd86b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984819, "uuid": "cd0815c2-76c2-404e-bea9-35d1592c9d19", "comment": "Malware payload", "value": "f6be87cd9afeab65ef6ce2652f506ecaf228a705d3a22843e4eca96997f1dcf3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984819, "uuid": "66b77dca-8eea-4d22-9fdd-0e5e8c768793", "comment": "Malware payload", "value": "0d5d711f86def1f2ccaaf6d1b2891d4490ae727a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984819, "uuid": "7828d25f-d025-4277-a83e-bd1614ca48a7", "comment": "Malware payload", "value": "0ea87654b9ab3f4ca0f08bcb607c1cd833db7043d5043fce56f73427e1b854d8333c5dcdf38f4c7a17f97d6d1a8b07dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984819, "uuid": "6e728305-f883-4ef8-9d5d-564de886a120", "value": "T11C235C2516857C24AE98C4361C7E2F0CB9AD43E6325452EEBFCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984819, "uuid": "6db25181-51b1-44e0-bb5b-e356c173c28b", "value": "768:bJ+5S9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:bJ+53cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984819, "uuid": "a45c1b7a-98c3-4bb4-bb58-d5cf80f21949", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984819, "uuid": "9cc0a808-66cc-4fce-b61b-861836136cb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984819, "uuid": "92525f53-ef81-47e2-b4d9-354e13a39e28", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd253af2-9156-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993822, "uuid": "e30d4d71-7828-4ee1-bce1-ffe042b405b9", "comment": "Malware payload (Mirai)", "value": "108e6dea4f099fc49ebe9bfc03c6a4e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993822, "uuid": "6e72ac9d-ad55-4ca5-a4fc-bd4eec7758c2", "comment": "Malware payload (Mirai)", "value": "f6e8cb9abc9d355c15971547ccf7bb0e0eafad617e38582d29fef2cd6df3f1da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993822, "uuid": "bc2de908-d8e7-4f0f-b652-3ce1171df52d", "comment": "Malware payload (Mirai)", "value": "6ab2d68e3e776ac55ae3ae06d2d8bd7b478ce996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993822, "uuid": "fedd43fd-89d3-4814-ae61-f7263278f6a3", "comment": "Malware payload (Mirai)", "value": "8f70dd35b94aeb5723645e4c04aaf74077b60abb93a597ebb54b9ee4759801bf0d066b3a49fa60236c9be21855ac259c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993822, "uuid": "f04a761e-095e-45d8-92a2-17330436727c", "value": "T194042A4F7720CF61D32CD93009B3CB5656E526522AE18889F31CDE08BE65349A96FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993822, "uuid": "c9c5017a-cd41-48f6-aa2b-e90b7d719928", "value": "3072:9t/754eB/M7PzpTIJKwqV13u5ISUrsLyw/n78ESgAkb1DDjn:DWdwY13vRArobHkhTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993822, "uuid": "56b55876-847e-49c0-a6b9-86fe32fb88b0", "value": 185236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993822, "uuid": "2255f308-65b8-44d3-82b2-164fcbb336a6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993822, "uuid": "ef2df868-d64e-4463-9f36-32b41ceba077", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c5b12f-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786049508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049508, "uuid": "52ef5652-757b-4795-b178-30104fbb4d79", "comment": "Malware payload", "value": "1187112573cb0257eeaaddc6e18b36cc", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049508, "uuid": "8fb199a4-c62c-459a-bfa3-966767bd21f3", "comment": "Malware payload", "value": "f6f133e53b98fc3e0d108357e848f7250ad9fe1b8af75cabe379c03d01e13a81", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049508, "uuid": "f52e491b-2473-4e32-a26f-292e379d6e5d", "comment": "Malware payload", "value": "14d696393464aa44bc72199105b825d9ea2a96bb", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049508, "uuid": "1323144b-1739-439d-9b5b-97bf36efe545", "comment": "Malware payload", "value": "52f5fc03aa9f48cef7e4cf850c60b8e5f86c1783f19f6b29747e6dbb540a05cbc2f71db872cd182449a422417e819e70", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049508, "uuid": "df4196b9-c087-4116-b001-1aa71ea45b54", "value": "T11A46E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049508, "uuid": "ac27162c-5fbb-4c42-b230-4959cd53752b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049508, "uuid": "0b442a29-4933-46ed-baba-0632feae8bdd", "value": "98304:jzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:jhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049508, "uuid": "2c64a879-c334-4da0-90a1-ff9a3d84ee4d", "value": 5687224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049508, "uuid": "ed6648d4-f8c7-4065-972c-80a6265e9702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049508, "uuid": "e4531b78-1e23-4f69-8d76-423d40637629", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47cb8b4-91d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786047038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047038, "uuid": "4f3bdbd5-9868-469e-bbe1-34b8b24486d4", "comment": "Malware payload (Mirai)", "value": "4f38e2e725f16b2714d42b583ebed401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047038, "uuid": "9e57a360-d7c0-41f2-ad2b-2dd1cf1095f8", "comment": "Malware payload (Mirai)", "value": "f6f9c5f16c7d2b9e4df3b132c05f356c9abc48a7ee1d5f079016338bc2030e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047038, "uuid": "ddfb3de1-5d6d-4b42-bfcc-3f21769b2f2f", "comment": "Malware payload (Mirai)", "value": "462b57f9d7c0ebc9ae976a1c25ef4d9ddea3c428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786047038, "uuid": "6895f5fd-682e-4a02-b53d-2328a465ed39", "comment": "Malware payload (Mirai)", "value": "22a6948517cf2db2c7270934a40511065c1d7aa0d2a2e5608706e47d7790aa2b0964b73f701aeb72ad338e50f2975277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047038, "uuid": "4dcd449a-7aa2-414b-b746-9b2b9b36da0e", "value": "T1F5E41B0AAF500EFBD82FCD3741A91B1635CC694732AA37353574DE14BA5E90A89E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047038, "uuid": "4e3c122c-325f-44fd-bcd5-0a58cbd65895", "value": "6144:kilZqYTNPknL0kWSNV+kDr9cnBr3eS9Kf+hYlrFnq2yNUHF5e3mxt9:kiu0mV+S9cnBr3/9TirHbHO3et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786047038, "uuid": "a2a57a90-c25b-4170-8cdf-f1c8807f2e93", "value": 681736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786047038, "uuid": "7381dbb9-d282-4647-819a-9051cb9c2116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786047038, "uuid": "6270d9fc-6bc7-4cfc-be42-42c82426655a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb45d74e-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993282, "uuid": "25d43ba3-8fd1-4de6-91d5-e54a12b26515", "comment": "Malware payload (Mirai)", "value": "d09e57322146fcbfaff0c3fbb9d03572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993282, "uuid": "5dded391-b61f-487f-81cc-8df93c1fee8c", "comment": "Malware payload (Mirai)", "value": "f7845559fb01db34607ed27046bd48c462ca6c0bf3166e856ba882bd9d95b286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993282, "uuid": "5d8b8101-8c8c-452d-853f-ee89c070a942", "comment": "Malware payload (Mirai)", "value": "a3a23da4d9cafd6b9b5003e5c2e528309610f0b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993282, "uuid": "40c19014-af67-42db-a5bf-b88769d2f4a8", "comment": "Malware payload (Mirai)", "value": "2eb866acd64a0bc0c4eca991847d832cf62eec9fade9d141cc730a2f65260e3d0f92a466d907670c00514f85c0cb0bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993282, "uuid": "970899b7-b778-49f7-ab82-60d607efdb60", "value": "T15B530275DAC1C0A8C18B40BD287FB34F145E9D58389135D71BAC119F8066BB429CFA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993282, "uuid": "b12a5e25-2b95-412c-82cf-47c8e4b6dba4", "value": "1536:ZemZ8kofPZfsPM9vtBhxdCP1OzsUxwoEsQSKOQjcmeqnouy8DMr:ZemZufTvDhxdCrUDeSKTjp/outDMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993282, "uuid": "0e58d728-cd97-4c60-b96f-867ac87ab5a8", "value": 62168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993282, "uuid": "29a6579f-e205-4a53-8fe4-e5709f0044a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993282, "uuid": "cc999c20-ec9f-4466-ba43-2b22ad2c5163", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051fa52d-91a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786026907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026907, "uuid": "0425cc3d-a18a-4370-88dc-95a980a64eac", "comment": "Malware payload (Formbook)", "value": "1f8499799f482802918c2c5fde6c179f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026907, "uuid": "b667a3e3-6ed7-4cc9-afca-2eb832c74655", "comment": "Malware payload (Formbook)", "value": "f787bb3704a9fe637e0e2ebdfb570ed8ae9dff3495bf4b765deb21dcde55e711", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026907, "uuid": "008e6548-3e15-4281-840d-1525ba5cfe8a", "comment": "Malware payload (Formbook)", "value": "dd5bceca6dc28755095c290ed274d70e6fbc0b4a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026907, "uuid": "24129ac8-47b6-44d0-be23-b5670e0e10d1", "comment": "Malware payload (Formbook)", "value": "dda6ec054c33b6341256c3e85025b225b9cdbf41fe62c7b0b00df4b1cd3ddbf591cbd87c608bc371c67b26a920633733", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026907, "uuid": "3b649a31-037e-4dce-a2b6-d16f49f9bc93", "value": "T13B255CED82349405132C2AB21A47A496504BF56DB70BC2379276C6BD179F291FC3B8BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026907, "uuid": "f0d3d318-d11e-4407-bb5a-6fca844f6d23", "value": "24576:GOP8YAzjiKHhMVVMZgbuK/FBH84/g0nSdxmDORtwE4AAodgf:wYAj60y0tE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026907, "uuid": "3040eb8f-1161-4ce2-92c6-9085e4070a82", "value": 971816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026907, "uuid": "4d147a7f-c2fe-4a63-b2d5-6c733d73a255", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026907, "uuid": "fbc031c6-ed2d-4446-8b87-fb0aecfa1c4e", "value": "SW_683200.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb0bec-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786022156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022156, "uuid": "8c829eb3-84bd-4e0d-8929-1297e47f616b", "comment": "Malware payload (Mirai)", "value": "06d04935af3099a587a9e198d1733bcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022156, "uuid": "c2df7893-2f8a-44c6-a440-628113516402", "comment": "Malware payload (Mirai)", "value": "f79dbd577ae5552492651e5f972afc2a571858de06ae45c438de402ec102881d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022156, "uuid": "cc2556bf-7e74-41b8-bce7-2da6a086cfda", "comment": "Malware payload (Mirai)", "value": "c4a8e0e690a4a19b24ec9319ec50eb2d3489900b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786022156, "uuid": "974a2f22-aa03-4353-9ab4-f1ab54401b28", "comment": "Malware payload (Mirai)", "value": "faf1958a7238a97dfd933201952134e660cf0727fcbf836f0427320c06c6d0ebf184f4c6e95c6b507654218f3d71f71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022156, "uuid": "d7860581-351e-470a-810c-e441c409e849", "value": "T1FE1319424C218314C6F612BC57F54A59E3C25F0739DB2701CA72F7397DAE0A46A93DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022156, "uuid": "2bea4cd1-e4ef-4694-924d-f12f27537781", "value": "768:Uc+JuaaB7LDINS4dY7vOyi1sHt7hMXUhKHG191ZBJV7zh5ooSaz80:Ukit3N1U7CtHG1ZBDooS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786022156, "uuid": "eaa9e447-d5ff-4d9e-af8b-29026b322f2b", "value": 42216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786022156, "uuid": "b5f13d95-f314-4cb0-8fa2-cddb7631377f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786022156, "uuid": "906f4d99-d8bd-4521-93a7-1598e75f8b2e", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bad59d-91c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786040200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040200, "uuid": "b7724c35-bddc-4004-a460-35f6e608b1f7", "comment": "Malware payload (Mirai)", "value": "411e56aea12ecb24789e3c6b05676d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040200, "uuid": "bfae343b-a2ca-46ff-af71-76671b288b5e", "comment": "Malware payload (Mirai)", "value": "f8045a37b35ec9e74905b9c20b0054ebd07f8d63d8404a8f9c55d4b001b3866c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040200, "uuid": "74915ea1-7b74-4745-9025-b3b0320be84f", "comment": "Malware payload (Mirai)", "value": "73b511c89f504c2aa724a268845396342846a02d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786040200, "uuid": "4eb93c99-5bd0-4e8c-8de6-7c7a690d8659", "comment": "Malware payload (Mirai)", "value": "3b7a746213220616650956892a830d31e1365c613a61bb3ed4daa6eed1b7cf26e3007d0d94b7b35369c9cf3f4a44cba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040200, "uuid": "9f67080a-e260-4709-854e-3631b6b9de0e", "value": "T1D1445907E757F4B0D54701B5330EEBB1A936A8716420885AF3D2BF69B9B1AD0D20672F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040200, "uuid": "c4f839cd-28ba-420f-bb49-db8c64a4bd18", "value": "3072:jZAMwTiclEX+tgBilM1nK/N39Zk72PuhvCJ4nUP01i+FgvCrZnAb:aTiKEOtIi8nKYVVCJ4NRkCFAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786040200, "uuid": "2302409f-484f-4154-8dbc-0bf2db311ee9", "value": 272444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786040200, "uuid": "feed9b4b-545b-4da0-a724-3a5ad46da65b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786040200, "uuid": "b6f1d69b-aa3f-44f4-a1b4-4f90152f2a79", "value": "pope.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be61c5cf-913b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785982120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982120, "uuid": "e8373ac4-ab65-4388-a4e8-102599d6b393", "comment": "Malware payload (Mirai)", "value": "6060fd2f074c04524acc6aad594bb8b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982120, "uuid": "3ecb70ae-9132-4d34-ae87-7703b57744bc", "comment": "Malware payload (Mirai)", "value": "f819a2a054b85e6d4d85cd5df2fa6682630f6afd4b7abeac159980b0e98452d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982120, "uuid": "b73b6778-96f9-4218-90c2-5102d609a49d", "comment": "Malware payload (Mirai)", "value": "6f3f5e82e0453b707a8ce397893c0df6b2b14c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785982120, "uuid": "f7653420-227b-4536-b5fa-4a3135425cbc", "comment": "Malware payload (Mirai)", "value": "7afd0261e7ba2b47e5849fff7a6f2f1ea1fc1d1eca6d14edf4a5c7bbb0e6fb49d5d6d4abd33fa17d4c133ea88e73f2e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982120, "uuid": "4935305b-9552-4af9-b6fa-5dd37795f5aa", "value": "T1C7F2E071E1E9AA23CFDEBDF15CCA9B963BF63E6836720D5140895B50129E0F947008F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982120, "uuid": "64aea321-94c3-4550-8465-66c76bb0b6a0", "value": "768:HdPkw4kSeNkHjEYdsY23VF9OpGmC6nWn1elkIVgxFrAn74uVcqgw098:9B4k/Nk7SPX9OpGKWn1euQgbAn74u+qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785982120, "uuid": "4e4cf01c-ae92-4a0b-96cd-8e7aba72b4f5", "value": 35132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785982120, "uuid": "146760a6-9ad9-4824-9664-113aa8e9758d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785982120, "uuid": "a77a5a04-843d-4873-8a52-2d6832c1d401", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7505434f-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030960, "uuid": "7feb2915-0319-4502-9ef8-567803931605", "comment": "Malware payload (Mirai)", "value": "0c95c5f595227433ede465b00b911b62", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030960, "uuid": "1aa533c5-2e92-4690-a599-b962ad206880", "comment": "Malware payload (Mirai)", "value": "f88af7d1eb01b01fbcf5280025c61342224bf773a1b5c8d15ad8e8b86aea980a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030960, "uuid": "1f50ab78-6ac4-43d5-9485-2b4a47dccb6f", "comment": "Malware payload (Mirai)", "value": "87bb288b846414221f45fb7e468b64ec5e4d13e2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030960, "uuid": "55e0bf36-4fc1-474e-b6b1-00b0184c9f30", "comment": "Malware payload (Mirai)", "value": "dc80b98f66eeb4b05cece5d30b7b1e7d8dfb10f93dfd76f6c42d72ea841f18e9bb95d72b8e01c77bb3b0afeef109503d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030960, "uuid": "03f8a4ec-90a3-4aad-b977-7766b8c65e05", "value": "T1A4F43A55F880DFA2C6C125B6F65D46AC33174779C2E772068A258B343BEB86B0F3A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030960, "uuid": "b4e806ee-f244-4889-b5ce-3b5e51b13b55", "value": "12288:tNLhllrbxgxm3FYvTu68dU5oCUNaj5XmfCMC7cldS6pKT7g8f:7hFySOL+NS5Xmf6AlUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030960, "uuid": "0405a1c1-c3a4-4b70-92dc-8f47ad883133", "value": 726416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030960, "uuid": "2461a0a5-781c-4caa-a193-f1f3a15fb19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030960, "uuid": "c9cb8860-b618-4a1e-84b6-5c541cf36767", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c9c7f7-91bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786038580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038580, "uuid": "b5e3d7e0-f08f-4e94-8ec0-728b42cde000", "comment": "Malware payload", "value": "9cb6886001913061e05ddeadc4fd4250", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038580, "uuid": "b39b61e3-c530-4389-9f7f-55f8c6b8ef47", "comment": "Malware payload", "value": "f8d7812cd71ee6db6ccd5e0890107b0f35557cbe176dc3cf7ac3ec1a6f5ed81b", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038580, "uuid": "f9b1a96e-d1d1-431c-b0b3-2917e4312136", "comment": "Malware payload", "value": "0c9ea88cddad80564f235179f3efb0ffed6338cc", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786038580, "uuid": "5d933578-c74c-413f-aacf-85d50745c430", "comment": "Malware payload", "value": "c984c511c705c262a4d7364673236fa02acff299df386140e93a60d9bb11e20db8c67797c5741e8099617f5e826cb1a0", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038580, "uuid": "2564cb1d-b5f6-4f1f-bb34-3718595d2e34", "value": "T1A712A5494C82A56283B289ADDE26D869F316370767262012FDACC6535F78726C3789BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038580, "uuid": "a0a6190d-2ffe-431a-9738-b41848282775", "value": "192:hyo6LkVD54ix/o8HGJRVxM96UNXRWW0QM9W4CsId0:hyo6LEis/rHI864099a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786038580, "uuid": "b8b59d9c-e6d8-4942-9eee-55a3dcdaa41f", "value": 9646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786038580, "uuid": "739b99e8-c5b7-4757-9a34-a73dae3f3ae4", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786038580, "uuid": "a7bd0259-096a-4e9a-8bff-c233ecd61014", "value": "1.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0641cc6a-91f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786059550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059550, "uuid": "3d5781b2-1635-4fcf-8ef6-d4915ac0d73c", "comment": "Malware payload (Mirai)", "value": "1fafe93899795acaecaa8ba1835ddab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059550, "uuid": "ac4cf777-0b4c-43f4-b48a-61b75f0ce012", "comment": "Malware payload (Mirai)", "value": "f949ba49ba8db0c49c0e22fa8c6f84ba7da8530b2bcc00c0df0f9cb17c69486f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059550, "uuid": "fb3d7083-e157-4838-a5c8-4beb68d3486a", "comment": "Malware payload (Mirai)", "value": "ce31ab6cf1ca508fd8f1b54262b14a94094340dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786059550, "uuid": "037fd6b5-584f-4fab-a729-ccbd59e02760", "comment": "Malware payload (Mirai)", "value": "2592cecd27e65967090fb2f228564c9f66b0d0b3ad3f893cb2245f1ae7d7dd7b75761ec64d27dd4d900402e091509e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059550, "uuid": "1c0fca23-8963-42dd-ab35-d64704a46cd8", "value": "T154C36CC1B10C7EADD5933D7DC20613176E1C9A55DC83810190A6FA53EAB76E32E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059550, "uuid": "5e1bbbc7-7dd8-4694-8589-0710e2cd0ac9", "value": "3072:YfEkkWHEPZ2QHKFZOKSP6X1ypvMctaTQLLjyoBrnQ:QE0OZcCKSP8wvMcgTQXvBDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786059550, "uuid": "8d60e09c-caef-4c33-a869-f14364509186", "value": 125308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786059550, "uuid": "95675c3c-f946-4840-90ce-e0f9b05c1226", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786059550, "uuid": "dadd601c-40b3-4c0d-9d7d-bca81da2ba56", "value": "f949ba49ba8db0c49c0e22fa8c6f84ba7da8530b2bcc00c0df0f9cb17c69486f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e4c1f6-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026398, "uuid": "cec708a4-d33f-4cb5-9d9d-c161fff7b1a4", "comment": "Malware payload", "value": "689871c84b22bbace16bc7b45fdd3a6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026398, "uuid": "1f6671d0-b56c-4143-9518-6ee07522f630", "comment": "Malware payload", "value": "f9885748dfb4828aa71a3cbce37b6b30286313ef1aa6794272c0ac09ac2c7b60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026398, "uuid": "b9976690-83bf-4140-b19f-76e7bf48b37c", "comment": "Malware payload", "value": "cf87df642c77932ae53f6d8d2f4cc419d9c02286", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026398, "uuid": "606fe8da-5b20-48c1-9b79-49665f81784e", "comment": "Malware payload", "value": "f4f4654b90b53f168cd7f10e68c2a2f9d6e7bff86d819d4b683d67ed7400c2aefc0b9ff6a97c35b3e47bdc08d57f354c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026398, "uuid": "d74497ac-3ad4-436e-b658-47a78ca14283", "value": "T197313D9A42045A322102CD9D77A33158B68EE2FB189FD7E5984D0FBA82486D8F271F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026398, "uuid": "de691b83-5542-4eb9-ae61-96a519f548e1", "value": "24:Tj47jTKuMuoCQ7VdFqla47pUZsdWVTVuH:TUja/RT47pUZPVuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026398, "uuid": "29a80090-d3e6-4f0e-a43e-ef9d667859e4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026398, "uuid": "0b306bca-2769-4338-9aa3-0ec922279d9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026398, "uuid": "0aa39f94-7a6a-4b2d-8313-3f4975301d4c", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfab8ecf-91cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786044453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044453, "uuid": "ccd4c67e-1dd1-4ad5-b820-2e03046a634e", "comment": "Malware payload (Mirai)", "value": "ac86f9bf68dd9b29254101847ca8863d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044453, "uuid": "45e0051d-c4fc-4e3e-a807-d8d580043063", "comment": "Malware payload (Mirai)", "value": "fa07edca90e67b662266661840a42d4ada8964eda0a3b7991974b8fad2a2fcd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044453, "uuid": "21261136-69a4-4fcc-967b-cf997b794e39", "comment": "Malware payload (Mirai)", "value": "367ee585b37911c31f3c79f964fa6099915987d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044453, "uuid": "0e188489-f92c-4b86-baf2-18caf61ac727", "comment": "Malware payload (Mirai)", "value": "e40f93aa95d5185d8c872f566119974776666ee557084c9cf875af31ff688144c8cca7d9af7b4caf17f9d715fafba37a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044453, "uuid": "75ef62da-57b7-40f6-8ea8-b78a3e3e9ccb", "value": "T14414965A6E228F7DF268C73447B74A34976D23D627E1D684E2ACC1102F6039E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044453, "uuid": "595e755a-4a94-4381-b995-4621698e5ec1", "value": "3072:DI6dK2d7g/1r+qdfibi4v4WOrgbR86oKMWkCNTM4KGtjsZKNgSS:DI6dK2dU6qdfgQcbR7orCTRPwZKyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044453, "uuid": "76e3bc74-db1c-42d8-92b3-7cc265e80489", "value": 190532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044453, "uuid": "0d37f780-d072-4e83-89d1-8d463258afac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044453, "uuid": "c3734496-33c6-4138-8b2d-ccb864485058", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fb8d6e-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "8cd05ad2-670d-443b-bee1-38cca2667fdb", "comment": "Malware payload (Mirai)", "value": "cba4a25703c8e9f19895b7a46edf66d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "a2485bcd-456d-4175-9def-e53d4fbd2781", "comment": "Malware payload (Mirai)", "value": "fa12e417bf8d52cfac80d55adea71909109860b0a8f7fbd1e2486a39af6e1c13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "cf39c8bb-fbcf-47c8-a73e-bd9a53dfbb40", "comment": "Malware payload (Mirai)", "value": "64790a926e53cb296245cab5befd686e2782c7fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "0fe75186-f826-45cf-84f2-84fee805b7b2", "comment": "Malware payload (Mirai)", "value": "efb23ae2c5c8869b2ffde5f237ce50e5e28861f94463a2896be32a0c5ff0ef03e0cd16e5a65574f6603239d4d67b9499", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "6b8a248c-25a8-48bf-9a67-48959d3517ec", "value": "T196A3029DE8B5DF10C5D86CE3C93A38DCA848D2C4947448D2AB848DFCD66E58B725D473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "45246db2-70cf-4ea3-9e8d-e18e0b40fdf3", "value": "1536:GvdMCn0qN0mIN8CaTZ1NyZ4yZRp40LdzS9ZuooDeKkMOheSNDWSqJ3KzTNcr:G2G0mY8CanN+4yZRp4QS9ERDFdOP7zpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048007, "uuid": "3ae05f9d-25f1-4f09-add2-a5531f34a58c", "value": 100964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048007, "uuid": "30fc1ebf-d876-47f1-a3f5-7a04ee9f0b2a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "161355b5-18c4-41a9-bdd9-abc3f0194a03", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b2e4ba-91ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786044999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "770d06a1-66c1-4061-8efd-5af1bce288ee", "comment": "Malware payload", "value": "c6ec490bcc247211d39d6f943c6949b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "19aec078-1594-4509-9626-a0545024bfa0", "comment": "Malware payload", "value": "fa5863411095c9098a1b29e557e1f0bf5083e6b40a0b9cf6c73851e03c8627f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "93d9d02a-f793-4a74-86c8-d7c83e4bfec8", "comment": "Malware payload", "value": "207bf867f0771ad91295a7cbbf28d519f79f897e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786044999, "uuid": "abbd6100-5ebd-4d6a-8660-13203b163452", "comment": "Malware payload", "value": "3b0ac95f282082f486bc5dd77538e2afaef9912c32eb6cf486f0cce5575d56645bb5359a5eaa555e3199eb5def271bff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "5985b2cb-1abf-45bd-9080-822669a73ddb", "value": "T1C1210F8267317D742C88465D71AA507A6083122F565F7FE8B4D6AEBB1F4C980F198FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "6587d1be-9ae4-4c79-b3e0-a85a03ffb42f", "value": "24:VUeYj+H1NDMK9CFdYhEnHQBYcduuD9aMzI5sdARipr3AnQZaZl1cSRs/:VUeYj+H1NDMK9CnYhEkD0MzlduidwOjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786044999, "uuid": "7b545f15-31ef-4714-9077-3b7545a1ef10", "value": 1370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786044999, "uuid": "a889d72a-d3f6-4eb2-9b19-a84b4e983622", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786044999, "uuid": "90f81f3d-797b-4fdb-b1aa-f824429ad12f", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2630ab1f-91d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786048007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "d5f40c31-17fa-41b3-b90e-e0258bd9760f", "comment": "Malware payload (Mirai)", "value": "c1076ad9dc42ff5296c0bebda23f8120", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "ca602c97-774c-474c-bf82-5e1ed59e3904", "comment": "Malware payload (Mirai)", "value": "fa647a06db06e6a26bff28e6ff34400c5344ad49a598f959d110a6437be85e05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "4a534179-9719-4b29-919a-4508bd56b62c", "comment": "Malware payload (Mirai)", "value": "fe5da622aae74c8b6f8919628bafae61753ced97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786048007, "uuid": "601eb2b7-0718-4055-b611-7d40f899f037", "comment": "Malware payload (Mirai)", "value": "716cd5ed805cdf569a13ca7117afd208e6b905a7847b78a0d6177bec2eb119f70a10a312b238f591b52f97bd9e612292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "625627fd-c959-4c4c-bc9e-9e409271f321", "value": "T163E35A42FB83D2F1E99315B0002BA71F8B349D398124DB4AEBA52E71EC75706456BB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "0a25c857-936f-406a-b033-f5d74e6404f2", "value": "3072:PlYwUxnDE1ZtD72kQLFlWa+14nx/GR4R2xlHGaeAQAaBqT8VD8H:9YwUSZtD7D4vWaY4nmGaCh3V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786048007, "uuid": "21257f3d-2e0c-4211-ac70-91e34e88218c", "value": 157052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786048007, "uuid": "d7e35836-46ea-47b6-a799-b3ba2f5950cc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786048007, "uuid": "ede7b95f-fb7c-41bc-836e-e579ff5c4cb6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdbe2d4-9155-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993285, "uuid": "d62109a2-65a0-4e73-9a43-f4d2d3d4ec37", "comment": "Malware payload (Mirai)", "value": "aa45044e8bb168b4ff0ba4edefd2a856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993285, "uuid": "fd5247dd-43e1-42dc-afbe-33713f46e897", "comment": "Malware payload (Mirai)", "value": "fab31503271ed1fdead93f6cad531eda6a76e17457aade9f2e3c3a7c6c61d42a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993285, "uuid": "9e776bbe-1546-4711-86ed-4f152fc48e27", "comment": "Malware payload (Mirai)", "value": "e827e7a5dca090e11e28cd4ceae998e738115ee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993285, "uuid": "a07336f1-3cb5-42a8-a9d2-061a993d9e4c", "comment": "Malware payload (Mirai)", "value": "d29831d97046a9bfd15c780e53e810e96abe0a55b2221b378abb35d91dccbe71dcc82ece30a6e114971dabcf83114702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993285, "uuid": "d155db03-717c-4cac-822f-5303dcb9b5c0", "value": "T19F93128ECDF2B9E1C12D1EF7C4D80583BC1E518BA889BF97176C8499543766CA93E078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993285, "uuid": "1c93659a-3d71-440a-b930-2c7473b5ce17", "value": "1536:2AvHILZD3UafB4ZG4M3JdhdOGQ6y8IW+IqBC+uxD/DrrP+2F+gsa5GrXaEB/Op5/:BPILJEafGM/fG6y8IVIQ6n+2FRs6TEBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993285, "uuid": "3f6d1fa2-7a34-45fd-93f5-858ad0b84d58", "value": 92840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993285, "uuid": "b661e10f-7b2f-4229-b902-56bad1594f56", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993285, "uuid": "4b4e3634-a849-454c-9015-5bf45096b8bc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76550e1f-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786049001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049001, "uuid": "d4b0f6aa-97c9-43cc-9bb0-549324f72b5d", "comment": "Malware payload (Mirai)", "value": "976860bb023ed8257cebf6c76a500048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049001, "uuid": "14e7c4e3-d7d0-464c-84e8-b8e316556c1f", "comment": "Malware payload (Mirai)", "value": "fbf3ba7e12da62cab56189dfc0c7ef1c9a68ec5379bda7e4ce826b23559c2ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049001, "uuid": "d488e4f2-ab5a-4c16-8281-7b52bd3f26ca", "comment": "Malware payload (Mirai)", "value": "610d9b2a90789b984d872e97dfe781fb1ef11df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049001, "uuid": "be1ff9b7-e7ea-4f19-b64f-09899ede81ad", "comment": "Malware payload (Mirai)", "value": "dd2dfca00a24b181d1963ee1f42c7288193a336f27dd604104f27e988bb532c28d10474273086f78d3ebd0b04ef474b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049001, "uuid": "89ec5506-bfd3-4c4b-b0d1-3e10a4e889fb", "value": "T1D6C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049001, "uuid": "d41eb0e1-182d-4bfe-985f-a20f1464ed87", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy2w:VoRNjmj1VGFVrRiyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049001, "uuid": "a14a84ad-58a3-4f1c-9975-1c2a370db5f1", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049001, "uuid": "9b4fe94f-118a-47a6-ad1c-5b33006c23c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049001, "uuid": "7a9905a8-6236-4c23-ad8e-1b627dafe7c0", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c3ebda-91ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058954, "uuid": "861ed0ad-090c-4b53-850a-1c3404c953fb", "comment": "Malware payload (Mirai)", "value": "7e219b47e1417a0a965b98adaf69e812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058954, "uuid": "41acad40-777f-4a40-9884-0a5544686353", "comment": "Malware payload (Mirai)", "value": "fc09cf6556d51f47fac884e51c4eff76d43bf44ab9dba7578123d8aa19dd3585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058954, "uuid": "783abcaf-79fa-4168-ac9e-de1d91624f7d", "comment": "Malware payload (Mirai)", "value": "29aec684f3603d2a0de11a0f681c60d5dd009e21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058954, "uuid": "12bb0a6f-7049-4581-9d4a-7612be85697f", "comment": "Malware payload (Mirai)", "value": "2901fe528c5dd8fc4e6129c1aa985f7c76aaa1e7dd06014e8606cbcecb304e875826b167759725a4a61256f31e73a891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058954, "uuid": "055b6f15-50b4-4811-afc6-fba4eb81b22a", "value": "T1DF53026AC147C2B1C1799A322F0C43F4DD71E5C217A79F8BA689F1BD48A7F906444399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058954, "uuid": "83da01a3-ad5a-4440-a69a-ad6cf3c0917a", "value": "1536:/lWnNvVkpdSUxQ4gXxoeoO0CVNF5n5lO5t:UTuxQZo2D545t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058954, "uuid": "d1dc715e-f703-4139-a9a3-3df4646da2fb", "value": 60956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058954, "uuid": "d4f7068f-025e-41fd-9ab0-06cb429a1fa7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058954, "uuid": "ef6a7f25-ca5d-474d-9b55-fe4ea956ab05", "value": "fc09cf6556d51f47fac884e51c4eff76d43bf44ab9dba7578123d8aa19dd3585.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dad532-91ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786030963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "b126476d-1428-404f-afe6-82e6325576ba", "comment": "Malware payload (Mirai)", "value": "b0440ebefd69a3032d1855b197a941f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "3ad8e633-7560-4512-b66d-c573c2a22261", "comment": "Malware payload (Mirai)", "value": "fc113466214a0de92edbdede08b402378cfa90fbffc7ce219c7ffc89fa6224bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "fa6d8980-bcf8-404b-8c18-0a0c5b0bf27a", "comment": "Malware payload (Mirai)", "value": "be94e9486f1e851fa086dda4e663d9bc746720e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786030963, "uuid": "470dcd08-1ebe-498d-8528-af95735ab5ae", "comment": "Malware payload (Mirai)", "value": "124cf6d31915b8e9a8d7fd6536cced8ec3ba4c4c914dc87292cb3378472b2c65510470ce41ba688492bb36d360336d9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "638fabed-64ec-4d63-bb11-23788fc168ad", "value": "T1FF253942BF1C0563C9431DF1693F47E5F7257A5240F88229371EAB5B3631E36AA8339A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "e37efa29-f5b0-48e6-b0b5-e895350da1a0", "value": "12288:tOeYl7Ftk8Cs/Pkh0uXtJQYULkUkX4bIzfaoU1erPIiaBNEcsn/opw0h2ldCVj:1yFtktXLB4bIzfalBB2cs08ldG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786030963, "uuid": "eea824be-9fe2-481a-9cc9-e756603c66a1", "value": 988208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786030963, "uuid": "f4dc3a81-4527-4379-ae14-971c5ce3fb94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786030963, "uuid": "8007329e-b2c3-4a96-a232-a768664af4de", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7538aa98-91b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786034396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "044d92b2-d89f-46eb-b39f-6d5d00e9f006", "comment": "Malware payload (Mirai)", "value": "4a85425cc8f92e3064793378ca715bd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "5dd1feab-4056-411d-8b59-02e0684c494c", "comment": "Malware payload (Mirai)", "value": "fc16acc4bd3243ec0ac36920f73ae9283ec1d767ace3fcd645a095cc653963d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "31b17d96-3065-4c06-af13-92011247ec44", "comment": "Malware payload (Mirai)", "value": "509b1eb1048133eceff5d6ffbf5e16a4a0d12269", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786034396, "uuid": "e89503f1-0fc2-4437-8b08-79893db6b8dd", "comment": "Malware payload (Mirai)", "value": "d1195f0d48e96b4df2044c4e0e928028254e96d8b249f4ffc7758decc2496ba796f6b0a18ed752d577e511fc907a7fc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "c53bf99e-3ffd-4586-ac64-fdb86712abd8", "value": "T14B041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "30fe3cbd-edbc-4626-bca3-caf383372817", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMnEzvQ6WJ9G2/7ZiYlTBVmJTY:J3CTRdrD5GFnrPUEsNzZt0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786034396, "uuid": "783d4692-aa1e-4c5c-96a8-1c4057f31aae", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786034396, "uuid": "66bd0b3a-b21c-4af0-bab1-9f861e0743b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786034396, "uuid": "01ca0a68-3ea2-48ef-a30a-56a1f3d75b82", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934b4ceb-9198-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786021991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021991, "uuid": "38ec3213-f4ac-4c8a-9a83-d4beceaa9684", "comment": "Malware payload (Mirai)", "value": "dbd6552fe40f2954d446aac02737cebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021991, "uuid": "f205a4ab-66b1-4fa3-a032-19d56e83b5ef", "comment": "Malware payload (Mirai)", "value": "fc74ff6113dff8b86c5c5ef9e5bb6307a557ff4234a0e67a76b98c2bae5d931d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021991, "uuid": "15b93640-a2f7-43a8-bbda-13b55accb60e", "comment": "Malware payload (Mirai)", "value": "3c54e0301c3da89f453de68b3491aada86346cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786021991, "uuid": "17a402f6-0193-42c9-9914-eb9fa653dbb0", "comment": "Malware payload (Mirai)", "value": "dbbb17708f4f4cc6cada749dd88db341156e4233aaaa6de5b58e5022dc00737a8822ef40b5a36965acc7a226288c9d11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021991, "uuid": "402b515d-eb25-4136-af84-73b27d205e97", "value": "T1B4234C46FD268320D3A216F05FF65A4257416E6638D37300D8A8FB3CB9AD0A86793DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021991, "uuid": "2dc92309-5edc-4989-a8e2-a49c16f25a92", "value": "768:2fMJrSyJet0hNfUjMBmvnWbVuDhwilaQJTVgqYH5lMpxYrxC64n/lT0kn+y/mvwm:xJGADNflmXivfUvntTPnCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786021991, "uuid": "c6f9cc03-07ff-4d31-a086-3e9731736256", "value": 45944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786021991, "uuid": "2412a9fb-b638-4ed1-9e0a-3a5076a49ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786021991, "uuid": "aea42d01-a146-4dc4-9fc8-cf542637b213", "value": "main.riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dd45f6-9157-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785993889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993889, "uuid": "8cecf133-94c1-4aae-917b-4b025d890071", "comment": "Malware payload (Mirai)", "value": "d1b337f17dc7b9b64dfd272a769e8eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993889, "uuid": "43d02863-dede-43dc-a0b9-542ba90faf8c", "comment": "Malware payload (Mirai)", "value": "fd572d74d7905f517fef099b3304f09f87029c94fb6080827f985635be919d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993889, "uuid": "28317f0c-a3f2-4970-825f-a5bfcada9b9c", "comment": "Malware payload (Mirai)", "value": "006904d697627c01c40f941a151fb0d9cc26c44d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785993889, "uuid": "4b199a5d-352a-48ab-89ad-12329891675f", "comment": "Malware payload (Mirai)", "value": "1d084e2a94cc2bb2b484a58605a83a8ecc462701012a70e5d1af060fa7cb370aee0a639e6de0fa686cd457fec8e8dc80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993889, "uuid": "275dd722-706c-4031-917f-d06107c0225c", "value": "T10C631201E33DD58BD8D4B5B6E8189F6276ABD6F4BFF9D2A93194D7500241C3C4820A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993889, "uuid": "ec9065e9-f555-437c-8f2a-4677630d3cce", "value": "1536:Jbl2FDCLaLvskssD+9bHBuSu4UhaOdgL327mY1GSOQv:Q2L8K9cXTYOdgLWmY1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785993889, "uuid": "cca8bf27-fcd1-4884-ba5b-cb16528ae3f7", "value": 68524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785993889, "uuid": "01ef3272-dd56-4f3b-803e-2e078cbcfcfd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785993889, "uuid": "f94eae83-87bf-48a8-a360-2b990a4304ed", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b38f5-91eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786057456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057456, "uuid": "c648cdf3-5948-41a9-8e34-aa98dd2fe40b", "comment": "Malware payload (Mirai)", "value": "735890fa4a6428dfa85a29c0c918a4a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057456, "uuid": "a8980978-81c9-443b-bb94-535acbd250fb", "comment": "Malware payload (Mirai)", "value": "fd720b19a62efa97b733d8f816a8a1e49867e50b042d6353d23ef8d8ad54458a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057456, "uuid": "94320ba7-b3bf-46e8-a8c9-81b50d1ba691", "comment": "Malware payload (Mirai)", "value": "179a54adf77861a534b583069ef6b96f23eabdde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786057456, "uuid": "622d5a8f-0a2f-4547-a751-d78e11a2299d", "comment": "Malware payload (Mirai)", "value": "452f0d7d7902494da8f1c9ab0994064785d315cbd176c38f83ed0029e45b892c997f58343242c5db7a901e3f0ad44e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057456, "uuid": "87c0790e-49a4-4e2b-a656-5e8ed8caf512", "value": "T112831229111913FDDFA34D7052B7B8F7B8A4A079A2C4E2D67540CEB86B490A1F7051E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057456, "uuid": "5851dbfd-6b9b-4a75-ad85-00f105ea6eb7", "value": "1536:MlZCNQKJT+1n0Rdiaz3Koqbnede8zucQHeqLYH6RnfaoHzBZQqI2j+NsNP/ej0HD:uwJalJ0yer4HeqLYH6F71ZnCNsNPC0HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786057456, "uuid": "21bd67fc-c7b4-4ae7-a82f-423e1479ed75", "value": 83736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786057456, "uuid": "4ad05406-f4cc-4a8d-b64d-6ccdc3894d31", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786057456, "uuid": "c8cd50eb-08e7-4231-8678-429cb4976fef", "value": "fd720b19a62efa97b733d8f816a8a1e49867e50b042d6353d23ef8d8ad54458a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3d1e43-91d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786049362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049362, "uuid": "77420a6e-74cc-4be0-99fa-604ce92d93c3", "comment": "Malware payload (ConnectWise)", "value": "e4a57306d4d3d0271a3578643693ace9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049362, "uuid": "53ff109d-6e42-47bd-9e7c-c5d5ed5389e3", "comment": "Malware payload (ConnectWise)", "value": "feb0d77be627d1f050fd5ff77c1e1c2c2342b79b28a4a629f35875ad0aebb4ac", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049362, "uuid": "e47a887f-47fa-4f1e-bf99-1e88f060d450", "comment": "Malware payload (ConnectWise)", "value": "b779772c9c9e4b8974ed7a3e01938ee1cdb43ea8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049362, "uuid": "e4a04044-b26f-4185-b393-b66074299ec3", "comment": "Malware payload (ConnectWise)", "value": "347549de02a691d4a2273f975516c81f15d1c151b1993d62be43245a8737735ac1cfa12de8b82d64bffd98adf22acaee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049362, "uuid": "6afb68f2-c51e-4614-94a1-00111fbf05c4", "value": "T17F46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049362, "uuid": "e99dab7d-8e4b-49f3-b2fc-a396dcc842f6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049362, "uuid": "30b74bd1-1ad7-43b1-9b26-db52d59a1dbb", "value": "98304:pzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:phfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049362, "uuid": "29c61ef1-712c-4bfe-bc90-00641a73d218", "value": 5643472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049362, "uuid": "6fd90d37-7d14-4e79-8ad1-0051f066959b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049362, "uuid": "836d80dc-abb0-4f45-82db-7cd96adf7743", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225ccec3-91a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786026097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026097, "uuid": "d800998a-01f1-4a7e-b2e0-8c1b537745f5", "comment": "Malware payload", "value": "c7025f4b92aeabdffe3524b98a38935b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026097, "uuid": "d9c00bdb-09a4-4449-9c72-617118c493d6", "comment": "Malware payload", "value": "ff2ca63ce0afe23545e57623af69aa39055f089501cfa524217588b2b7c06292", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026097, "uuid": "f203908f-309e-43a0-a916-2adf68c33602", "comment": "Malware payload", "value": "a4af807f8d4a056b89f1b865f6ac6366d4be3e73", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786026097, "uuid": "532ee814-c254-48f4-8a87-0353d2d31469", "comment": "Malware payload", "value": "a9ca0d56eee4ef993744d6ac846a1dcd17d01e77343051b26c40459f4157b7a162ee565c499d8ba79de445998f491d7f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026097, "uuid": "bb699f3b-2935-40c4-8fdf-f301cb40d8df", "value": "T1BA151212FE808937CD5257380F53A2D1E21DBC6B9E6A9B0B1785337E783B6E4D952C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026097, "uuid": "4e76ab65-07d4-4fbd-9e5b-e70168c0e215", "value": "24576:JKNt1QRT/64rmfu1UiVN4jtE9BmLf27XmEqq:JKNtmB6Bu19v4xE9By27Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786026097, "uuid": "06b33c99-bdca-4c6f-8d39-73dbc04ad117", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786026097, "uuid": "fa7c1ea2-9d15-4256-855e-501fc6f5bdc6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786026097, "uuid": "5742bf99-b15a-4b85-b8d0-3faf9425c227", "value": "SINO7300194.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e0675b-9158-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785994488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994488, "uuid": "4c23cd85-d431-4e2c-90c5-0f739674aa70", "comment": "Malware payload (Mirai)", "value": "7bbaef0912fd573348b41dbc4969b247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994488, "uuid": "81376631-580b-4fdf-b974-c257df981287", "comment": "Malware payload (Mirai)", "value": "ff50ab25dced414673e87e913e8000dcf04011a44b3c763224db8b574e10c94f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994488, "uuid": "e4c3f419-9b64-4b5a-9fc3-7048123758cc", "comment": "Malware payload (Mirai)", "value": "6a7bb274f7385700480669afcb37f8cb5665c11c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785994488, "uuid": "cf7d5154-7927-4a3b-a3cb-bf1a4bafb0cf", "comment": "Malware payload (Mirai)", "value": "653c718cb723bebb0e582ba9d59417c0ffc2c37e2cd2295a3ae6f6d4a96dc124c238132a1bccc6ea9fdd1425a3d85750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994488, "uuid": "97bfe519-5873-42fd-83e9-56e932ba1fba", "value": "T1EAC30A52BE418F13C6C321F6FBAE46583B176B7DD7EA3102A924BF50274B8DA0E36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994488, "uuid": "07516c5e-5293-485a-8368-88c22e3710f9", "value": "3072:kLE0n5R++pFz8Om/aNPG/RwG1aCDozD6w+IOK:OR++pFz8VEG/Rj/ozD5+IOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785994488, "uuid": "140308ed-39ce-4444-a9e6-84454139d2ab", "value": 121676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785994488, "uuid": "50aff3a9-04b2-4126-b83e-de8107efeb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785994488, "uuid": "45e92329-ae2f-4a1c-9f9f-e11082650142", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8854b2df-91d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786049031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049031, "uuid": "e0bfab8f-2cf2-44f4-a6e1-e93d15f5c25a", "comment": "Malware payload", "value": "4cf3e8bed9ffc1acc16c2317ed716b3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049031, "uuid": "49068b49-665b-4a18-8261-47f5d25cdac3", "comment": "Malware payload", "value": "ff602817eb50e8e361871af7c6dd1351c06671f310a3eb2a0692f89df6eb3a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049031, "uuid": "adba5672-0706-46e6-a77e-92a9457b99eb", "comment": "Malware payload", "value": "1847543325c1f4cb3569c382daa629b618bfcdd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786049031, "uuid": "387f9232-6007-41bc-901a-d2c719ccd317", "comment": "Malware payload", "value": "bc3ddf23be0d0c24c6127fb55b776c882ea400b77425e4517746e4afbe14e446c1dbe0829be675a4bbc155f88e344ad6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049031, "uuid": "4cfc4cec-7123-4e57-bddb-b95953dd7c2e", "value": "T1ACA35A0679C1D0FEC8E5C2B48BEFE13ADA3274095134B61E27C87E262E5DF212B6D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049031, "uuid": "75b4a869-0176-4dbb-8096-6493752f91ac", "value": "3072:U3Y4KAGZpQVplHmN1gqr8ODAyn5ylj2Qe:U1KAhXe9Gq/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786049031, "uuid": "2e95ebda-c88b-4231-b9b1-0d8067082079", "value": 101431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786049031, "uuid": "ff5c2114-ceaf-4813-bef0-c8c309f56492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786049031, "uuid": "2c554427-5a3f-48b7-b119-e2ad97991714", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd50398-91ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786058677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058677, "uuid": "2abfeeca-d5b7-4d88-8b58-d042ef6a4c2a", "comment": "Malware payload (Mirai)", "value": "559ec197356fa29937dc96073285b140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058677, "uuid": "69ea77a1-cdd0-4a8e-ad26-cd8b56a2aeed", "comment": "Malware payload (Mirai)", "value": "ff75859841364fa791b47c073bd4a4f37d32be48ce349749a98537b0d0926996", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058677, "uuid": "0a732ab3-fd69-4e0b-a614-d144b2aabb73", "comment": "Malware payload (Mirai)", "value": "969014c57e3e4a83a7abfb6fe9543272b96975c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786058677, "uuid": "fd540ccb-0ec3-4bec-87a1-da3dcf15d2c1", "comment": "Malware payload (Mirai)", "value": "1e2397ea414b51c49067bb61d6b347e162f6f5425b6107cba27c30910e4dd42977a16eff410438fd39ba08e7c878ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058677, "uuid": "7dd56f53-3480-4929-8359-a77f55b16600", "value": "T16EC329A9F890DE52C6C52676F74E418C33231778D3DA7106CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058677, "uuid": "baa38686-2137-4f76-a2c3-b3cbbcc19122", "value": "3072:8E/eDOpvJF41gFIXbcYEEU5ajMWxNwhUhGw2P7KNyF3j+uzf1Dl:8wEuFCbcYEEU5ajMW3wst2PnT5z95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786058677, "uuid": "690a4d06-515c-4804-b81c-07727b7f2475", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786058677, "uuid": "ea98c32b-0626-4b16-bd19-aac0d4205fce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786058677, "uuid": "cc6c88e2-606e-4fde-bc44-12e68e09a62b", "value": "eb2ee7f82fbb97e22c940a837e3544f9d0ebee6ca4e875cd45eb36f546154635.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48de58f-9140-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785984278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984278, "uuid": "85a05d41-9999-40d8-86df-b2d82ec536d1", "comment": "Malware payload (Mirai)", "value": "4bb19cb9e89759128972dd8d803ab4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984278, "uuid": "01a4975d-b1d6-4ff6-854a-79b337457815", "comment": "Malware payload (Mirai)", "value": "ffb0668a571ad16e671d71ee480fa292e94357c6cfc794dfa38be1a37779e431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984278, "uuid": "9068208d-21e4-44b2-8dc2-73a6f4127ff0", "comment": "Malware payload (Mirai)", "value": "59ad2caea7b2d07d5101d4a72e3d198001f4be49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785984278, "uuid": "91f9a212-fb7f-474f-b13b-0a36346db108", "comment": "Malware payload (Mirai)", "value": "84ad79facd7a4b42b5a499f00e156b8a1d769cf3b4b7773e2e48921cbc116a8315c2a031abecc6539c9f24b7ca2f86b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984278, "uuid": "d5a37629-1e5e-46d2-9ad1-245f73dbe49c", "value": "T1EBB3F959F880CA52C6D5267AFB4E428D33231B78D3D97102CE24AE3577FE95A4B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984278, "uuid": "8fc02e11-5701-4daf-9194-a7bdfa34fb21", "value": "3072:n4hqvUA4hakSXEd504awTVix8ezDvKeBEPg:n4h8UAcakQ4awTVix8yDBEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785984278, "uuid": "ca44256f-d78b-40f8-8e07-ff90723c4086", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785984278, "uuid": "6087c1bc-f090-48f8-b965-bfec9548727d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785984278, "uuid": "8ed96c63-1cdd-442e-8bd6-f5d21685866a", "value": "killbotx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b940a8df-9170-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786004875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004875, "uuid": "b36c3f43-c310-4915-a601-236b228a67ba", "comment": "Malware payload", "value": "f291c9311c17d8da82db7d3de027218c", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004875, "uuid": "21c05229-17c0-484a-bcb2-607ae20eecaa", "comment": "Malware payload", "value": "fffa5be744fc2315cdec4636a6c098c31ca40794a902883362badf0ac3f0c5bd", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004875, "uuid": "7c6daaaf-3f96-498a-9584-a8f72e208bba", "comment": "Malware payload", "value": "0931356d46971b3d0982a40d3c862ba6bee95f56", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786004875, "uuid": "d62ddb62-61a6-4d9d-b9dd-b20ab0c16557", "comment": "Malware payload", "value": "8559f5474b296eb46eeab006ebd78a95cfb778ffb7a724a570d09e0c955bd0ca4deac60511c8b67d26a0ac2ed535861d", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004875, "uuid": "d533713a-a49f-4cf2-b7c2-0bcae0fb8abe", "value": "T14C4623335B89592FCAB07375B01E6D227E6F4603424CF29669DCA07637FBBC5422E894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004875, "uuid": "c4bb682a-7dcb-447c-9a38-4f315761a749", "value": "49152:OynvPr137EcEDnXzlfZ4jn6OIB0juKTAnvhSxxrLJc9/pOvCZUQyFdm0jid3Goxx:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786004875, "uuid": "35758d73-1a9d-4a3d-9eef-2c8a722f6f78", "value": 5632000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786004875, "uuid": "9bebe019-d1de-47cf-b29f-8630b6f22b50", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786004875, "uuid": "83f7b4c2-09fd-4b34-8a99-ba226e2cb999", "value": "0Tramxrsonf_lmay.66772EFFN.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }